Top Class Actions’s website and social media posts use affiliate links. If you make a purchase using such links, we may receive a commission, but it will not result in any additional charges to you. Please review our Affiliate Link Disclosure for more information.
Before the rise in popularity of social media apps like Instagram, Twitter, and TikTok, Facebook was the world’s most-used social platform. Its use became so widespread that by 2012, Facebook surpassed 1 billion users worldwide.
Two years before that, when nearly half a billion people were using the platform, Facebook unveiled a new facial tagging feature for photos, which used facial recognition technology to automatically identify and tag users in pictures posted on its website. While the feature proved popular with users — because it saved them time from manually tagging friends and family in group shots — it became the foundation for a class action lawsuit against the company, resulting in one of the largest privacy settlements to date, worth $650 million.
The class action against Facebook (Patel v. Facebook) was built on a state privacy law in Illinois called the Biometric Information Privacy Act (BIPA). The law has been used in multiple class actions against other Big Tech companies like Microsoft, Google and Clearview AI, and could spur more legal action against other firms over user privacy matters in the future.
Adam Schwartz, senior staff attorney with the Electronic Frontier Foundation, a nonprofit group that advocates for protective user privacy policies, said BIPA is “the gold standard of privacy legislation.” The term “biometric” in BIPA refers to biological markers that are unique to each individual which can be used to identify them. The most commonly used biometrics are fingerprints, but with advances in technology, biometrics have expanded to include faces, voices, and, potentially, heartbeats. This comes with huge privacy risks — especially when our biometric data is collected and used by private companies without permission.
But strong privacy laws like BIPA can play a big role in protecting users’ biometric data Schwartz said.
“By having this, number one, strong opt-in rule and, number two, strong enforcement through private right of action, BIPA is one of the most important privacy laws that exists in America today,” Schwartz explained on ACLU Illinois’s podcast Talking Liberties.
The “private right of action” component of BIPA, passed by the Illinois Legislature in 2008, is particularly important as it enables a private individual instead of a government agency to bring legal action against an entity that violates the law. This enabled multiple users to launch lawsuits against Facebook, which lead to a consolidated class action against the tech giant in 2015.
The lawsuit, filed by Illinois residents Nimesh Patel, Adam Pezen, and Carlo Licata on behalf of the class plaintiffs, argued the company’s facial tagging feature violated BIPA by subjecting them to facial recognition technology without obtaining written consent and without informing them how long their data would be stored. In 2018, U.S. District Judge James Donato granted the lawsuit class-action status, paving the way for millions of the state’s Facebook users to claim damages against the company.
According to court documents, the company argued that plaintiffs did not have enough standing to seek damages because they did not suffer “sufficient injury” from Facebook’s alleged violation. However, the state’s Supreme Court ruling in another case, Rosenbach v. Six Flags, established that plaintiffs in lawsuits over violations of BIPA did not need to prove “actual injury” other than the violation itself, setting a foundation for legal action in similar cases like Patel v. Facebook.
An estimated 22% of class members, or nearly 1.6 million Facebook users, have filed compensation claims from the case. With the court’s approval of $650 million in settlement, each claimant could receive at least $345.
Ed Yohnka, director of communications and public policy at ACLU Illinois, which was instrumental in lobbying for the bill’s passage, told Top Class Actions in an interview that the group had seen an uptick in BIPA-related cases since Rosenbach. But the exact number of cases is still unknown due to lack of tracking data, he said. Some legal observers have suggested BIPA could trigger a flood of lawsuits against private companies, including small businesses that are also subject to the law. As the National Law Review put it, “these BIPA class actions have the potential to bankrupt some Illinois businesses and discourage future business investment in Illinois.”
But Yohnka argues BIPA is simply another policy that companies must tick off their checklist of compliances.
“The existence of BIPA can only unleash an avalanche of lawsuits if there’s an avalanche of people not complying,” Yohnka said. And while opponents of the law have argued that it puts small businesses at legal risk, in reality “the only people who get protected when you take away the protections of BIPA are these huge companies who are violating it willfully and intending to, for the purposes of monetizing the (person’s) data.”
BIPA’s strong biometric protections have spawned a number of countermeasures in Illinois’s General Assembly, legislation which consumer protection advocates have labeled as attempts to gut BIPA. The most prominent is HB 559, which nearly made it through the Legislature via an accompanying bill during this year’s budget session.
So far, no such legislation has advanced, but Yohnka said there would be no leash on Big Tech seeking to profit off users’ valuable biometric data if BIPA were ever weakened.
“The giants of monetizing this data, whether it’s the Facebooks or Clearviews of the world, will be able to act and operate without restriction here in Illinois, the way they have been in other states across the country,” he said. “And I think, ultimately, it means the data of biometric information from residents of Illinois will be tossed into that great pool of information and individualized data that’s being collected, monetized, and used all over the world.”
Don’t Miss Out!
Check out our list of Class Action Lawsuits and Class Action Settlements you may qualify to join!
14 thoughts onHow Illinois’s Biometric Information Privacy Act Pushed Class Actions Against Big Tech
I stopped processing my hair because I thought it was the chemicals but nope my hair continued to fall out. Please add me.
Lmao what does this have to do with hair cuz it doesn’t.! It’s about Facebook
I meant biometric lmao