Instagram Class Action Lawsuit Accuses Facebook of Harvesting Biometric Data

Facebook has been hit with a new class action lawsuit accusing the social media giant of violating biometric privacy law through Instagram photos and videos.

Plaintiff Kelly Whalen filed her case in California Superior Court, alleging Facebook collects, stores and profits from Instagram users’ biometric information without written notice or consent.

Such use of data is a violation of the Illinois Biometric Information Privacy Act, Whalen claims. 

The plaintiff states that Facebook has admitted to collecting and using Instagram users’ biometrics. Facebook acquired Instagram in 2012.

It is believed that more than 100 million Instagram users’ biometric data may have been collected by Facebook, according to Apple Insider.

“Its facial recognition software works by scanning faces of unnamed people in photos or videos to analyze details of individuals’ faces and creating a corresponding ‘face template’ for each face, and then storing that face template for later use and/or matching it to those already in a database of identified people,” the Instagram class action lawsuit says. 

Facebook claims users are in charge of that process, but people actually are not able to control the technology because Facebook scans faces in photos and videos uploaded by other users, the class action lawsuit says. 

The plaintiff believes Facebook uses that biometric data “to bolster its facial recognition abilities across all of its products, including the Facebook application, and shares this information among various entities.”

Whalen, of Palos Heights, Ill., says she has been uploading Instagram photos since 2011, including images of her face in which she has tagged herself. She says her face has also been tagged by other Instagram users in their own photos.

Whalen believes Facebook has captured biometric data from her Instagram photos by “automatically locating and scanning” her face and “extracting geometric data relating to the contours of her face and the distances between her eyes, nose, and ears, data which Facebook then used to create a unique template of Plaintiff’s face …,” the class action lawsuit says.

The plaintiff alleges the resulting unique template was stored and used as Facebook did research while developing its own facial recognition technology. 

Whalen says many of the Instagram photos she has been tagged in were taken in Illinois and uploaded from her computer in Illinois.

The Illinois Legislature has determined that biometrics are “‘biologically unique to the individual; therefore, once compromised, the individual has no recourse, is at heightened risk for identity theft, and is likely to withdraw from biometric-facilitated transactions,’” the Facebook class action lawsuit states.

Because of this, BIPA requires any entity in possession of biometric information to develop a written, public policy that establishes a retention schedule and guidelines for permanently destroying that information when the initial purpose for collecting such data concludes, or within three years of an individual’s last interaction with that entity, according to the complaint.

The plaintiff claims Facebook actively misled Instagram users about whether it was collecting facial recognition data from their Instagram photos. 

The Instagram data policy states that the platform uses facial recognition technology if the user has the feature turned on. However, Whalen says, Instagram users don’t have the ability to turn off facial recognition within the app.

The policy allegedly goes on to state Instagram will let users know first if they “introduce face-recognition technology to your Instagram experience,” according to the class action lawsuit.

She says she did not receive notice that Facebook would collect, store or profit from her biometric information.

Whalen claims she never gave any sort of consent to that use of her data and was never given the opportunity to prevent Facebook from collecting that data.

“This suit is baseless,” Facebook spokesperson Stephanie Otway said in a statement emailed to Fortune. “Instagram doesn’t use face recognition technology.”

The Instagram class action lawsuit comes on the heels of a settlement in which Facebook agreed to pay $650 million to settle claims it had illegally captured scans of users’ faces.

The plaintiffs in that case accused Facebook of gathering biometric data for a feature that suggests the identities of people appearing in other users’ photos posted to the platform. 

The plaintiff is seeking a declaration that Facebook’s alleged actions violate BIPA; an award of statutory damages of $5,000 for each “intentional or reckless” BIPA violation or $1,000 for each negligent violation; an injunction requiring Facebook to comply with BIPA by providing a public retention schedule for biometric data and forcing the company to stop collecting biometric identifiers without obtaining users’ written consent; an award of proceeds Facebook received as a result of its treatment of the biometric information; pre- and post-judgment interest; attorneys’ fees and costs; and any other relief deemed appropriate.

She also demands a jury trial.

Are you an Instagram user who is worried that your biometric data has been compromised? Tell us your experience in the comments.

The plaintiff is represented by Todd D. Carpenter, Kyle A. Shamberg and Nicholas R. Lange of Carlson Lynch LLP and Matthew E. Lee and Erin J. Ruben of Whitfield Bryson LLP.

The Instagram Users Biometric Data Class Action Lawsuit is Kelly Whalen, et al. v. Facebook Inc., Case No. 20-CIV-03346, in Superior Court of California, County of San Mateo.

Read About More Class Action Lawsuits & Class Action Settlements:

Users of Google Home Devices Allege Gadgets Record Conversations Without Permission

Macy’s Faces Privacy Class Action Over Alleged Use of Clearview Facial Recognition Software

Aetna v. UnitedHealthcare Long Term Disability Comparison

What Is the Lemon Law In Florida?