Facebook to Pay $550 Million in Biometric Privacy Accord
Consumer privacy cases in U.S. courts occasionally have succeeded in making internet companies change their policies.
(Bloomberg) -- Facebook Inc. agreed to pay $550 million to resolve claims it collected user biometric data without consent in one of the largest consumer privacy settlements in U.S. history.
The accord, which requires a judge’s approval, will avert a trial that may have exposed the social networking company to billions of dollars in damages. Facebook fought unsuccessfully to persuade the U.S. Supreme Court to derail the class action case. The users alleged that the company’s photo-scanning technology violated an Illinois law by gathering and storing biometric data without their permission.
“We decided to pursue a settlement as it was in the best interest of our community and our shareholders to move past this matter,” Facebook said.
While Facebook has weathered controversy over privacy almost since its inception, the company has come under particularly harsh scrutiny in recent years, both in the U.S. and in Europe. Facebook reached a historic $5 billion deal in July with the U.S. Federal Trade Commission to settle an investigation into its privacy practices stemming from the Cambridge Analytica scandal that came to light in early 2018. The company is also facing probes by New York, California, Massachusetts and others over its third-party data practices.
Consumer privacy cases in U.S. courts occasionally have succeeded in making internet companies change their policies, but have rarely triggered payouts of more than $10 million. The lawsuit over photo scanning was brought under the Illinois Biometric Information Privacy Act of 2008, the toughest laws of its kind in the U.S.
“Biometrics is one of the two primary battlegrounds, along with geolocation, that will define our privacy rights for the next generation,” Jay Edelson, a Chicago-based lawyer representing consumers who sued, said in a statement.
Facebook has for years encouraged users to tag people in photographs they upload in their personal posts and the social network stores the collected information. The company has used a program it calls DeepFace to match other photos of a person.
Courts have struggled over what qualifies as an injury to pursue a privacy case in lawsuits accusing Facebook, Google and other internet companies of siphoning users’ personal information from emails and monitoring their web browsing habits. Suits over selling the data to advertisers have often failed.
Facebook contended that its collection of biometric data didn’t cause users to suffer any concrete injury such as loss of money or property. But a San Francisco federal judge rejected that argument, saying in 2018 that the alleged violation of the user-consent requirement in the Illinois law goes to “the very privacy rights the Illinois legislature sought to protect.”
Privacy advocates regard biometric data as especially sensitive because -- unlike names, addresses, credit cards and even social social security numbers, which can be changed -- scans of retinas, fingerprints, hands, face geometry and blood samples are unique identifiers.
The settlement will push technology companies to pay closer attention to users’ concerns over biometric technology, said Pam Dixon, executive director of nonprofit advocacy group World Privacy Forum.
“This will cause a lot of discussion on the Biometric Information Privacy Act as very few companies could afford a settlement like this and survive,“ she said.
U.S. District Judge James Donato allowed the case to proceed as a class action on behalf of millions of Illinois residents who had uploaded photos on the network since 2011. Facebook failed to get a federal appeals court or the Supreme Court to reverse Donato’s ruling.
Taking the case to trial would be risky because, under the Illinois law, the company could be fined $1,000 to $5,000 each time a person’s image is used without consent. If Facebook had lost it might have been forced to pay $6 billion, according to Matthew Schettenhelm, Bloomberg Intelligence litigation and government analyst.
The case is In re Facebook Biometric Information Privacy Litigation, 15-cv-03747, U.S. District Court, Northern District of California (San Francisco).
--With assistance from Kurt Wagner and Malathi Nayak.
To contact the reporter on this story: Daniel Stoller in Arlington at dstoller1@bloomberg.net
To contact the editors responsible for this story: David Glovin at dglovin@bloomberg.net, Peter Blumberg, John Hughes
©2020 Bloomberg L.P.