At the opening of the new millennium, the idea of computer
programs using facial recognition software to target ads to people was the
stuff of such science fiction stories as 2002’s “Minority Report.”
By 2010, however, Facebook had reported its users had
applied more than 100 million “tags” to photos uploaded to its site,
identifying millions of people appearing in the photos, and allowing the social
media titan to launch a new tool it called “Tag Suggestions” – essentially allowing
facial recognition algorithms to identify in those uploaded photos the people
whose “faceprint” had been stored in Facebook’s databases from previous tagged
Katherine Welles / Shutterstock.com
And by 2015, Facebook was served with the first in a series
of class action lawsuits under a previously little known Illinois law over the
use of facial recognition and other such biometric identification systems.
But if those bringing such class action lawsuits have their
way, the state law, enacted in 2008 as the Illinois Biometric Information
Privacy Act, will impact businesses of many sizes, far beyond Silicon Valley’s
social media giants.
Only Texas and Illinois have such
state-level laws in place to protect biometric information. But Illinois was ahead of its time when it created the BIPA
eight years ago, said Christopher Dore, a partner at Edelson PC in Chicago.
BIPA regulates the ways in which
a person’s biometric identifiers – described in the act as “a retina or iris scan, fingerprint,
voiceprint, or scan of hand or face geometry” – are collected, stored and used.
Under the act, individuals
must be informed in writing ahead of time – and give their written permission –
before any biometric identifiers can be obtained by a private entity. The
length of time the identifiers will be used also must be disclosed.
But since BIPA was, and is, the only act of its
kind in regard to its strength – and since it came into being several years
before Facebook implemented Tag Suggestions - it mostly sat on the shelf, going unnoticed by companies operating on a nationwide
basis, Dore said.
That is, until early last year,
when Dore said Cook County resident Carlo Licata came to Edelson with concerns
about his privacy on Facebook.
Licata and two other Illinois residents alleged
Facebook violated BIPA by not gathering proper consent before collecting his
biometric information. Though the suit originated in
Illinois, it was transferred to a California federal court, since Facebook is
headquartered in California. But a judge recently determined Illinois would
retain jurisdiction, and BIPA regulations would apply.
The case still is pending, and its outcome will
provide more definitive guidance on how similar cases will be handled.
Until the courts figure
out how broadly or narrowly BIPA should be interpreted and applied, it’s
difficult to say whether the statute is working the way it was intended, said A.J.
Dixon, an associate attorney who is following the Licata case and others like
it at Winston and Strawn LLP in Chicago.
findings’ provisions, as well as its legislative history, suggest that it was
originally meant to cover biometric information used in financial transactions
and security screenings - for example, the ‘pay-by-touch’ machines that were
being installed in a number of a Illinois grocery stores around the time the
legislation was passed,” Dixon wrote in an email, responding to questions from
the Cook County Record. “BIPA’s applicability to other technologies, such
as Facebook’s photo-tagging function, is far less clear.”
Still, the mere existence of the
Facebook case already has opened the door for a new scope of liability for
businesses relying on biometric information.
In March, Google was hit with a
class action for allegedly collecting the face templates of millions of
Illinois residents through its Google Photos service.
In April, Shutterfly quietly
settled a class action suit it had been fighting for months in which the photo
publishing website was accused of violating BIPA. The amount of the settlement
was not disclosed, but BIPA provides $1,000 for each negligent violation and
$5,000 for intentional or reckless violations.
Most recently, the popular
mobile messaging app Snapchat was sued in late May for collecting face
templates through its Lenses feature.
In addition to the suits brought
against the social media companies, at least two more cases have been filed
under BIPA as of late, Dore said. National tanning salon chains LA Tan and Palm
Beach Tan have come under BIPA’s glare for their systems, which collect and
store their clients’ fingerprints.
Until there is judicial clarity
on the reach of the BIPA, litigation likely will continue to increase, Dixon
Dore believes that’s a good
“It’s vital that this type of information is
regulated in how it’s collected and sold and used,” Dore said. “You can change your
email password, even your Social Security number … but you can’t change your
thumb print; you can’t change your face. You’re stuck with it, for better or
Other privacy advocates believe
BIPA is a strong statute and could pave the way for similar protection acts in
“[It’s] a good example of the kind
of law that protects privacy in a way that’s effective and balances innovation
desires and goals of companies but protects privacy rights of people,” said
Gautam Hans, policy counsel of the Center for Democracy and Technology-San
Others, such as the Illinois
Policy Institute, have questioned whether the law may again make Illinois a
haven for what others have called “enterprising litigation.” An Illinois Policy
Institute spokesperson said the Institute doesn’t have an official position on BIPA.
But an article written by an
Institute staffer and posted on the Institute’s website has openly pondered
whether Illinois could “become
the tech litigation capital of the nation, akin to Madison County, Illinois’
notoriety as an asbestos trial attorney’s paradise.”
“Might that have a
dampening effect on technological innovation that could ultimately benefit huge
numbers of people worldwide?” the article asked. “And wouldn’t it give tech
firms – and many other companies – pause before they set up shop in Illinois?”