Firm will appeal against action that could expose it to billions of dollars in potential damages

This article is more than 1 year old

This article is more than 1 year old

A US federal appeals court has rejected Facebook’s effort to undo a class action lawsuit alleging it illegally collected and stored biometric data for millions of users without their consent using facial recognition technology.

The 3-0 decision from the ninth US circuit court of appeals in San Francisco exposes the company to billions of dollars in potential damages paid out to the Illinois users who brought the case.

The decision came as the social media company faces broad criticism from American politicians, lawmakers and regulators over its privacy practices. Last month, Facebook agreed to pay a record $5bn (£4bn) fine to settle a Federal Trade Commission (FTC) data privacy investigation.

“This biometric data is so sensitive that if it is compromised, there is simply no recourse,” Shawn Williams, a lawyer for plaintiffs in the class action, said in an interview. “It’s not like a social security card or credit card number where you can change the number. You can’t change your face.”

Facebook said it would appeal. “We have always disclosed our use of face recognition technology and that people can turn it on or off at any time,” a spokesman said.

Google had a similar lawsuit dismissed in Chicago last December.

The current lawsuit began in 2015, when Illinois users accused Facebook of violating the state’s Biometric Information Privacy Act.

Facebook allegedly did this through its “tag suggestions” feature, which allowed users to recognise their Facebook friends from previously uploaded photos.

Writing for the appeals court, the circuit judge, Sandra Ikuta, said the users could sue as a group, rejecting Facebook’s argument that their claims were unique and required individual lawsuits.

She also said the 2008 Illinois law was intended to protect individuals’ “concrete interests in privacy” and Facebook’s alleged unauthorised use of a face template “invades an individual’s private affairs and concrete interests”.

The court returned the case to the US district judge, James Donato, in San Francisco, who had certified a class action in April 2018, for a possible trial.

Illinois’s biometric privacy law provides for damages of $1,000 for each negligent violation and $5,000 for each intentional or reckless violation.

Williams, a partner at Robbins Geller Rudman & Dowd, said the class action could include 7 million Facebook users.

The FTC investigation arose from the discovery that Facebook had let the British consulting firm Cambridge Analytica harvest users’ personal information. Facebook’s $5bn payout still requires US Department of Justice approval.