Facebook has lost a federal appeal in a lawsuit over facial recognition data, setting the company up to face a massive damages payment over its privacy practices.

3–0 appeals court decision

In 2015, Facebook was sued under the Illinois Biometric Information Privacy Act, which requires companies to make a public policy before collecting and storing biometric data, including faces scans, and to lay out how the data will be stored. Facebook has used the technology in its Tag Suggestions feature, which determines whether a photo includes a user’s friends.

The plaintiffs brought suit, arguing that Facebook had failed to meet the requirements of the law. When a lower court certified the suit as a class action, Facebook appealed, arguing that the plaintiffs had failed to show concrete injury, and that the lower court overstepped its power by certifying the class.

In the 3–0 decision today, the appeals court disagreed with the company. “We conclude that the development of a face template using facial-recognition technology without consent (as alleged here) invades an individual’s private affairs and concrete interests,” the court wrote in its decision, sending it back to the lower court for further proceedings.

The stakes are potentially high for Facebook. The Illinois law allows for payments of $1,000 or $5,000 per violation, depending on the severity of the violation. As Reuters reports, the class could potentially include millions of Facebook users, meaning the company could one day be forced to pay billions of dollars in damages, if it ultimately loses the case.

“We plan to seek further review of the decision,” a Facebook spokesperson said in a statement. “We have always disclosed our use of face recognition technology and that people can turn it on or off at any time.” The company will seek further review from the full court of appeals, according to the spokesperson, and could take the case to the Supreme Court.

Civil liberties groups have supported the suit, and the American Civil Liberties Union cheered today’s ruling. “This decision is a strong recognition of the dangers of unfettered use of face surveillance technology,” ACLU staff attorney Nathan Freed Wessler said in a statement.