By Natasha Singer and Mike Isaac
The case stemmed from Facebook’s photo-labeling service, Tag Suggestions, which uses face-matching software to suggest the names of people in users’ photos. The suit said the Silicon Valley company violated an Illinois biometric privacy law by harvesting facial data for Tag Suggestions from the photos of millions of users in the state without their permission and without telling them how long the data would be kept. Facebook has said the allegations have no merit.
Under the agreement, Facebook will pay $550 million to eligible Illinois users and for the plaintiffs’ legal fees. The sum dwarfs the $380.5 million that the Equifax credit reporting agency agreed this month to pay to settle a class-action case over a 2017 consumer data breach.
Facebook disclosed the settlement as part of its quarterly financial results, in which it took a charge on the case. The sum amounted to a rounding error for Facebook, which reported that revenue rose 25 percent to $21 billion in the fourth quarter, compared with a year earlier, while profit increased 7 percent to $7.3 billion.
“We decided to pursue a settlement as it was in the best interest of our community and our shareholders to move past this matter,” a Facebook spokesman said in a statement.
“From people who are passionate about gun rights to those who care about women’s reproductive issues, the right to participate in society anonymously is something that we cannot afford to lose,” Mr. Edelson said.
The case also illustrates the protections that strong state laws may offer consumers. Of the three states that have stand-alone biometric privacy laws, Illinois has the most comprehensive one. It requires companies to obtain written permission before collecting a person’s fingerprints, facial scans or other identifying biological characteristics. The law also gives residents the right to sue companies for up to $5,000 per violation, which could add up to billions of dollars in payouts for tech giants that lose such class-action suits.
Since the Illinois law was enacted in 2008, it has vexed companies that market voice assistants, doorbell cameras, photo labeling and other technology that may collect biometric details from people without their knowledge or consent.
Many of the companies have argued that people should not be able to sue over violations of a consumer privacy law if they cannot prove they suffered concrete harms like financial losses. Facebook made similar claims in the facial recognition lawsuit, including in a petition in December asking the United States Supreme Court to review the case. The Supreme Court last week denied Facebook’s appeal.
But last January, in a case against an amusement park that had collected and stored a child’s fingerprints, the Illinois Supreme Court ruled that violating a person’s biometric privacy could constitute a harm in and of itself, enabling consumers to pursue privacy claims. An appeals court judge later issued a similar ruling in the Facebook case, denying the company’s bid to have the lawsuit dismissed.
Facebook has been dogged by complaints over its use of facial recognition since 2010, when it rolled out Tag Suggestions as the default option for users. People could turn it off, but privacy experts said the company had neither obtained users’ opt-in consent for the technology nor explicitly informed them that it could benefit by, for instance, using scans of their photos to improve its face-matching technology.
In 2012, Facebook deactivated the technology in Europe after regulators there raised questions about its consent system. Last year, as part of a $5 billion settlement with the Federal Trade Commission over privacy violations, Facebook agreed to provide “clear and conspicuous notice” about its face-matching software and obtain additional permission from people before using it for new purposes they had not agreed to.
In 2018, Facebook reintroduced facial recognition as an option for users in Europe. Last year, Facebook updated its facial recognition notices and settings for certain users, providing more details on how it uses the technology.