Facebook sued for collecting, storing, and profiting from the biometric data of over 100 million Instagram users
Just days after Facebook settled the Illinois Biometric Information Privacy Act (BIPA) lawsuit for $650 million, it has now been hit with another lawsuit claiming that it used Instagram to harvest user data for profit. In the new lawsuit, filed Monday in state court in Redwood City, California, the plaintiff’s accused Facebook of collecting, storing, and profiting from the biometric data of more than 100 million Instagram users, without their knowledge or consent.
The plaintiffs allege that Facebook’s action violates the Illinois Biometric Information Privacy Act (BIPA) of 2008. As per the BIPA law, the violating company can be forced to pay $1,000 per violation. The judge can even penalize the company $5,000 per violation if it’s found to have acted recklessly or intentionally. In this case, Facebook may face increased penalty for repeatedly breaking the BIPA if found guilty.
The lawsuit, Whalen v. Facebook, claims that Instagram has a face-tagging tool that uses facial recognition to identify people and create a unique face template. It adds that Facebook violates BIPA by storing this user face template in its database.
While Instagram discloses this practice in its terms of service between it and the Instagram user, plaintiffs say that Instagram’s data harvesting tool also scans images of faces of those who appear in the images shared on the platform. The lawsuit argues that these people never agreed to Instagram’s ToS and may not even use Instagram other than being featured in someone’s Insta post. The lawsuit says that this practice violates an Illinois state law that bans companies from collecting user’s biometric data like facial recognition scans without their explicit knowledge or consent.
The lawsuit further argues that once the Instagram biometric harvesting tool captures the data, Facebook uses the information to promote other products like Facebook. The lawsuit says that Facebook also shares this private biometric data with other entities violating basic privacy norms. The plaintiffs say that Facebook does all of this without providing any of the required notices or disclosures to the Instagram users as required by Illinois BIPA and various other data disclosure laws.
Once Facebook captures its Instagram user’s protected biometrics, it uses them to bolster its facial recognition abilities across all of its products, including the Facebook application, and shares this information among various entities. Facebook does all of this without providing any of the required notices or disclosures required by Illinois law.
If Facebook is found guilty this time, it could face a much larger penalty for smaller number of users. It is estimated that it could have to pay $500 billion to the 100 million Instagram users if the court finds it is repeat offender.