Facebook’s photo-tagging facial recognition software may be in violation of an Illinois law protecting residents’ identities.

A California judge ruled last week that a lawsuit filed by three Chicago area men over Facebook’s software may proceed. The men, who filed a class action lawsuit last summer, argued Facebook’s tagging software violated the Illinois Biometric Information Privacy Act by acquiring users’ biometric data, which determines a person’s identity based on biological or physical characteristics.

The state privacy law, which was passed in 2008, requires businesses to inform people when their biometric data has been obtained and to receive permission before storing it. According to the law, biometric identifiers include scans of face geometry, regardless of how it was obtained.

Carlo Licata filed a suit in the Cook County Circuit Court in April 2015, and Adam Pezen and Nimesh Patel filed in federal court in April and May 2015. The cases were combined when it moved to the Northern District of California federal court last summer. Judge James Donato ruled on May 5 the case can proceed.

Facebook had asked in October that the case be dismissed. According to Donato’s May 5 ruling on the case, Facebook argued that the case was invalid because their terms of service — which all three plaintiffs had agreed to — say disputes will be decided based on California law, so the Illinois law would not apply.

“If California law is applied, the Illinois policy of protecting its citizens’ privacy interests in their biometric data, especially in the context of dealing with ‘major national corporations’ like Facebook, would be written out of existence,” Donato said in a court order. “Illinois will suffer a complete negation of its biometric privacy protections for its citizens if California law is applied.”

Facebook could not be reached for comment.

In response to Facebook’s assertion that its tag suggestions derived from photos are not covered by BIPA, Donato wrote that the facial analysis does fall within the Illinois statute.

The plaintiffs are asking for $5,000 for each intentional violation and $1,000 for each negligent violation of their personal information, according to the Chicago Tribune.

Other major corporations have had issues with the Illinois privacy act. An Illinois resident sued Google in March arguing the facial recognition software used in Google Photos violated the state legislation. Shutterfly Inc. has a similar lawsuit being filed against it, which moved forward in January.

Email: [email protected]
Twitter: @RenzoDowney