Is the Law Finally Catching Up to Mark Zuckerberg?
Even before the Cambridge Analytica breach turned Facebook into the poster child for growing concerns around user privacy, its photo-scanning technology may have violated state laws by gathering and storing biometric data about people on Facebook without their consent. That’s the argument being made by three Illinois plaintiffs on behalf of millions of Facebook users in San Francisco federal court, where U.S. District Judge James Donato, unsympathetic to the tech giant, ruled on Monday that the class-action lawsuit against the company could proceed.
Facebook has for years encouraged people to tag their friends in photos they upload; in 2010, the company launched a feature called “tag suggestions,” which, per its name, analyzes the people depicted in the photo, and recommends that you tag them. Facebook does this through a program called DeepFace, which uses data it has gathered about what you look like to match your face to your online profile. But Illinois’s Biometric Information Privacy Act (B.I.P.A.), which was signed into law in 2008, requires that companies notify people when their biometric data is being collected, and get their permission to do so.
So in 2015, Illinois-based Facebook users sued the company for violating the law, claiming that they had suffered a loss of property due to Facebook’s data scraping—the property, in this case, being the algorithms that make up their digital identities. Facebook, which pushed for the cases to be considered individually instead of as a class-action lawsuit, is reviewing the ruling. “We continue to believe the case has no merit and will defend ourselves vigorously,” the company said in a statement.
The material effects of such a lawsuit on Facebook remain unclear, but under B.I.P.A., the company could face fines of $1,000 to $5,000 every time a person’s image is used on the platform without consent. This possibility was not lost on Donato, who stated in his ruling that damages could “amount to billions of dollars.” It’s also unclear whether the suit will force Facebook to change how it handles biometric data, but Shawn Williams, a lawyer for the Facebook users, predicted it could be pivotal. “As more people become aware of the scope of Facebook’s data collection and as consequences begin to attach to that data collection, whether economic or regulatory, Facebook will have to take a long look at its privacy practices and make changes consistent with user expectations and regulatory requirements,” he said.
To some extent, Facebook’s most recent scandal pulled back the curtain on just how thoroughly tech companies have penetrated every aspect of our lives, collecting data on us all the while. “Cambridge Analytica is just the tip of the iceberg, and this problem doesn’t begin and end with Facebook,” Evan Greer, the campaign director for the Internet activism group Fight for the Future, told me recently. “It’s not even just big tech companies; retail chains, hospitals, and government agencies are vacuuming up massive amounts of sensitive personal information about all of us.” This lawsuit could prove a canary in the coal mine of sorts—a test for how regulatory laws around privacy could apply to big tech. Mark Zuckerberg has already been accused of attempting to skirt such laws, with Senator Dick Durbin noting during last week’s congressional hearing that “I’m afraid Facebook has come down to the position of trying to carve out exceptions . . . I hope you’ll fill me in on how that is consistent with protecting privacy.” In a subsequent race to forestall forced regulation, Zuckerberg announced last week that, among other things, the changes Facebook is making to comply with the European Union’s strict General Data Protection Regulation will be rolled out globally, and will include requirements about how user data is collected. But if this state-level suit is any indication, this could be just the beginning for Facebook—and for other companies that have thus far flown under the radar.
