A California federal judge has approved a $650m settlement of a class action privacy suit against Facebook for allegedly using biometric data without permission from its users. The settlement is one of the largest ever paid out for a privacy violation.
Chicago attorney Jay Edelson originally sued the tech giant in Cook County Circuit back in 2015, claiming Facebook’s use of facial recognition in their photo-tagging system was in violation of the Illinois Biometric Information Privacy Act (BIPA). The case was moved to Chicago federal court and then California federal court, where it became a class-action lawsuit. The lengthy legal battle led Facebook to change tack and make the facial recognition feature available on an opt-in basis.
The approval of the settlement means 1.6m Facebook users in Illinois will receive at least $345 each. The three named plaintiffs, Nimesh Patel, Carlo Licata and Adam Pezen, will receive $5,000 each.
The settlement was reached by a trio of law firms that represented the plaintiff class. Chicago-based firm Edelson originally filed the first suit against Facebook, with cases filed thereafter by Labaton Sucharow and Robbins Geller Rudman & Dowd. Facebook was represented by Cooley and Mayer Brown.
District Judge James Donato of the Northern District of California called the payout a “landmark result”, saying it stands as “major win for consumers in the hotly contested area of digital privacy.”
“The standing issue makes this settlement all the more valuable because Facebook and other big tech companies continue to fight the proposition that a statutory privacy violation is a genuine harm,” he wrote.
The case raised several “intensely litigated” issues, including the question of whether a statutory privacy injury was concrete enough to establish the injury-in-fact needed for federal standing. In the end, the court ruled the collection of a person's biometric data in violation of BIPA is sufficient to establish Article III standing.
Facebook had agreed to pay $550m in January last year after failing to get the class action dismissed, but Donato ruled the amount was insufficient.
“We are pleased to have reached a settlement so we can move past this matter, which is in the best interest of our community and our shareholders,” Facebook said in a statement.
Illinois’ biometric privacy laws are recognised as some of the most stringent in the US. Under BIPA, consumers are able to sue companies that don’t get permission before harvesting biologically unique data including facia, voiceprints and fingerprints. The intent of the legislation was to address heightened risk of identity theft associated with the use of biometric data and it has been a steady source of litigation within the state since it first came into effect in 2008.
“One of the key takeaways is the Court’s laser focus on innovative notice and ensuring unprecedented claim rates,” Edelson wrote on Twitter, adding that settlements need to be measured by how much money is being paid to class members.
“If no one is participating, that is a problem,” he said. “The Court’s approach sets a new benchmark.”