Facebook will pay more than $300 each to 1.6M Illinois users in settlement
Millions of Facebook users in Illinois will be receiving about $340 each as Facebook settles a case alleging it broke state law when it collected facial recognition data on users without their consent. The judge hearing the case in federal court in California approved the final settlement on Thursday, six years after legal proceedings began.
“This is money that’s coming directly out of Facebook’s own pocket,” US District Judge James Donato said, according to the Chicago Tribune. “The violations here did not extract a penny from the pockets of the victims. But this is real money that Facebook is paying to compensate them for the tangible privacy harms that they suffered.”
Three different Illinois residents filed suit against Facebook in 2015 and claimed that the service’s “tag suggestions” feature, which uses facial recognition to suggest other users to tag in photos, violated their rights under the Illinois Biometric Information Privacy Act (BIPA). The suits were eventually rolled together into a single class-action complaint and transferred to federal court in California.
Illinois adopted BIPA in 2008, and it remains one of the strongest biometric data laws in the country. The statute requires any entity that gathers biometric data—including fingerprints, voice prints, “hand or face geometry,” and retinal or iris scans—to get informed consent from those individuals whose data it collects. Those entities are also required to protect biometric data they store in the same way they would have to protect other sensitive personally identifiable information.
The plaintiffs in the case argued that Facebook violated that law when it introduced the “tag suggestions” feature without gaining express consent from users. There are about 7 million total affected Facebook users in Illinois, and the statute stipulates penalties of $1,000 for each accidental violation or $5,000 for each knowing violation of the law, so Facebook could have been on the hook for as much as $35 billion if the case had gone to trial and the company lost.
Facebook tried to settle for $550 million in June 2020, but Judge Donato rejected that deal, finding it to be insufficient. The following month, he agreed to a preliminary sign off on a modified $650 million settlement, which he approved the final version of in this week’s hearing.
The legal firms representing the plaintiffs asked to get about $110 million of the settlement money. That leaves the remaining $540 million to be divided among the roughly 1.6 million members of the class who filed a claim before the Nov. 23 deadline, which works out to about $338 per user. Those payments are expected to take “a few months” to make their way to claimants.
Controversial facial recognition firm Clearview AI is also facing a class action BIPA suit in Illinois amid allegations that it collected billions of facial images for matching without the consent or knowledge of either the people in the photos or the services from which the images were scraped.
Although $340 per person is far less than the $1,000 or $5,000 per person Facebook could theoretically have been made to pay, it’s still an unusually high payout for members of a class action suit, which in many cases provide a pittance to affected individuals. The lawsuits against Equifax over its massive 2017 data breach, for example, will probably result in pocket change at best for the 147 million consumers who had their personal data purloined.
https://arstechnica.com/?p=1735391