ACLU:

The ruling in Patel v. Facebook affirms the district court’s certification of a class of Facebook users in Illinois who have alleged that the company violated their rights under their state’s Biometric Information Privacy Act (BIPA). The Illinois statute imposes protections against companies collecting and storing biometric information, including using face recognition technology, without the user’s knowledge and consent. The suit alleges that Facebook’s practice of using face recognition technology to identify users in digital images uploaded to the site without disclosing its use of face recognition or obtaining consent violates state law.

“This decision is a strong recognition of the dangers of unfettered use of face surveillance technology,” said Nathan Freed Wessler, staff attorney with the ACLU Speech, Privacy, and Technology Project. “The capability to instantaneously identify and track people based on their faces raises chilling potential for privacy violations at an unprecedented scale. Both corporations and the government are now on notice that this technology poses unique risks to people’s privacy and safety.”