People Should Be Allowed to Sue Facebook If It Violates Law on Face Recognition Privacy
Ten years ago, Illinois enacted a law that imposes important protections against companies collecting and storing our biometric information — including using facial recognition— without our knowledge and consent. The law is called the Biometric Information Privacy Act. Although facial recognition was relatively crude when it was passed, the wisdom of Illinois’ decision has been borne out over the last decade, as facial recognition and other biometric collection has developed and spread.
On Monday, the ACLU filed a friend-of-the-court brief in federal appeals court defending the Illinois law against arguments advanced by Facebook trying to remove the law’s pro-privacy teeth. (The brief was filed along with ACLU affiliates in Illinois and California as well as the Electronic Frontier Foundation, Center for Democracy & Technology, and Illinois PIRG).
Under the law, a company may collect a person’s biometric identifiers — like fingerprints or data from a person’s face or iris — only if it first obtains informed consent from that person. In the case now pending in the Ninth Circuit Court of Appeals, Facebook users in Illinois have alleged that the company violated their rights under the law by using facial recognition technology to identify them in digital images uploaded to the site without disclosing its use of facial recognition or obtaining consent.
One of Facebook’s is that people should not have an automatic right to sue when their biometric information has been collected in violation of the law. Rather, they must prove that they have suffered monetary or other damages. As we explain in our brief, however, that runs counter to the Illinois Legislature’s intent, which was to provide strong, enforceable protection against surreptitious collection of sensitive biometric data.
In the decade since passage of the law, the need for its protections has become crystal clear. As we explain in the brief, today:
Retail stores use facial recognition technology to “,” and at least some companies are using such technology to track shoppers in their stores. collect biometrics for time tracking and attendance management, as well as to manage access to company phones, laptops, and cloud storage accounts. have invested in collecting customers’ biometric data, including face scans, fingerprints, iris scans, and voiceprints, to authenticate those customers’ identities. have facial recognition and fingerprint collection technology “to accurately track attendance for various events like Bible studies, worship services and Sunday school.” Many now collect fingerprints to manage attendance, cafeteria purchases, library services, and security, and some have started installing facial recognition systems to control entry into buildings.
Perhaps most concerning, major technology companies like Amazon have invested heavily in powerful facial recognition systems that they sell access to on the cheap. its facial recognition system, called Rekognition, is not only able to store facial recognition images of large numbers of people, but it is also able to “perform real-time face searches against collections with tens of millions of faces” and “detect, analyze, and index up to 100 faces ... in a single image,” such as photographs captured at “crowded events ... [and] department stores.”
%3Ciframe%20allow%3D%22accelerometer%3B%20autoplay%3B%20encrypted-media%3B%20gyroscope%3B%20picture-in-picture%22%20allowfullscreen%3D%22%22%20frameborder%3D%220%22%20height%3D%22315%22%20src%3D%22https%3A%2F%2Fwww.youtube.com%2Fembed%2FlSSZ3-ZIkHU%3Fautoplay%3D1%26version%3D3%22%20thumb%3D%22%2Ffiles%2Fweb18-amazon-face-recognition-560x315.jpg%22%20width%3D%22560%22%3E%3C%2Fiframe%3E
Privacy statement. This embed will serve content from youtube.com.
Using it is cheap, and as we have warned before, without protections, this technology could enable civil rights and civil liberties violations on a massive scale. Indeed, a recent survey conducted by the ACLU revealed that 18 of the top 20 American retail companies refused to say whether they collect facial recognition scans of their customers.
That’s why we support a strong interpretation of the law’s protections. As the district court in its ruling against Facebook in February, “When an online service simply disregards the Illinois procedures, as Facebook is alleged to have done, the right of the individual to maintain her biometric privacy vanishes into thin air.”
Without an enforceable requirement that companies disclose their collection of biometric information and obtain consent, people will have no way to protect themselves against surreptitious corporate surveillance.
Sign up for the and get our finest content from the week delivered to your inbox every Saturday.
Learn More About the Issues on This Page
-
Press ReleaseDec 2024
Privacy & Technology
ACLU Applauds Arizona Supreme Court Historic Decision That Police Need a Warrant to Access DNAACLU Applauds Arizona Supreme Court Historic Decision That Police Need a Warrant to Access DNA
PHOENIX — In a 7-0 decision, the Arizona Supreme Court ruled that a warrant is required to extract and analyze people’s DNA, saying that a person’s limited consent to a search of biological material for a specific purpose—in this case, a blood alcohol test for a DUI arrest—does not overcome that requirement. The ACLU and the ACLU of Arizona filed a friend-of-the-court brief in State v. Mitcham, arguing the government cannot genetically test biological material it already has in its possession—whether that’s blood taken from newborns to test for diseases or swabs collected from sexual assault survivors—to investigate the donors for a crime without first obtaining a warrant. In the decision, the court wrote that “in reaching this conclusion, we emphatically reject the State’s position that it was free to analyze Mitcham’s blood in any way it pleased simply because the State lawfully possessed the blood vials.” “Government analysis of our DNA can expose detailed information about our identity, appearance, family relationships, medical conditions, and more. We don’t consent to sharing all of that information each time we involuntarily shed our DNA or consent to a blood draw. The government’s argument in this case was a privacy nightmare,” said Vera Eidelman, staff attorney with the ACLU’s Speech, Privacy, and Technology Project. “We are greatly heartened by the Arizona Supreme Court’s decision to preserve the privacy of our sensitive genetic information.” In 2015, during a DUI arrest, the defendant in this case consented to the government collecting a sample of his blood solely to test it for blood-alcohol content, and was advised that the sample would be destroyed after 90 days. Instead, law enforcement held on to this sample for three years, at which point it used it for a completely different purpose—to extract and analyze his DNA, without a warrant or consent—while investigating another crime. Had the court accepted the government’s rationale here, all of us who consent to a biological sample collection, at any point in time, for any purpose, to any government entity, could have been subject to a warrantless DNA search after the fact. “Our DNA can reveal so much about us that our genetic privacy must be protected,” said Jared Keenan, legal director of ACLU of Arizona. “The Court’s decision is vital to protecting the strong constitutional rights that keep all Arizonans’ information safe from warrantless searches and unconstitutional intrusion.” -
News & CommentaryDec 2024
Privacy & Technology
Face Recognition Threatens to Replace Tickets, ID at Sports Events – and BeyondFace Recognition Threatens to Replace Tickets, ID at Sports Events – and Beyond
You shouldn't participate in face recognition ticketing schemes. -
MississippiJul 2024
Free Speech
Privacy & Technology
NetChoice v. FitchNetChoice v. Fitch
Whether a law that mandates age verification for all users of social media services violates the First Amendment. -
News & CommentaryDec 2024
Privacy & Technology
AI Generated Police Reports Raise Concerns Around Transparency, BiasAI Generated Police Reports Raise Concerns Around Transparency, Bias
AI-generated police reports threaten to exacerbate existing problems in law enforcement, and to create new ones.