Facebook Could Face $500 Billion in Fines for Illegally Collecting Biometric Data Through Instagram

Facebook-owned Instagram was sued Monday for illegally collecting, storing and distributing the facial recognition data of its users and could face up to $500 billion in fines. A class action lawsuit filed in San Mateo Superior Court by Illinois resident Kelly Whalen on Aug. 10 alleges that Facebook and Instagram are routinely harvesting and sharing its users’ biometric data without informing them or asking for consent to collect it. The lawsuit requests Facebook pay every member of the class $5,000 for each intentional violation of the Illinois BIPA act, which prohibits misuse of biometric data, or statutory damages of $1,000 for every negligent violation of the law — Business Insider estimated that could total up to $500 billion in fines given that at least 100 million Instagram users could be included in the class. Facebook recently paid $650 million in July to settle a similar case about its misuse of facial recognition data. “This suit is baseless. Instagram doesn’t use Face Recognition technology,” Facebook spokesperson Stephanie Otway told TheWrap in an email. Whalen’s class includes any Illinois resident who has had their biometric identifiers or facial geometry scans at all obtained by Facebook through photos uploaded to its Instagram app. The plaintiff is represented by Chicago-based law firm Carlson Lynch, which did not immediately respond to TheWrap’s requests for comment. The lawsuit reports Facebook began using facial recognition technology in 2010 and started using it on Instagram after it bought the San Francisco-based photo sharing network in 2012. It essentially uses the tech to scan photos of faces uploaded to the Instagram app to collect a profile of unique facial recognition and other biological data for specific users. “Facebook is actively collecting, storing, disclosing, profiting from, and otherwise using the biometric information of its reportedly more than 100 million Instagram users without any written notice or informed written consent, including millions of Illinois residents,” the lawsuit reads. The practice is problematic in part because it doesn’t allow users to opt-out of data collection — “Indeed, Instagram users are not even given an opportunity to provide a written release because Facebook automatically processes content and shares it across its platforms,” the filing said. “Even if a user does not have facial recognition activated on their personal account, their photo may still be scanned, collected, and entered into Facebook’s database if it matches with a user’s data who does have the facial recognition setting activated,” the lawsuit notes. “This further means that one can never truly “opt out” because Facebook must capture and compare the biometrics of a face before learning if that face in fact matches with faces of users who have their facial recognition setting turned on or off.” The filing said that Instagram reported 118 million users in the United States last year — and points out that Whalen and other defendants (and most Instagram users) are unable to know which third parties Instagram allowed to view their facial recognition data or for what purpose. Instagram users whose data has been collected by Facebook “have no recourse for the fact that their biologically unique information has been compromised,” the lawsuit states. Pamela Chelin contributed to this report