People in Illinois keep suing tech companies for tagging them in photos

This week an Illinois woman filed a class action lawsuit against Google, alleging that the company broke the law by using facial recognition technology to tag her in someone else’s photos. Google is in good company in the Prairie State: the image publishing firm Shutterfly is facing similar allegations, as is Facebook, which has in the past two years been sued over its photo-tagging tech at least four times.

It’s not that Illinois residents hate how they look in photos more than people in the rest of America. In 2008, the state passed the Illinois Biometric Information Privacy Act, making it, along with Texas, one of only two states with laws on the books governing the use of biometric data. That includes “faceprints,” which is what companies like Facebook and Google use to identity you in photos; they created the faceprints by analyzing your face in the many tagged photos you’d previously uploaded to their servers. In the suit, plaintiff Lindabeth Rivera takes issue with the fact that the photos she was identified in were taken by someone else and stored on their device.

The broader concern over facial recognition technology is that it could be used to identify people when they would rather not be, such as at stores, political protests or in church. Illinois and Texas believe that use of these identifiers should be closely governed because unlike your Social Security number or driver’s license, short of some kind of “Face Off” scenario, these identifiers can’t be changed. You can’t just go to the DMV and get a new face (though you can change it temporarily).

The Illinois law went mostly unnoticed until April of last year, when a high-profile privacy lawyer filed the first lawsuit in federal court against Facebook and inspired a string of copycats. Facebook has argued that its faceprints do not stray from the terms of service that users agree to when using the site and that because the faceprints are derived from photographs, the Illinois law does not apply. Notably, Facebook only tags you in your friends’ photos, and doesn’t identify you for strangers. So, sorry, but you can’t snap a photo of a hottie at the bar, load the photo into Facebook and find out who they are.

A federal judge last month dismissed one of the Illinois suits against Facebook, on the grounds that the state did not have jurisdiction, but the Shutterfly suit has been allowed to proceed.

There will likely be many more facial-recognition lawsuits in the US. Not so in Europe: Facebook canned its facial recognition tagging system there because European users and privacy regulators objected to the creation of faceprints without the explicit consent of the person in the photo.

Here in the US, there have been attempts to get federal consensus around the use of facial recognition, but they’ve been unsuccessful so far. Last year, multiple privacy groups withdrew from discussions with the advertising and technology industry on how to create guidelines for face-recognition technology after growing frustrated with unwillingness to grant even the most minimal of protections.

Faceprints are still for the most part unregulated. But regulators will be closely watching how Google’s case and others play out in Illinois as they consider crafting bills of their own.