CHICAGO (CN) – A federal judge in Illinois refused Monday to dismiss a class-action lawsuit claiming Google illegally collects face geometry scans from photographs taken on its smartphones without users’ knowledge.
Lead plaintiff Lindabeth Rivera alleges a photo taken of her on a Google Android device was automatically uploaded to the company’s cloud-based service, Google Photos, where her facial features were scanned to create a unique face template without her consent.
Co-plaintiff Joseph Weiss says Google used photographs from his Android device to “unlawfully create a face scan.”
On behalf of a proposed class, Rivera and Weiss accuse the company of violating the Illinois Biometric Information Privacy Act because the photos were taken by Google devices in the Prairie State.
“Between around March 2015 and March 2016, ‘approximately eleven’ photographs of Lindabeth Rivera were taken in Illinois by a Google Photos user on a Google Droid device,” according to court records. “As soon as the photographs of Rivera were taken, the Droid automatically uploaded them to the cloud-based Google Photos service.”
Rivera claims Google then scanned the uploaded photos, zeroing in on her facial features to create a “template” to map and record her unique facial measurements.
Weiss alleges that between 2013 and 2016, about 21 photos he took of himself on his Android device in Illinois were also automatically uploaded and scanned with the same custom face template technology.
Rivera and Weiss both claim their face templates were then used by Google to find and group together other photos of them.
Google, without permission, allegedly used the templates to recognize their unique characteristics, including gender, race, age and location.
Rivera and Weiss claim the face templates created by Google are “biometric identifiers” that cannot be collected and stored without permission under the Biometric Information Privacy Act.
The class-action complaint also alleges Google failed to publish a policy describing how long it stores biometric data or how it discards it, which is required by the Act.
Google filed a motion to dismiss the complaint, claiming face-scan measurements derived from a photograph are not biometric identifiers and only in-person scans qualify as such.
On Monday, U.S. District Judge Edmond Chang rejected the tech giant’s request.
“Indeed, because advances in technology are what drove the Illinois legislature to enact the Privacy Act in the first place, it is unlikely that the statute sought to limit the definition of biometric identifier by limiting how the measurements are taken. Who knows how iris scans, retina scans, fingerprints, voiceprints, and scans of faces and hands will be taken in the future?” Chang wrote in his 30-page opinion. (Emphasis in original.)
Chang noted that Rivera and Weiss do not claim that the photos themselves are biometric identifiers, only the face templates.
“The bottom line is that a ‘biometric identifier’ is not the underlying medium itself, or a way of taking measurements, but instead is a set of measurements of a specified physical component (eye, finger, voice, hand, face) used to identify a person,” the judge wrote. (Parentheses in original.)
Google also argued that what Rivera and Weiss complain about occurs online or in a cloud, not in Illinois, and applying the Privacy Act to Google would be an extraterritorial application of the statute, but Chang said it was too early to dismiss the case on those grounds.
“The court concludes that the plaintiffs sufficiently allege facts that would deem the asserted violations as having happened in Illinois. But there is no bright-line rule for determining this, so the parties will have the chance to develop more facts during discovery,” the judge wrote.