Meta, the parent company of Facebook and Instagram, can’t use its user agreement to escape yet another potentially massive payout from a lawsuit brought under Illinois’ stringent biometric privacy law, a federal judge has ruled.
In the decision, U.S. District Judge Nancy Rosenstengel essentially ruled that the need to maintain Illinois residents’ ability to use the Illinois Biometric Information Privacy Act (BIPA) to sue Meta outweighs the need to abide by the user agreement provision that would otherwise force users to abide by California law.
The decision was filed Feb. 20 in the U.S. District Court for the Southern District of Illinois.
The ruling comes as the latest step in a court fight dating back to 2023.
At that time, attorney Ryan A. Keane and others with the firms of Keane Law, of St. Louis, and Goldenberg Heller & Antognoli, of Edwardsville, filed their class action complaint in St. Clair County Circuit Court.
The lawsuit, filed on behalf of named plaintiffs Rebecca Hartman and Joseph Turner, both of East St. Louis, and their respective minor children, accused Meta of allegedly violating the Illinois BIPA law by scanning users faces when they accessed so-called “augmented reality filters” when using the Messenger and Messenger Kids messaging platforms.
The AR filters would allow users to humorously alter their likenesses in photos and videos captured by the Messenger system. For instance, users might alter their facial appearance to resemble cartoon unicorns, kittens and other non-human creatures, or to appear to be wearing certain kinds of masks, or to accentuate some of their facial features, among other applications.
Such AR filters were highly popular, particularly among young users of the Messenger and Messenger Kids platforms.
However, the lawsuit accuses Meta of violating the BIPA law by conducting the face scans needed to activate the AR filters without first securing authorization or providing certain notices concerning data collection and retention, as allegedly required by the BIPA law.
The lawsuit is just one of a growing number of thousands of class action lawsuits lodged against businesses in Illinois courts under the BIPA law.
While the bulk of those lawsuits have targeted Illinois employers, a large number of BIPA suits have also assailed tech giants, including Meta.
The lawsuits have typically accused targeted companies of violating the law by scanning people’s fingerprints, faces, voices and other so-called biometric identifiers, without first obtaining written consent or providing notices about how that information might be stored, used, shared and ultimately destroyed.
To coerce compliance, the law gave plaintiffs the so-called right of private action, allowing them to sue businesses accused of violating the BIPA law. Those sued can face potentially steep payment demands of $1,000-$5,000 per violation.
Under Illinois Supreme Court rulings, the law was interpreted broadly, as plaintiffs could bring their lawsuits against businesses without showing they were ever actually harmed, and they could demand payment for each and every allegedly illegal biometric scan.
When multiplied across potentially thousands or even millions of plaintiff class members, those payouts could quickly rise into the many millions or even billions of dollars.
Meta, for instance, has already famously paid $550 million to settle a class action accusing the company of scanning Illinois residents’ faces in photos uploaded to Facebook. And the company also agreed to pay $68 million to settle a similar class action over scans of photos uploaded to Instagram.
It is not yet known how many BIPA violations the new St. Clair County lawsuit would seek to pin on Meta over the alleged Messenger AR filter face scans, or how much the potential payout would be.
Illinois lawmakers recently reformed the BIPA law to make clear that the law should not be interpreted to allow damages to be calculated based on every scan, but only the first one. However, appeals courts are currently considering whether that change to the law should be applied to lawsuits filed before the reform provisions were signed into law, such as the St. Clair County Messenger AR filters suit.
After it was filed in St. Clair County Circuit Court, Meta removed the lawsuit to federal court.
And there, the company asserted it can’t be sued in Illinois under the law at all. Rather, the company argued a provision in the Messenger and Messenger Kids user agreement should be read to require legal disputes between users and the company to be decided under California law.
Thus, the company argued any alleged violations of users’ biometric privacy rights should be handled under California’s biometric privacy protection law — a law that does not include the so-called right of private action allowing people to sue, differing from Illinois’ unique BIPA law.
And in court, Rosenstengel said that difference should cancel out the California choice of law provision in the Messenger user agreement, as it would “negate” Illinois law and its “public interest” in ensuring its residents’ privacy rights are protected by the threat of potentially massive payouts through class action lawsuits.
The judge also rejected Meta’s argument that tossing aside the choice of law provision in the user agreement would amount to leaving international tech companies, based in California, exposed to uncertain legal risks under a patchwork of U.S. state laws.
“Considering the interests at stake, it is apparent that ‘Illinois will suffer a complete negation of its biometric privacy protections for its citizens if California law is applied,” Rosenstengel wrote, citing an earlier ruling out of California, addressing the earlier BIPA action against Facebook. “‘In contrast, California law and policy will suffer little, if anything at all, if BIPA is applied.’
“The imbalance of harm in Facebook Biometric justified a finding that Illinois had a materially greater interest in the case than California.
“The same is true here. Illinois has a materially greater interest in this litigation than California because the application of California law would result in the evisceration of one of the state’s critical pieces of privacy legislation,” Rosenstengel wrote.
Meta is represented in the action by attorneys from the firms of Gibson Dunn & Crutcher, of New York and Los Angeles; and Latham & Watkins, of Chicago.
