The plaintiff alleges that Google is using "face geometry" without permission in violation of the Illinois Biometric Information Privacy Act, one of two such statutes in the U.S.

On March 1, 2016, Lindabeth Rivera filed a class action lawsuit in the U.S. District Court for the Northern District of Illinois against Google, Inc. for alleged violations of the Illinois Biometric Information Privacy Act (740 ILCS 14/1).

Google is not the first company to face such a lawsuit. Shutterfly was sued in June 2015 and Facebook was sued in August 2015. Both of those cases were also filed in the NDIL. The lawsuit against Facebook was dismissed for lack of personal jurisdiction. Gullen v. Facebook, Inc., 1:15-cv-07681, Dkt. 37 (N.D. Ill. Jan. 21, 2016). The Shutterfly case survived a Rule 12(b)(6) motion to dismiss, and, according to an order entered on March 28, 2016, has settled. Norberg v. Shutterfly, Inc., 1:15-cv-05351, Dkt. 89 (N.D. Ill. Mar. 28, 2016).

The Illinois Biometric Information Privacy Act ("BIPA") was enacted in 2008, and there is no published case law that interprets the Act. According to the International Business Times, Illinois is the only state that authorizes statutory damages for violations of its statute; Texas is the only other state that currently regulates the use of biometric data. See http://www.ibtimes.com/google-gets-sued-over-face-recognition-joining-facebook-shutterfly-battle-over-2330278.

The Act defines a "biometric identifier" as "a retina or iris scan, fingerprint, voiceprint, or scan of hand or face geometry." It excludes, among other things, photographs. 740 ILCS 14/10.

It prohibits the collection, capture, or purchase of an individual's biometric information without first disclosing that the collection is taking place, the purpose for the collection, and the length of time the information will be stored and used. Written consent must also be obtained from the individual. 740 ILCS 14/15(b)(1)-(3).

Violations of the Act create a private cause of action. A successful plaintiff can recover its attorney's fees and actual damages or statutory damages of $1,000 for a negligent violation and $5,000 for a reckless violation. 740 ILCS 14/20. In a class action context, a successful BIPA complaint could expose a defendant to millions of dollars in liability.

Face templates, not photos

Rivera's complaint, which was filed by the same attorneys that filed the Shutterfly and Facebook lawsuits, alleges that Google violated Rivera's, and her class members', rights by "actively collecting, storing, and using - without providing notice, obtaining informed written consent or publishing data retention policies - the biometrics of thousands of unwitting Illinois residents." Rivera v. Google, Inc., 1:16-cv-02714, Dkt. 1 at ¶ 4.

Google has a service named Google Photos. According to the complaint, the service stores "millions of 'face templates'" of Illinois residents, many of whom are not enrolled in the service. Each "face template" is allegedly "unique to a particular individual, in the same way that a fingerprint or voiceprint uniquely identifies one and only one person." Id. ¶ 5.

At the heart of the complaint is that the plaintiff and her proposed class are people who are not users of the Google Photos service. Google Photos is a service that allows users to tag people in their photos. The service then recognizes those individuals in other photos, allowing users to search their photos more effectively.

Google Photos indexes users' photos using, among other things, face templates. When people actively use Google Photos, they have no doubt agreed to Google's terms of service before using the service. Rivera's complaint alleges that those who are not users have not consented to having their biometric information used or stored by Google. The complaint also alleges that "Google's failure to provide a publicly available written policy regarding their schedule and guidelines for retention and permanent destruction of non-users' biometric information" also violates the Act. Id. ¶ 18.

Although the Act exempts photographs from the definition of biometric identifiers, Rivera's complaint alleges that Google Photos "extracts geometric data relating to the unique points and contours (i.e., biometric identifiers) of each face, and then uses that data to create and store a template of each face." Id. ¶ 21.

Rivera alleges that, since the launch of the Google Photo service, a Google Photos user that resides in Illinois took approximately eleven photos of her, which were automatically uploaded to the cloud-based service. She further alleges that, upon upload to the service, Google analyzed her photos, extracting data about her face geometry. This was done without her consent.

The complaint alleges that the potential class may contain thousands of individuals located in Illinois. As of press time, Google had not yet filed a responsive pleading. Attorneys for all parties were unavailable for comment.