By: Josh McIntyre

Before it became the name of the world’s largest social media network, a “face book” was a print or online directory of photographs designed to help students recognize their classmates.  Facebook has lived up to that name so well that it is now threatened with billions of dollars in fines for allegedly misusing facial-recognition technology.  The case, now proceeding in a federal court in San Francisco, is a good reminder of the importance of practicing Online Identity Management – a continual effort to monitor and maintain a good online image that will protect your personal and professional reputation.

A Database of Faceprints.  For more than five years, Facebook has offered a feature called “Tag Suggestions” that automatically identifies people in a photograph and suggests a nametag linking the photograph to the subject’s Facebook profile.  Like other facial-recognition software, Tag Suggestions requires users to first identify the subject by applying a nametag to a photograph.  The software then analyzes the photo and generates unique data describing the subject’s facial features.  Whenever a new photograph is added, Tag Suggestions scans it for a match to the faceprints in its database.  By default, the software never asks the subject if he wants to be identified in photographs uploaded by other users.

Does It Cross the Line?  The technology is now being challenged in several lawsuits that claim facial-recognition without proper consent violates Illinois law.  In 2008, Illinois passed the Biometric Information Privacy Act to govern the collection, use, and sale of biometric identifiers such as fingerprints, voiceprints, and “scans of face geometry.”  Any business in possession of biometric identifiers must publish a policy describing how it collects, stores, and uses the information, and must obtain written consent from each subject before the data is collected.

In the class-action lawsuit In re Facebook Biometric Information Privacy Litigation, Facebook users allege that Facebook failed to inform them of the technology and failed to obtain their informed consent.  The case presents two important questions.  First, can Illinois law protect Facebook’s users who live in Illinois, even though the Terms of Service say that only California law will apply to disputes between Facebook and its users?  And if Illinois law applies, does the Tag Suggestion software violate the law?

The users face an uphill battle. Even if the court applies the Illinois law, the law does not protect photographs or information derived from photographs, which is exactly how Tag Suggestions works.  To succeed, the users will have to convince the court that Tag Suggestions are instead more like fingerprints or a “scan of face geometry.”

What Can You Do?  Everyone – from employers and customers to opposing parties in litigation – uses online data to form opinions about you.  Much of this information may have been posted without your knowledge.  To protect your personal and professional reputation, practice Online Identity Management by regularly searching social networks and websites for your name, photograph, and any negative or false information.  You might then increase privacy settings, opt-out of services, or challenge inaccurate information.  These options and important information about how a website uses data about you are described in Privacy Policies typically linked at the bottom of a website’s homepage.  Facebook’s policy, for example, describes how users can turn off Tag Suggestions, which automatically deletes the user’s faceprint data and prevents the user’s name from being suggested for future tagging.  By reading the policies, adjusting your settings, and taking appropriate action, you can begin to protect your privacy no matter where the technology leads us.

Josh writes regularly on tech law topics, and his work has been cited in the Iowa Defense Counsel Association’s Defense Update, Depaul Law Review, Privacy and Data Protection in Business, and The Oxford Handbook of Internet Studies. Learn more at https://l-wlaw.com/attorneys/joshua-j-mcintyre/.