Rules
Illinois BIPA Explained: The Biometric Law Behind the Facebook Photo-Tagging Settlement
Illinois's 2008 Biometric Information Privacy Act (BIPA) required notice and written consent for face scans. It is the law behind the $650 million Facebook Tag Suggestions class settlement.
What to take away
- The Illinois Biometric Information Privacy Act (BIPA) was enacted in 2008 and sits at 740 ILCS 14. It regulates how private entities collect, keep and destroy biometric identifiers such as a "scan of hand or face geometry."
- Section 15(b) bars collecting a biometric identifier unless the entity first informs the person in writing and gets a written release. Section 15(a) requires a public written retention and destruction policy.
- Facebook's Tag Suggestions feature, launched in 2010, built face signatures from uploaded photos. Illinois users sued, saying this broke sections 15(a) and 15(b).
- In 2019 both the Illinois Supreme Court (Rosenbach) and the Ninth Circuit (Patel v. Facebook) ruled in ways that kept such claims alive, and in 2021 a federal judge approved a $650 million settlement.
- The settlement required Facebook to turn its Face Recognition setting off by default for users who had not opted in and to delete stored face templates unless users gave express consent.
The 2008 statute in plain terms
BIPA is a short Illinois law with a specific target: biometric data. Section 10 defines a "biometric identifier" as "a retina or iris scan, fingerprint, voiceprint, or scan of hand or face geometry." It lists exclusions, including photographs. That exclusion explains why photo-tagging cases focused on the face signature a platform derives from a photograph, not on the photo itself.
The Illinois legislature wrote findings into the Act. It said biometrics are unlike other unique identifiers, because a compromised Social Security number can be changed but biometric data are "biologically unique to the individual." The Ninth Circuit quoted those findings when it described the law's purpose.
Section 15 sets the duties. As quoted by the Ninth Circuit:
- Section 15(a):a private entity in possession of biometric identifiers must develop a written policy, available to the public, with a retention schedule and guidelines for permanent destruction. Data must be destroyed when the initial purpose has been satisfied or within three years of the individual's last interaction with the entity, whichever comes first.
- Section 15(b):no private entity may collect or otherwise obtain a biometric identifier unless it first informs the person in writing that it is being collected or stored, informs them in writing of the specific purpose and length of term, and receives a written release.
Who can sue, and for how much
Section 20 gives "any person aggrieved by a violation" a right of action in a state circuit court or as a supplemental claim in federal court. As quoted by the Illinois Supreme Court, a prevailing party may recover for each violation:
| Violation | Recovery |
|---|---|
| Negligent | Liquidated damages of $1,000 or actual damages, whichever is greater |
| Intentional or reckless | Liquidated damages of $5,000 or actual damages, whichever is greater |
| Either | Reasonable attorneys' fees and costs, and other relief such as an injunction |
These are the figures in the statute as quoted in the 2019 decisions. The Act has been amended since, so check the current text on the Illinois General Assembly website before relying on any figure.
How Tag Suggestions worked
The Ninth Circuit's opinion describes the feature. Facebook had long let users tag friends in photos. In 2010 it launched Tag Suggestions. When the feature is enabled, Facebook may use facial-recognition technology to analyze whether a user's friends appear in uploaded photos. The technology scans the photo for faces, extracts geometric data points that make a face unique, such as the distance between the eyes, nose and ears, and builds a face signature. It then compares the signature to stored face templates linked to user profiles. A match lets Facebook suggest a tag.
The court noted that Facebook created and stored a template for a user who had been tagged in at least one photo and had not opted out of Tag Suggestions, among other criteria. The templates were stored on Facebook's servers. The plaintiffs argued that this was a scan of face geometry collected without a written release and without a compliant retention schedule.
If you want the surrounding timeline, our Facebook and the FTC settlement timeline covers a separate federal case in which the FTC alleged that Facebook misrepresented controls for Tag Suggestions.
From complaint to the 2019 rulings
Three Illinois users, Nimesh Patel, Adam Pezen and Carlo Licata, filed a consolidated complaint in a California federal court in August 2015. The district court certified a class of "Facebook users located in Illinois for whom Facebook created and stored a face template after June 7, 2011."
Two decisions in 2019 shaped the case:
- Rosenbach v. Six Flags (Illinois Supreme Court, January 25, 2019).The court held that an individual need not allege some actual injury or adverse effect beyond a violation of their rights under the Act to qualify as an "aggrieved" person and seek liquidated damages and injunctive relief.
- Patel v. Facebook (Ninth Circuit, August 8, 2019).The panel held that the plaintiffs alleged a concrete and particularized harm sufficient for Article III standing, because the development of a face template without consent invades an individual's private affairs and concrete interests. It affirmed the class certification, and rejected Facebook's argument based on Illinois's extraterritoriality doctrine.
The $650 million settlement
On February 26, 2021, Judge James Donato of the Northern District of California issued the order granting final approval. He called the $650 million settlement a landmark result and one of the largest settlements ever for a privacy violation. The key terms described in the order:
- a non-reversionary common fund of $650 million, after Facebook agreed to add $100 million to an earlier proposal that the judge had declined to approve preliminarily;
- payment from the fund of administration costs, taxes, incentive awards and attorneys' fees, with the balance paid pro rata to class members who submitted valid claims;
- at least $345 for every class member interested in being compensated, according to the court;
- a claims rate of roughly 22 percent, against 4 to 9 percent typical for consumer class actions, according to the order;
- conduct changesfor users who had not affirmatively opted in or consented to biometric scans, Facebook would set its Face Recognition default to off, and it would delete existing face templates for class members unless it obtained express consent after a separate disclosure. Templates for class members with no activity for three years would also be deleted.
The court noted that Facebook's product manager said, under oath at the preliminary approval hearing, that the change to an opt-in default would be global.
Why the case matters for platform history
Three points stand out from the case record:
- Consent design.The law requires a specific written release, and the settlement moved Facebook's Face Recognition setting to an opt-in default for users who had not consented.
- Statutory damages.Because liquidated damages are set per violation, a class of millions produced exposure large enough to drive a large settlement, as the court itself noted when comparing the settlement to the theoretical possibility of billions.
- Standing.The courts held that violating the statute's procedures can itself be a concrete injury, a point the court noted Facebook and other large technology companies continue to contest.
For readers comparing regimes, our piece on Quebec Law 25 versus US platforms looks at a different consent model, and the platform timelines place the Facebook feature in the longer history of the service.
Common questions
Does BIPA apply to photos themselves?
Did the settlement end Facebook's face recognition?
Is the $345 figure what every user received?
Does BIPA cover only social media?
Official sources
- 8,Patel v. Facebook, Inc., No. 18-15982 (9th Cir. Aug. 2019)
- 2019Rosenbach v. Six Flags Entertainment Corp., IL 123186 (Illinois Supreme Court)
- 26,In re Facebook Biometric Information Privacy Litigation, Order re Final Approval (N.D. Cal. Feb. 2021)
