Facebook has settled a lawsuit over facial recognition technology, agreeing to pay $550m (£419m) over accusations it had broken an Illinois state law regulating the use of biometric details.
The settlement was quietly disclosed in the company’s quarterly results, released on Wednesday evening, which showed record revenues overall at the company, but also surging costs.
It is one of the largest payouts for a privacy breach in US history, a marker of the strength of Illinois’s nation-leading privacy laws. The New York Times, which first reported the settlement, noted that the sum “dwarfed” the $380m penalty the credit bureau Equifax agreed to pay over a much larger customer data breach in 2017.
Illinois heavily regulates the use of biometric identifiers, prohibiting the collection and storing of biometric information without consent from individuals. The law, passed in 2008, also requires companies to store the identifiers securely, and to delete them in a timely manner.
In a class action suit, Facebook users in the state argued that a feature launched in 2011, called tag suggestions, broke the rules by automatically processing and storing facial recognition imagery for every US user without first asking permission. The feature compares uploaded photos to those of the user’s friends, in order to suggest who should be tagged in any given image.
The Illinois law allows individuals to sue for up to $5,000 per violation, which, in a state of more than 12 million people, can rapidly add up for technology companies that process information at scale.
Facebook’s decision to settle, the company’s chief financial officer told investors, was just part of the increase in the company’s rising cost base. A spokesperson said: “We decided to pursue a settlement as it was in the best interest of our community and our shareholders to move past this matter.”
Tag Suggest also landed the company in hot water in the EU, where it was disabled a year after it was introduced following a report from the Irish data protection commissioner. It removed it from Canada around the same time. But neither of those removals resulted in a monetary fine for the company, even though the feature was live for users for without consent for months.
It would be another six years before Facebook launched a facial recognition feature in the EU, until it seized the opportunity of GDPR to force every user to actively give or withhold consent.
If users wanted to accept the new permissions, they were able to click “accept and continue”. Declining, however, was harder. The only other option was a white button labelled “manage data settings”, which took them to a second page where Facebook gave more information about the positives of consenting, and then a third page where they are able to opt out.