Skip to main content

Google's Face Scanning on Android Photos Doesn't Violate Privacy

By Lisa M. Schaffer, Esq. on January 02, 2019 | Last updated on March 21, 2019

Facial recognition software is all the rage these days, from unlocking your iPhone to unlocking doors at your place of business to allowing you access to theme parks with your season pass. As creepy as biometrics often seems to the general public, it is not a violation of privacy. Google won a major biometrics lawsuit in Illinois federal court this week, based on a challenge under Illinois Biometric Information Privacy Act. Facebook still faces a similar legal challenge, but Google is off the legal hook.

What Is Facial Recognition Software?

Google's facial recognition software is imbedded in its Google Photos app. This software analyzes faces that are uploaded in users' photos, and can recognize unique characteristics, including gender, race, age, and location. Users can then easily search through their photos to find other pictures of specific people or places. The company has yet to use the analysis for anything other than a fun "Search" function for users, but does admit there are interesting monetization applications that could tie into it.

Illinois' BIPA Law

Plaintiffs in this lawsuit claimed Google's software violated their rights under Illinois Biometric Information Privacy Act (BIPA). Under BIPA, private companies cannot collect or store biometric identifiers, including face geometry, without the prior written consent of the person or provided disclosures. Illinois has become a hotbed for facial recognition controversy, since this is the only law in America that allows for statutory damages: $1,000 per negligent violation and $5,000 per intentional or reckless violation, as well as attorneys' fees.

Plaintiffs claimed that the photos taken with Android devices and uploaded to Google Photos, which uses the face analyzer, unlawfully created a scan of their face without their consent. One plaintiff acknowledges the photos were taken with his own phone, but the other plaintiff claimed the photo was taken with someone else's phone. But that didn't seem to matter.

In granting Google's summary judgment motion, the Seventh Circuit court held that mere retention of the facial recognition information by Google is not sufficient to cause injury, which is a necessary element to have standing for a claim under this Act. The judge also emphasized that people cannot have a realistic expectation of privacy of their actual face, Google did come into possession of these photos lawfully, so there were really no other laws that plaintiffs could possibly win if the case went to trial. Though the judge acknowledged that it's possible Google could use this data in an unlawful way years down the road, to date it hasn't, and therefore there is no cause of action.

If you believe facial recognition software has in some way violated your rights, contact a consumer protection attorney. Though Illinois is the only state that provides for statutory damages, other states have laws that limit what companies can do with your facial data.

Related Resources:

Copied to clipboard