On January 29, 2020, Facebook reportedly entered into a $550 million settlement to resolve class claims brought by Illinois Facebook users under the Biometric Information Privacy Act (“BIPA”). This case involved Facebook’s “Tag Suggestions” feature, which develops and stores unique facial signatures that recognize Facebook users from photos uploaded to the website. The news of Facebook’s settlement comes just over a year after the Illinois Supreme Court’s Rosenbach v. Six Flags decision opened the floodgates by finding that a mere technical violation is all that is needed for an individual to be “aggrieved” under BIPA.[1]
Originally filed in Illinois state court in 2015, the case against Facebook turned into a five-year whirlwind of pre-trial procedural and substantive rulings. After being transferred to federal court in the Northern District of California, a class was eventually certified and was expected to include approximately seven million Facebook users in Illinois. The Ninth Circuit Court of Appeals unanimously affirmed certification of the class, marking the first appellate decision to allow BIPA claims to proceed on a class-wide basis.[2] In December, Facebook unsuccessfully petitioned the U.S. Supreme Court for a writ of certiorari.
With the Supreme Court’s refusal to hear Facebook’s appeal effectively greenlighting a trial with over ten billion dollars at stake, Facebook agreed to settle the claims and establish a $550 million fund to compensate the Illinois users who allege Facebook violated BIPA.
Three additional takeaways from the news
First, Facebook’s settlement is not surprising. Facebook faced unique pressures from this lawsuit. Unlike the majority of BIPA defendants, Facebook marketed the face-tagging feature that was the subject of this suit. Moreover, Facebook has been under well-publicized scrutiny relating to its use of customer data and privacy procedures including a recent $5 billion fine from the Federal Trade Commission. Further discovery and a public trial in this case—including the potential disclosure of the profits that Facebook reaped from its actions—likely increased this pressure. Facebook also faced a much larger liability (with an estimated seven million potential class members) and had the benefit of a profitable 2019 (including a reported $21 billion in revenue during the fourth quarter of 2019) to cover the costs of the settlement. Although the settlement breakdown is not yet public, press reports have suggested that each class member may seek up to $200–$300—only a portion of the $1,000 statutory award for a BIPA claim based on negligence or the $5,000 statutory award for a BIPA claim based on intentional conduct. The relatively low per-user settlement amount may be a helpful precedent to other BIPA defendants seeking to limit their exposure, many of whom may have better defenses than Facebook could have asserted.
Second, while Illinois remains the only state with private right of action, other states and municipalities have been actively considering and pushing for similar BIPA legislation. The nationwide press coverage of the settlement may lead to additional legislative efforts in these and other states.
Third, the steady stream of new BIPA filings (approximately 10 per week in Cook County) is not likely to subside following the widespread news of the settlement. Press coverage has included the Chicago Sun Times, the Chicago Tribune, the New York Times, and the Wall Street Journal. The increased press coverage for BIPA could lead other individuals to come forward with BIPA claims. BIPA claims have impacted a number of industries including employers that use fingerprint or hand scanning for time-keeping or log-in purposes and companies that employ video monitoring that may capture facial features. Thus, businesses with exposure to BIPA can expect BIPA cases to continue steadily throughout Illinois. Click here for Nixon Peabody’s previous guidance on the steps to comply with BIPA.
BIPA sets forth what a company can do to limit its exposure. These steps include having a written policy that complies with the Act and signed written consent from the person whose biometric information is collected. Nixon Peabody has assisted clients to update their disclosures and policies to ensure compliance with BIPA.