From face recognition to fingerprints, biometric data is widely used in today’s consumer technology to sort through pictures, unlock phones, and more. Some states have passed privacy laws to govern usage, with the Biometric Information Privacy Act (BIPA) in Illinois allowing individuals to seek damages. A lawsuit involving Google Photos was just dismissed in a win for the company.

Rivera v. Google, Inc. dates back to 2016 and involves two individuals alleging that Google Photos made biometric scans of them without explicit permission as required by the 2008 Illinois law.

The first case involves a separate individual using a “Google Droid device” to take pictures of the plaintiff that were then uploaded to Google Photos. Presumably, the account where the pictures resided had the “Group similar faces” feature enabled.

As soon as the photographs of Rivera were taken, the Droid automatically uploaded them to the cloud-based Google Photos service. Id. According to the Complaint, Google immediately scanned each uploaded photograph of Rivera. Id. ¶ 28. The scans located her face and zeroed in on its unique contours to create a “template” that maps and records her distinct facial measurements.

Meanwhile, the second plaintiff took pictures of himself on a device and Google Photos account that he owned and managed.

Weiss’s experience was similar, except that Weiss himself was a user of Google Droid and Google Photos (Rivera, on the other hand, neither had a Droid nor a Google Photos account).

Google Photos facial recognition privacy lawsuit

Both argue that Google did not seek their permission to create or use the “face-templates,” nor did the plaintiffs grant the company “permission to collect or store the data derived from their faces.”

Based on these allegations, Rivera and Weiss, individually and on behalf of a proposed class, bring suit against Google for a violation of the Illinois Biometric Information Privacy Act. They argue that the face geometry templates created by Google are “biometric identifiers” within the definition of the Privacy Act, and accordingly cannot be collected without consent.

Bloomberg this morning reported that the case was dismissed by the U.S. District Judge for the Northern District of Illinois due to a lack of “concrete injuries” to the plaintiffs. They were seeking $75,000 in damages with BIPA permitting $1,000 fines per violation and $5,000 per intentional violation.

Google Cloud earlier this month noted how it won’t sell facial recognition tech to third-parties as the company works through policy and privacy questions. In contrast to Amazon and Microsoft, Google touted this deliberate pause as a result of its AI Principles being applied.

Check out 9to5Google on YouTube for more news:

FTC: We use income earning auto affiliate links. More.

Check out 9to5Google on YouTube for more news:

You’re reading 9to5Google — experts who break news about Google and its surrounding ecosystem, day after day. Be sure to check out our homepage for all the latest news, and follow 9to5Google on Twitter, Facebook, and LinkedIn to stay in the loop. Don’t know where to start? Check out our exclusive stories, reviews, how-tos, and subscribe to our YouTube channel

About the Author

Abner Li

Editor-in-chief. Interested in the minutiae of Google and Alphabet. Tips/talk: