A federal court says Facebook users in Illinois can join a class-action lawsuit against the social media giant, potentially collecting thousands of dollars per account.
A federal appellate court ruled unanimously Thursday that Illinois-based users who want to sue Facebook for allegedly breaking state law by collecting biometric data may do so as one large class-action lawsuit. Facebook told Forbes that it plans to appeal the ruling. Google had a similar case dismissed.
The lawsuit alleges Facebook broke Illinois’ Biometric Information Privacy Act, which requires companies to ask to collect facial, fingerprint or other physical characteristic data and then explain how they plan to use the data.
“Facebook intentionally refused to do either,” said Jay Edelson of Edelson PC, an attorney involved in the suit.
With anywhere from 5 million to 10 million Facebook users in Illinois, he said a final judgment could cost the company up to $40 billion.
“Each person in Illinois would get $1,000 and if we can show willfulness, that would go up to $5,000,” he said.
Should the case go to trial, Edelson said it’s likely Facebook CEO Mark Zuckerberg would testify.
Illinois has the nation’s strongest biometric privacy laws. It is the only state where individuals can seek damages in court. Edelson said it’s paramount to keep companies like Facebook from storing that data and, willingly or not, putting it in the hands of a bad actor.
“There’s already technology that people, if they have your face template, can make a mask, which will trick a lot of security systems into thinking that it’s you,” Edelson said.
Facebook recently cut a $5 billion check to pay a fine for something similar in the European Union.
In light of Illinois’ strict BIPA law, a number of companies have blocked certain services to users in the state to avoid possible violations of the state law.