EAST ST. LOUIS - Meta Platforms must defend a claim that facial recognition on Facebook Messenger and Messenger Kids violates privacy of biometric data, Chief U.S. District Judge Nancy Rosenstengel ruled on Sept. 17.
She denied a motion to dismiss a class action complaint that St. Clair County residents Rebecca Hartman and Joseph Turner filed last year.
Hartman and Turner claim Meta doesn’t comply with Illinois biometric privacy law when it collects face geometries from filters and effects like bunny ears.
Rosenstengel found that by scanning face geometries and centrally storing them on servers as plaintiffs allege, Meta plausibly gathers data and takes control of it.
“Although more information would have been helpful, plaintiffs have sufficiently alleged that they supplied identifying information that Meta could match to their face geometry scans to identify them,” she wrote.
Attorneys Ryan Keane and Tanner Kirksey of St. Louis County represent Hartman and Turner.
They sued Meta in St. Clair County circuit court last year and Meta removed the complaint to district court on the basis of diverse citizenship.
The suit claims Meta did not inform Illinois users that their biometric data was being collected when they used the augmented reality filters on Messenger applications.
Meta allegedly provided no way for users to opt out of its data collection and failed to publish and follow a data retention and destruction policy.
Meta counsel Lauren Goldman of New York City moved to dismiss the complaint in November.
Goldman claimed Illinois law didn’t cover facial scans because they are not unique to individuals and thus incapable of identifying them.
She claimed plaintiffs did not provide information that would allow Meta to match the alleged facial geometry scans to individual users.
She claimed that without the information it was impossible to identify people whose faces were scanned regardless of the uniqueness of the data.
She also claimed jurisdiction belonged in California.
She attached terms of service and signup pages for Facebook and Messenger Kids, an introduction and a privacy notice for Messenger Kids, a Federal Trade Commission article and privacy notices for faces and hands.
Rosenstengel found none of them worthy of consideration.
She found Meta contended the documents were fair game because they were part of its website and plaintiffs cited other parts of the website in the complaint.
“But these documents are not mentioned in plaintiffs’ complaint nor do they appear central to their claims,” Rosenstengel wrote.
She found the terms and conditions of relationship with Meta didn’t mention biometric data.
She found the signup pages asked users for name, birthday, and gender.
“But the signup pages also do not mention anything about biometric data,” she wrote.
She found nothing in these documents that suggested their centrality to plaintiffs’ claims.
She found it unclear whether four exhibits accurately presented terms and conditions of relationship with Meta over time.
She found terms and conditions might have been modified over the years, triggering questions of whether a valid agreement was ever reached on these terms.
She found it entirely possible that prior versions of privacy notices contained different language about Meta’s collection of data or that they contained no such language at all.
She found the documents relevant but extraneous at the motion to dismiss stage.
She found plaintiffs alleged the scans modeled user faces based on estimation of the location of parts of faces.
“These allegations permit an inference of personalization that supports the uniqueness of each scan based on the user from whom it was taken,” Rosenstengel wrote.
“Indeed, the point of this process is to allow users to superimpose filters and effects like bunny ears or cat whiskers on their face.
“To do so effectively, the bunny ears or cat whiskers would have to appear in a location that creates a plausible appearance.
“If the filters and effects were applied based on a generic face template that included an oval shape to convey a facial structure, and general outlines of ears, nose, and mouth, the filters and effects could and often would create an odd appearance.
“Bunny ears could appear on the user’s forehead or be superimposed in a location that is not connected to the face at all.
“The technology would have little entertainment or commercial value if it applied these effects in such a non personalized manner."
She found scanning a face to identify locations of constituent parts including eyes, nose, mouth, and ears, creates a geometric representation unique to that person.
She found the estimation of location is intrinsically unique and could plausibly identify a user.
“Affording the complaint the generous interpretation to which it is entitled, the court finds that it sufficiently alleges that Meta scanned users’ face geometries and that these scans are capable of identifying the people from whom they were taken," she wrote.
She rejected Meta’s claim that the law doesn’t apply because it didn’t collect or store data.
She found that according to Meta information is stored only on personal devices, not on servers or in databases that Meta controls.
“Thus, so the argument goes, if the information at issue never leaves a personal device, there is no way Meta could collect or possess it.”
She found plaintiffs alleged that Meta collected data of each child and adult who used an effect or filter and stored it locally on user devices and servers.
She found they alleged Meta retains exclusive control over the process by which biometric data is harvested and stored.
She rejected California jurisdiction, for the moment at least.
She found the argument relied on choice of law provisions in the terms of service which she excluded from review.
“To be clear, the court’s decision to apply Illinois law for the limited purpose of testing the legal sufficiency of plaintiffs’ claims does not resolve the question of which state’s law ultimately governs this case,” she wrote.
She wrote that she’d set a scheduling conference by separate order.