`
`
`
`CARLSON LYNCH, LLP
`TODD D. CARPENTER (234464)
`1350 Columbia Street, Suite 603
`San Diego, CA 92101
`Tel:
`619-762-1910
`Fax: 619-756-6991
`tcarpenter@carlsonlynch.com
`Attorneys for Plaintiffs and the Proposed Class
`[Additional counsel listed on signature page.]
`
`
`
`UNITED STATES DISTRICT COURT
`NORTHERN DISTRICT OF CALIFORNIA
`OAKLAND DIVISION
`Case No. 4:20-cv-06361-JST
`KELLY WHALEN, S.M., a Minor, By and
`Through Her Guardian, Tachah Wade, and
`CONSOLIDATED CLASS ACTION
`VICTORIA EDELSTEIN, Individually and on
`COMPLAINT
`Behalf of All Others Similarly Situated,
`DEMAND FOR JURY TRIAL
`Plaintiffs,
`
`v.
`FACEBOOK, INC.,
`Defendant.
`
`Plaintiffs Kelly Whalen, S.M., a minor, by and through her guardian Tachah Wade, and
`Victoria Edelstein, individually and on behalf of all others similarly situated, through undersigned
`counsel, bring this Consolidated Class Action Complaint for Violations of the Illinois Biometric
`Information Privacy Act (“BIPA”), 740 ILCS 14/1, et seq., against Defendant Facebook, Inc.
`(“Facebook” or “Defendant”), and allege the following upon information and belief, except as to the
`allegations within Plaintiffs’ personal knowledge. Plaintiffs believe that substantial additional
`evidentiary support will exist for the allegations set forth herein after a reasonable opportunity for
`discovery.
`SUMMARY OF THE ACTION
`I.
`Facebook, Inc. is a social media conglomerate founded in 2004. It owns its eponymous
`1.
`social networking platform in addition to a host of subsidiaries.
`
`
`
`1
`CONSOLIDATED CLASS ACTION COMPLAINT
`
`1
`2
`3
`4
`5
`6
`7
`8
`9
`10
`11
`12
`13
`14
`15
`16
`17
`18
`19
`20
`21
`22
`23
`24
`25
`26
`27
`28
`
`
`
`
`Case 4:20-cv-06361-JST Document 37 Filed 01/26/21 Page 2 of 27
`
`
`
`
`Instagram is a photo and video-sharing social networking service that is owned by
`2.
`Facebook, Inc. It was initially released as an application for the iOS mobile operating system in 2010
`before being acquired by Facebook in 2012. Since its acquisition by Facebook, Instagram has steadily
`amassed new users worldwide. In 2019, there were more than approximately 118 million users in the
`United States alone.
`Facebook’s social media platform offers a multi-faceted approach for users to connect
`3.
`with one another. In addition to sharing photos and videos, Facebook is a social networking service,
`which allows users to share news articles, create special interest groups, shop, and more. Instagram,
`on the other hand, is more limited in its scope of use. Its primary features are photo and video sharing,
`direct messaging, and “stories,” which are photos and/or videos that disappear from a user’s profile
`after 24 hours.
`Facebook holds the largest facial dataset to date, powered by DeepFace, Facebook’s
`4.
`deep-learning facial recognition system, which collects information about face geometry.1 Based on
`testing, the DeepFace facial recognition system closely approaches human-level accuracy in
`identifying faces. Unless a user opts out, Facebook scans photos uploaded to the social network in
`search of faces it recognizes using its DeepFace technology.2
`Earlier this year, Facebook agreed to pay $650 million to settle a class action that
`5.
`accuses the company of illegally harvesting the protected biometrics of users of its Facebook platform.
`As part of the settlement, Facebook agreed to delete face templates of users that it had created and
`stored.
`As set forth below, Facebook also illegally harvests the protected biometrics of users
`6.
`of its Instagram application. In direct violation of Sections 15(b)-(e) of the BIPA, Facebook is actively
`collecting, storing, disclosing, profiting from, and otherwise using the biometric data of its reportedly
`more than 100 million Instagram users, which includes millions of Illinois residents, without any
`written notice or informed written consent.
`
`
`1 https://research.fb.com/publications/deepface-closing-the-gap-to-human-level-performance-in-face-
`verification/
`2 https://slate.com/technology/2019/07/facebook-facial-recognition-ice-bad.html
`2
`CONSOLIDATED CLASS ACTION COMPLAINT
`
`
`
`1
`2
`3
`4
`5
`6
`7
`8
`9
`10
`11
`12
`13
`14
`15
`16
`17
`18
`19
`20
`21
`22
`23
`24
`25
`26
`27
`28
`
`
`
`
`Case 4:20-cv-06361-JST Document 37 Filed 01/26/21 Page 3 of 27
`
`
`
`
`Facebook has readily admitted to its collection of biometrics from users. As explained
`7.
`by Facebook, its use of face recognition technology includes analyzing uploaded photos and videos it
`thinks a user may appear in on Facebook, such as a user’s profile picture, as well as photos and videos
`that he/she has been tagged in, and then creates a unique number for that user, called a template.3
`Its facial recognition software works by scanning faces of unnamed people in photos
`8.
`and videos to analyze details of individuals’ faces, checking whether they match with those for whom
`Facebook has already created templates. While Facebook claims that users are in charge of that
`process, in reality, people cannot actually control the technology because Facebook scans their faces
`in photos and videos uploaded by other users even if their individual facial recognition setting is
`turned off.4
`Facebook claims it uses an individual’s template to find photos and videos a user
`9.
`appears in, to suggest tags, and to provide more relevant content and feature recommendations.5
`Facebook also surreptitiously captures its Instagram users’ protected biometrics without their
`informed consent and, worse yet, without actually informing users of its practice. Upon information
`and belief, once Facebook captures its Instagram users’ protected biometrics, it associates this data
`with an existing Facebook template and/or includes this data in its dataset of biometrics that it uses to
`power, train, and develop its facial recognition software. Moreover, it then uses this biometric data
`for its own business and financial gain, including, but not limited to, bolstering its facial recognition
`abilities across all of its products, including the Facebook application and sharing this information
`among various entities. Facebook does all of this without providing any of the required notices or
`disclosures required by Illinois’ BIPA.
`Plaintiffs bring this action individually and on behalf of a proposed class in order to
`10.
`stop Facebook’s violations of the BIPA, and to recover statutory damages for Facebook’s
`unauthorized collection, storage, disclosure, profiting from, and use of their biometric data in violation
`of the BIPA.
`
`
`3 https://www.facebook.com/help/122175507864081
`4 https://www.nytimes.com/2018/07/09/technology/facebook-facial-recognition-privacy.html
`5 https://www.facebook.com/help/122175507864081
`3
`CONSOLIDATED CLASS ACTION COMPLAINT
`
`
`
`1
`2
`3
`4
`5
`6
`7
`8
`9
`10
`11
`12
`13
`14
`15
`16
`17
`18
`19
`20
`21
`22
`23
`24
`25
`26
`27
`28
`
`
`
`
`Case 4:20-cv-06361-JST Document 37 Filed 01/26/21 Page 4 of 27
`
`
`
`II.
`
`PARTIES
`Plaintiff Kelly Whalen is, and has been at all relevant times, a resident and citizen of
`11.
`the state of Illinois and a resident of Cook County, Illinois. Ms. Whalen first created an Instagram
`account on November 17, 2011, and has used Instagram regularly since that time.
`During the relevant time period, Ms. Whalen accessed Instagram on both her computer
`12.
`and phone to post photographs, view content posted by other users, and react to that content via
`comments and “likes.” Ms. Whalen frequently tagged herself and others in photographs posted on
`Instagram, and appeared in photographs uploaded by others to Instagram. Ms. Whalen was not aware
`that any facial recognition data or other biometric data was being collected by Facebook through her
`Instagram use.
`Plaintiff S.M., by and through her guardian, Tachah Wade (her mother), is a minor
`13.
`child and a resident and citizen of the state of Illinois and a resident of Kendall County, Illinois. S.M.
`is the owner of an Instagram account, which includes content she has posted.
`During the relevant time period, S.M. accessed Instagram on her phone to post
`14.
`photographs, view content posted by other users, and react to that content via comments and “likes.”
`In addition to photographs of herself that she uploaded to her account, S.M. was frequently tagged in
`photographs uploaded by others to Instagram. S.M. was not aware that any facial recognition data or
`other biometric data was being collected by Facebook through her Instagram use.
`Plaintiff Victoria Edelstein is, and has been at all relevant times, a resident and citizen
`15.
`of the state of Illinois and a resident of Lake County, Illinois. Ms. Edelstein first created an Instagram
`account in 2017 and has used Instagram regularly since that time.
`During the relevant time period, Ms. Edelstein accessed Instagram on both her
`16.
`computer and phone to post photographs, view content posted by other users, and react to that content
`via comments and “likes.” Ms. Edelstein frequently tagged herself and others in photographs posted
`on Instagram, and appeared in photographs uploaded by others to Instagram. Ms. Edelstein was not
`aware that any facial recognition data or other biometric data was being collected by Facebook
`through her Instagram use.
`
`
`
`4
`CONSOLIDATED CLASS ACTION COMPLAINT
`
`1
`2
`3
`4
`5
`6
`7
`8
`9
`10
`11
`12
`13
`14
`15
`16
`17
`18
`19
`20
`21
`22
`23
`24
`25
`26
`27
`28
`
`
`
`
`Case 4:20-cv-06361-JST Document 37 Filed 01/26/21 Page 5 of 27
`
`
`
`
`Defendant Facebook is a Delaware corporation with its headquarters and principal
`17.
`executive offices at 1601 Willow Road, Menlo Park, California 94025. Facebook is a citizen of the
`states of Delaware and California. Facebook is also registered to conduct business in the State of
`Illinois (file number 66267067) and maintains an office in Cook County, Illinois.
`JURISDICTION AND VENUE
`III.
`This Court has jurisdiction pursuant to 28 U.S.C. §1332(d)(2) (the “Class Action
`18.
`Fairness Act”) because sufficient diversity of citizenship exists between the parties in this action, the
`aggregate amount in controversy exceeds $5,000,000, exclusive of interests and costs, and there are
`well in excess of 100 class members. Because it is estimated that the Class will have thousands of
`members and Defendant’s intentional and reckless violations of BIPA are punishable by statutory
`damages of $5,000 per violation, the amount in controversy is well in excess of $5,000,000. This
`Court has supplemental jurisdiction over the state law claims pursuant to 28 U.S.C. §1367.
`The Court has personal jurisdiction over Defendant because it has affirmatively
`19.
`established and maintained sufficient contacts with California in that Defendant is registered to do
`business in this State, is headquartered in this State, and conducts significant business in this State.
`Venue is proper under 28 U.S.C. §1391(b)(1) because Defendant’s principal place of
`20.
`business is in this judicial district.
`SUBSTANTIVE ALLEGATIONS
`IV.
`Biometric Information and the Illinois BIPA
`I.
`A “biometric identifier” (together with “biometric information,”6 “biometrics” or
`21.
`“biometric data") is any personal feature that is unique to an individual, including fingerprints, iris
`scans, DNA, facial features, and voice, among others.
`The Illinois Legislature has found that “[b]iometrics are unlike other unique identifiers
`22.
`that are used to access finances or other sensitive information.” 740 ILCS 14/5(c). “For example,
`social security numbers, when compromised, can be changed. Biometrics, however, are biologically
`
`
`6 The BIPA defines “biometric information” as “any information, regardless of how it is captured,
`converted, stored, or shared, based on an individual’s biometric identifier used to identify an
`individual.” 740 ILCS 14/10. Plaintiffs herein use the terms “biometric information” and “biometric
`identifier” interchangeably.
`
`
`
`5
`CONSOLIDATED CLASS ACTION COMPLAINT
`
`1
`2
`3
`4
`5
`6
`7
`8
`9
`10
`11
`12
`13
`14
`15
`16
`17
`18
`19
`20
`21
`22
`23
`24
`25
`26
`27
`28
`
`
`
`
`Case 4:20-cv-06361-JST Document 37 Filed 01/26/21 Page 6 of 27
`
`
`
`unique to the individual; therefore, once compromised, the individual has no recourse, is at heightened
`risk for identity theft, and is likely to withdraw from biometric-facilitated transactions.” Id.
`In recognition of this legitimate concern over the security of biometric data, the Illinois
`23.
`Legislature enacted the BIPA, which requires, inter alia, that companies in possession of biometric
`data establish and maintain a satisfactory biometric data retention and deletion policy. Section 15 (a)
`of the BIPA requires that “[a] private entity in possession of biometric identifiers or biometric
`information must develop a written policy, made available to the public, establishing a retention
`schedule and guidelines for permanently destroying biometric identifiers and biometric information
`when the initial purpose for collecting or obtaining such identifiers or information has been satisfied
`or within 3 years of the individual's last interaction with the private entity, whichever occurs first.”
`740 ILCS 14/15(a).
`As set forth more fully herein, Facebook has violated Section 15(a) of the BIPA by
`24.
`failing to develop and make available to the public the requisite retention and deletion plan and, upon
`information belief, by failing to destroy such biometrics when the purpose for collecting and obtaining
`the biometrics have been satisfied or within three years of Plaintiffs’ and Class Members’ last use of
`the app.
`Further, BIPA provides that:
`25.
`No private entity may collect, capture, purchase, receive through trade, or otherwise
`obtain a person’s or a customer’s biometric identifier or biometric information,
`unless it first:
`informs the subject or the subject’s legally authorized representative in
`(1)
`writing that a biometric identifier or biometric information is being collected or
`stored;
`
`informs the subject or the subject’s legally authorized representative in
`(2)
`writing of the specific purpose and length of term for which a biometric identifier or
`biometric information is being collected, stored, and used; and
`receives a written release executed by the subject of the biometric
`(3)
`identifier or biometric information or the subject’s legally authorized representative.
`
`740 ILCS 14/15(b).
`
`
`
`6
`CONSOLIDATED CLASS ACTION COMPLAINT
`
`1
`2
`3
`4
`5
`6
`7
`8
`9
`10
`11
`12
`13
`14
`15
`16
`17
`18
`19
`20
`21
`22
`23
`24
`25
`26
`27
`28
`
`
`
`
`Case 4:20-cv-06361-JST Document 37 Filed 01/26/21 Page 7 of 27
`
`
`
`
`As alleged herein, Facebook’s practices of collecting, storing, and using Instagram
`26.
`users’ biometric information without informed written consent violates all three prongs of §15(b) of
`the BIPA.
`Facebook has also violated Section 15(c) of the BIPA by selling, leasing, trading, or
`27.
`otherwise profiting from a person’s biometrics, as set forth more fully below.
`Facebook has likewise violated Sections 15(d)-(e) of the BIPA by disclosing,
`28.
`redisclosing, or otherwise disseminating the biometrics captured from media uploaded to Instagram,
`as set forth more fully below.
`Facebook Collects, Stores, Discloses, Profits from, and Otherwise Uses Plaintiffs
`II.
`and Class Members’ Biometric Data in Violation of the BIPA
`
`Instagram has over one billion users worldwide and millions of users in Illinois alone.
`29.
`Instagram allows its users to create a personal page where users can upload
`30.
`photographs and videos, participate in live video broadcasts, and communicate and interact with other
`Instagram users. Approximately 95 million photos are shared on Instagram each day, with over 40
`billion photos and videos shared on the platform since its inception.
`Facebook has employed its facial recognition technology continuously from the time
`31.
`it was first introduced in 2010, including the time period after its acquisition of Instagram in 2012,
`and continuing to the date of the filing of this Complaint.
`Facebook’s sophisticated facial recognition technology works by collecting and
`32.
`analyzing the facial features of individuals appearing in photographs and videos uploaded to
`Facebook and generating a “biometric signature” or “face template” of each individual’s face that
`appears therein. This facial template is based on each person’s facial geometry and is specific to that
`person. Facebook, upon information and belief, also collects biometric data from Instagram users. It
`scans photos, videos, or other content uploaded to Instagram for biometric data. As Facebook’s
`Instagram and Facebook users continue to manually tag friends, family, and other people they
`recognize in a photograph, Facebook’s software automatically compares those images to the face
`templates and other biometrics in its database. If there is a match, Facebook may identify the user.
`
`
`
`7
`CONSOLIDATED CLASS ACTION COMPLAINT
`
`1
`2
`3
`4
`5
`6
`7
`8
`9
`10
`11
`12
`13
`14
`15
`16
`17
`18
`19
`20
`21
`22
`23
`24
`25
`26
`27
`28
`
`
`
`
`Case 4:20-cv-06361-JST Document 37 Filed 01/26/21 Page 8 of 27
`
`
`
`
`1
`2
`3
`4
`5
`6
`7
`8
`9
`10
`11
`12
`13
`14
`15
`16
`17
`18
`19
`20
`21
`22
`23
`24
`25
`26
`27
`28
`
`
`Facebook is then able to identify the individuals whose biometrics it has captured by
`33.
`cross referencing the biometric data of individuals appearing in Instagram photographs with face
`templates that it has already linked with an identified individual (for instance, the face template
`created for the individual by Facebook or companies with whom Facebook shares captured
`biometrics), and identify the individual when there is a match.
`Prior to January 1, 2020, Facebook has never informed Instagram users that it collects
`34.
`their biometric data. Rather, the Instagram Data Policy merely states that Facebook collects
`information “you and others provide” to the app, in the form of both posted content and anything users
`might see through the camera, and that its systems automatically process the content and
`communications provided by users to analyze context and what is in them (emphasis added).7
`In fact, Facebook actively mislead Instagram users about whether it was collecting
`35.
`facial recognition data. Instagram’s Data Policy states, “If you have it turned on, we use face
`recognition technology to recognize you in photos, videos and camera experiences.”8 However,
`Instagram users have no ability to turn off any facial recognition software within the app. Furthermore,
`the Instagram Data Policy states, “If we introduce face-recognition technology to your Instagram
`experience, we will let you know first, and you will have control over whether we use this technology
`for you.”9 As set forth below, these statements are untrue.
`On January 1, 2020, Facebook published, for the first time, its California Privacy
`36.
`Notice for its California users as a supplement to its current Data Policy in compliance with
`California’s Consumer Privacy Act (CCPA).10 Instagram admits in this notice that any of the
`information disclosed within the California Privacy Notice may have been collected from users over
`the past 12 months. While California is currently the only state requiring these types of disclosures to
`consumers, the content of the notice demonstrates that Facebook has been collecting biometric data
`from its Instagram users for, at minimum, the 2019 calendar year. The California Privacy Notice is
`reproduced in part below (emphasis added):
`
`
`7 See https://help.instagram.com/155833707900388 Section I: What Kinds of Information Do We
`Collect?
`8 See https://help.instagram.com/519522125107875 Section II: How Do We Use This Information?
`9 Id.
`10 See https://help.instagram.com/2482657248648591 “California Privacy Notice”
`8
`CONSOLIDATED CLASS ACTION COMPLAINT
`
`
`
`
`
`Case 4:20-cv-06361-JST Document 37 Filed 01/26/21 Page 9 of 27
`
`Examples of how Personal
`Information is used include:
`
`• Providing, personalizing, and
`improving our Products;
`• Facilitating transactions,
`providing measurement,
`analytics, advertising, and
`other business services;
`• Promoting safety, integrity,
`and security;
`• Communicating with you;
`• Researching and innovating
`for social good; and
`• To perform other business
`purposes.
`
`Parties with whom your
`information may be shared
`include:
`
`• People and accounts you
`share and communicate with;
`• People and accounts with
`which others share or reshare
`content about you;
`• Apps, websites, and third-
`party integrations on or using
`our Products;
`• New owners in the event of a
`change of ownership or
`control of all or part of our
`Products or their assets
`changes;
`• Partners, including partners
`who use our analytics
`services, advertisers,
`measurement partners,
`partners offering goods and
`services in our Products,
`vendors and service
`providers, and researchers
`and academics;
`• Law enforcement or other
`third parties in connection
`with legal requests; and
`• Facebook Companies.
`
`
`
`
`Categories of Personal
`Information we collect may
`include:
`
`• Identifiers;
`• Data with special protections,
`if you choose to provide it;
`• Commercial information, if
`you choose to provide it;
`• Photos and face imagery
`that can be used to create
`face-recognition templates
`if you or others choose to
`provide it and you have the
`setting turned on.
`• Internet or other electronic
`network activity information,
`including content you view or
`engage with;
`• Location-related information,
`including precise device
`location if you choose to
`allow us to collect it;
`• Audio or visual Information,
`including photos and videos,
`if you or others choose to
`provide it;
`• Professional or employment
`information, if you choose to
`provide it;
`• Education information, if you
`choose to provide it;
`• Financial information, if you
`choose to provide it; and
`• Information derived from
`other Personal Information
`about you, which could
`include your preferences,
`interests, and other
`information used to
`personalize your experience.
`
`Although Facebook’s California Privacy Notice indicates that it collects Instagram
`37.
`users’ protected biometrics “if you or others choose to provide it and you have the setting turned on,”
`
`
`
`9
`CONSOLIDATED CLASS ACTION COMPLAINT
`
`1
`2
`3
`4
`5
`6
`7
`8
`9
`10
`11
`12
`13
`14
`15
`16
`17
`18
`19
`20
`21
`22
`23
`24
`25
`26
`27
`28
`
`
`
`
`Case 4:20-cv-06361-JST Document 37 Filed 01/26/21 Page 10 of 27
`
`
`
`Facebook’s belated, after-the-fact notice to Instagram users cannot constitute compliance with the
`BIPA for a variety of reasons, including that Facebook only allowed Plaintiffs and Class Members to
`opt out after it collected their protected biometrics, and even then, only if Plaintiffs and Class
`Members knew to look for the opt-out option, which, upon information and belief, is not even possible
`through a user’s Instagram account.11
`In any event, Instagram users cannot opt out. Indeed, Instagram users are not even
`38.
`given an opportunity to provide a written release because Facebook automatically processes content
`and shares it across its platforms. Rochelle Nadhiri, a Facebook spokeswoman, said its system
`analyzes faces in users’ photos to check whether they match with those who have their facial
`recognition setting turned on. This means that users can never really “opt out” of Facebook’s use of
`facial recognition. So even if a user does not have facial recognition activated within their personal
`account, their photo may still be scanned, collected, and entered into Facebook’s database if it matches
`with a user’s data who does have the facial recognition setting activated.12 This also means that one
`can never truly “opt out” because Facebook must capture and compare the biometrics of a face before
`learning if that face, in fact, matches with faces of users who have their facial recognition setting
`turned on or off.
`Further, Facebook concedes that it collects information such as the location of a photo,
`39.
`Instagram users’ current location, where they live, the places they go, and the businesses and people
`they are near to “provide, personalize and improve our Products.” As such, Facebook knows, or
`should know, that Plaintiffs and Class Members are Illinois users.13
` Moreover, upon information and belief, Facebook disclosed Instagram users’
`40.
`biometric data not only to teams operating across its own various platforms, but also with third parties.
`Facebook concedes that biometrics harvested from Instagram’s photographs and videos may be shared
`with other apps, websites, and third-party integrations, Facebook’s partners, including partners who
`use Facebook’s analytics services, advertisers, measurement partners, partners offering goods and
`
`
`11 See https://help.instagram.com/519522125107875, directing Instagram users to “opt out” via settings
`on their Facebook profile.
`12 See https://www.nytimes.com/2018/07/09/technology/facebook-facial-recognition-privacy.html
`13 See https://help.instagram.com/155833707900388
`10
`CONSOLIDATED CLASS ACTION COMPLAINT
`
`
`
`1
`2
`3
`4
`5
`6
`7
`8
`9
`10
`11
`12
`13
`14
`15
`16
`17
`18
`19
`20
`21
`22
`23
`24
`25
`26
`27
`28
`
`
`
`
`Case 4:20-cv-06361-JST Document 37 Filed 01/26/21 Page 11 of 27
`
`
`
`services within Facebook’s products, vendors and service providers, researchers and academics, law
`enforcement, and Facebook Companies, including Facebook Payments Inc., Onavo, Facebook
`Technologies, LLC, Facebook Technologies Ireland Limited, WhatsApp Inc., WhatsApp Ireland
`Limited, and CrowdTangle (collectively, “Facebook Companies”).14
`Facebook and Instagram share infrastructure, systems, and technology with other
`41.
`Facebook Companies and process information about the user across the Facebook Companies.15 This
`includes, upon information and belief, using Facebook’s facial recognition technology to process
`biometrics collected from Instagram users, which are then used to enhance already-existing facial
`templates of those users.
`For example, Facebook is currently the subject of antitrust litigation in Germany,
`42.
`where it is alleged to have broken competition laws by combining personal data collected about users
`across its different platforms, including Instagram, to create “super profiles” for users.16 A ruling
`from German regulators prohibited Facebook from combining Facebook user account data with user
`data on company services like WhatsApp and Instagram.17
`Upon information and belief, Facebook’s shared infrastructure, systems, and
`43.
`technology and processing of user information across the Facebook Companies includes using the
`biometrics harvested from its Instagram users’ uploaded material to improve the algorithms that power
`its facial recognition abilities across all of its platforms, including, but not limited to, its Facebook
`application where, for example, Facebook uses its facial recognition to suggest tags to Facebook users
`and lets Facebook users know when their photos are uploaded by someone else.18
`Upon information and belief, Facebook also includes the biometrics captured from
`44.
`Instagram users’ uploaded material, as well as Instagram users’ tagging information, to bolster its
`databases of biometrics, face templates, and tagging information that enables Facebook’s facial
`recognition to continue learning and improving, which, in turn, enhances all of Facebook’s facial
`
`
`14 See https://help.instagram.com/2482657248648591
`15 See https://help.instagram.com/155833707900388 Section IV: How Do the Facebook Companies
`Work Together?
`16 See https://www.nytimes.com/2020/06/23/technology/facebook-antitrust-germany.html
`17 See https://www.nytimes.com/2019/02/07/technology/germany-facebook-data.html
`18 See https://www.facebook.com/help/122175507864081 What is the face recognition setting on
`Facebook and how does it work?
`
`
`
`11
`CONSOLIDATED CLASS ACTION COMPLAINT
`
`1
`2
`3
`4
`5
`6
`7
`8
`9
`10
`11
`12
`13
`14
`15
`16
`17
`18
`19
`20
`21
`22
`23
`24
`25
`26
`27
`28
`
`
`
`
`Case 4:20-cv-06361-JST Document 37 Filed 01/26/21 Page 12 of 27
`
`
`
`recognition products, including, for example, its predictive tagging feature on the Facebook
`application.19 Several of Facebook’s products, such as Moments, an application Facebook introduced
`in 2015, capitalizes on Facebook’s facial recognition technology.20
`Several of Facebook’s prior patent filings further attest to Facebook’s commercial
`45.
`purposes in developing its facial recognition technologies. These patents reportedly described one
`system that could detect consumers within stores and match those shoppers’ faces with their social
`networking profiles, and another in which cameras near checkout counters could capture shoppers’
`faces and match them with their social networking profiles.21
`As such, Facebook profits from its use of its Instagram users’ protected biometrics by
`46.
`using them to improve the accuracy of its own facial recognition services, to expand the datasets
`which enable its facial recognition software, and to cement its market-leading position in facial
`recognition and social media.
`Accordingly, Facebook and Instagram have collected, captured, or otherwise obtained
`47.
`Instagram users’ biometric identifiers or biometric information, as those terms are defined in Section
`10 of BIPA, from content that Instagram users uploaded to Instagram.
`Facebook and Instagram are in possession of Instagram users’ biometric identifiers or
`48.
`biometric information from content that Instagram users uploaded to Instagram.
`Facebook and Instagram scan photographs, videos, or other content uploaded to
`49.
`Instagram for biometric identifiers or biometric information.
`In direct contravention of Section 15(a) of the BIPA, Facebook has failed to develop
`50.
`and make available to the public its requisite retention and deletion plan and, upon information belief,
`by has failed to destroy such biometrics when the purpose for collecting and obtaining the biometrics
`have been satisfied or within three years of Plaintiffs’ and Class Members’ last use of the app.
`
`
`19 See https://www.npr.org/sections/alltechconsidered/2016/05/18/477819617/facebooks-facial-reco
`gnition-software-is-different-from-the-fbis-heres-why#:~:text=Facebook-,Facebook's%20Moments
`%20app%20uses%20facial%20recognition%20technology%20to%20group%20photos,friends%20w
`ho%20are%20in%20them.&text=When%20someone%20tags%20you%20in,reminder%20of%20a%
`20shared%20memory. (describing the benefit to facial recognition algorithms of additional photographs
`and tagging information).
`20 See https://techcrunch.com/2015/06/15/facial-recogbook/
`21 See https://www.nytimes.com/2018/07/09/technology/facebook-facial-recognition-privacy.html
`12
`CONSOLIDATED CLASS ACTION COMPLAINT
`
`
`
`1
`2
`3
`4
`5
`6
`7
`8
`9
`10
`11
`12
`13
`14
`15
`16
`17
`18
`19
`20
`21
`22
`23
`24
`25
`26
`27
`28
`
`
`
`
`Case 4:20-cv-06361-JST Document 37 Filed 01/26/21 Page 13 of 27
`
`
`
`
`1
`2
`3
`4
`5
`6
`7
`8
`9
`10
`11
`12
`13
`14
`15
`16
`17
`18
`19
`20
`21
`22
`23
`24
`25
`26
`27
`28
`
`
`In direct contravention of §15(b) of the BIPA, Facebook collected Plaintiffs’ and Class
`51.
`Members’ biometrics without informing them that it would collect, store, and use their biometric
`facial data, without informing Instagram users of the specific purpose and length of term for which
`their biometric data would be collected, stored, and used, and without receiving a written release from
`Instagram users before it began to collect, store, disclose, profit from, and otherwise use their
`biometric data.
`In direct contravention of §15(c) of the BIPA, Facebook profited from Plaintiffs’ and
`52.
`Class Members’ protected biometrics.
`In direct contravention of §15(d)-(e) of the BIPA, Facebook voluntarily disclosed and
`53.
`otherwise disseminated Plaintiffs’ and Class Members’ protected biometrics.
`Plaintiffs and Class Members’ Injuries and Damages
`III.
`54.
`As alleged herein, as a result of Facebook’s unlawful conduct, Plaintiffs and Class
`Members have already sustained injuries and face many more imminent and certainly impending
`injuries, which they will continue to suffer.
`Facebook’s unlawful conduct has resulted in, among other injuries: (a) Plaintiffs’ and
`55.
`Class Members’ unique biometric identifiers and information being collected, captured, obtained,
`disc