throbber
Case 4:20-cv-06361-JST Document 37 Filed 01/26/21 Page 1 of 27
`
`
`
`CARLSON LYNCH, LLP
`TODD D. CARPENTER (234464)
`1350 Columbia Street, Suite 603
`San Diego, CA 92101
`Tel:
`619-762-1910
`Fax: 619-756-6991
`tcarpenter@carlsonlynch.com
`Attorneys for Plaintiffs and the Proposed Class
`[Additional counsel listed on signature page.]
`
`
`
`UNITED STATES DISTRICT COURT
`NORTHERN DISTRICT OF CALIFORNIA
`OAKLAND DIVISION
`Case No. 4:20-cv-06361-JST
`KELLY WHALEN, S.M., a Minor, By and
`Through Her Guardian, Tachah Wade, and
`CONSOLIDATED CLASS ACTION
`VICTORIA EDELSTEIN, Individually and on
`COMPLAINT
`Behalf of All Others Similarly Situated,
`DEMAND FOR JURY TRIAL
`Plaintiffs,
`
`v.
`FACEBOOK, INC.,
`Defendant.
`
`Plaintiffs Kelly Whalen, S.M., a minor, by and through her guardian Tachah Wade, and
`Victoria Edelstein, individually and on behalf of all others similarly situated, through undersigned
`counsel, bring this Consolidated Class Action Complaint for Violations of the Illinois Biometric
`Information Privacy Act (“BIPA”), 740 ILCS 14/1, et seq., against Defendant Facebook, Inc.
`(“Facebook” or “Defendant”), and allege the following upon information and belief, except as to the
`allegations within Plaintiffs’ personal knowledge. Plaintiffs believe that substantial additional
`evidentiary support will exist for the allegations set forth herein after a reasonable opportunity for
`discovery.
`SUMMARY OF THE ACTION
`I.
`Facebook, Inc. is a social media conglomerate founded in 2004. It owns its eponymous
`1.
`social networking platform in addition to a host of subsidiaries.
`
`
`
`1
`CONSOLIDATED CLASS ACTION COMPLAINT
`
`1
`2
`3
`4
`5
`6
`7
`8
`9
`10
`11
`12
`13
`14
`15
`16
`17
`18
`19
`20
`21
`22
`23
`24
`25
`26
`27
`28
`
`
`

`

`Case 4:20-cv-06361-JST Document 37 Filed 01/26/21 Page 2 of 27
`
`
`
`
`Instagram is a photo and video-sharing social networking service that is owned by
`2.
`Facebook, Inc. It was initially released as an application for the iOS mobile operating system in 2010
`before being acquired by Facebook in 2012. Since its acquisition by Facebook, Instagram has steadily
`amassed new users worldwide. In 2019, there were more than approximately 118 million users in the
`United States alone.
`Facebook’s social media platform offers a multi-faceted approach for users to connect
`3.
`with one another. In addition to sharing photos and videos, Facebook is a social networking service,
`which allows users to share news articles, create special interest groups, shop, and more. Instagram,
`on the other hand, is more limited in its scope of use. Its primary features are photo and video sharing,
`direct messaging, and “stories,” which are photos and/or videos that disappear from a user’s profile
`after 24 hours.
`Facebook holds the largest facial dataset to date, powered by DeepFace, Facebook’s
`4.
`deep-learning facial recognition system, which collects information about face geometry.1 Based on
`testing, the DeepFace facial recognition system closely approaches human-level accuracy in
`identifying faces. Unless a user opts out, Facebook scans photos uploaded to the social network in
`search of faces it recognizes using its DeepFace technology.2
`Earlier this year, Facebook agreed to pay $650 million to settle a class action that
`5.
`accuses the company of illegally harvesting the protected biometrics of users of its Facebook platform.
`As part of the settlement, Facebook agreed to delete face templates of users that it had created and
`stored.
`As set forth below, Facebook also illegally harvests the protected biometrics of users
`6.
`of its Instagram application. In direct violation of Sections 15(b)-(e) of the BIPA, Facebook is actively
`collecting, storing, disclosing, profiting from, and otherwise using the biometric data of its reportedly
`more than 100 million Instagram users, which includes millions of Illinois residents, without any
`written notice or informed written consent.
`
`
`1 https://research.fb.com/publications/deepface-closing-the-gap-to-human-level-performance-in-face-
`verification/
`2 https://slate.com/technology/2019/07/facebook-facial-recognition-ice-bad.html
`2
`CONSOLIDATED CLASS ACTION COMPLAINT
`
`
`
`1
`2
`3
`4
`5
`6
`7
`8
`9
`10
`11
`12
`13
`14
`15
`16
`17
`18
`19
`20
`21
`22
`23
`24
`25
`26
`27
`28
`
`
`

`

`Case 4:20-cv-06361-JST Document 37 Filed 01/26/21 Page 3 of 27
`
`
`
`
`Facebook has readily admitted to its collection of biometrics from users. As explained
`7.
`by Facebook, its use of face recognition technology includes analyzing uploaded photos and videos it
`thinks a user may appear in on Facebook, such as a user’s profile picture, as well as photos and videos
`that he/she has been tagged in, and then creates a unique number for that user, called a template.3
`Its facial recognition software works by scanning faces of unnamed people in photos
`8.
`and videos to analyze details of individuals’ faces, checking whether they match with those for whom
`Facebook has already created templates. While Facebook claims that users are in charge of that
`process, in reality, people cannot actually control the technology because Facebook scans their faces
`in photos and videos uploaded by other users even if their individual facial recognition setting is
`turned off.4
`Facebook claims it uses an individual’s template to find photos and videos a user
`9.
`appears in, to suggest tags, and to provide more relevant content and feature recommendations.5
`Facebook also surreptitiously captures its Instagram users’ protected biometrics without their
`informed consent and, worse yet, without actually informing users of its practice. Upon information
`and belief, once Facebook captures its Instagram users’ protected biometrics, it associates this data
`with an existing Facebook template and/or includes this data in its dataset of biometrics that it uses to
`power, train, and develop its facial recognition software. Moreover, it then uses this biometric data
`for its own business and financial gain, including, but not limited to, bolstering its facial recognition
`abilities across all of its products, including the Facebook application and sharing this information
`among various entities. Facebook does all of this without providing any of the required notices or
`disclosures required by Illinois’ BIPA.
`Plaintiffs bring this action individually and on behalf of a proposed class in order to
`10.
`stop Facebook’s violations of the BIPA, and to recover statutory damages for Facebook’s
`unauthorized collection, storage, disclosure, profiting from, and use of their biometric data in violation
`of the BIPA.
`
`
`3 https://www.facebook.com/help/122175507864081
`4 https://www.nytimes.com/2018/07/09/technology/facebook-facial-recognition-privacy.html
`5 https://www.facebook.com/help/122175507864081
`3
`CONSOLIDATED CLASS ACTION COMPLAINT
`
`
`
`1
`2
`3
`4
`5
`6
`7
`8
`9
`10
`11
`12
`13
`14
`15
`16
`17
`18
`19
`20
`21
`22
`23
`24
`25
`26
`27
`28
`
`
`

`

`Case 4:20-cv-06361-JST Document 37 Filed 01/26/21 Page 4 of 27
`
`
`
`II.
`
`PARTIES
`Plaintiff Kelly Whalen is, and has been at all relevant times, a resident and citizen of
`11.
`the state of Illinois and a resident of Cook County, Illinois. Ms. Whalen first created an Instagram
`account on November 17, 2011, and has used Instagram regularly since that time.
`During the relevant time period, Ms. Whalen accessed Instagram on both her computer
`12.
`and phone to post photographs, view content posted by other users, and react to that content via
`comments and “likes.” Ms. Whalen frequently tagged herself and others in photographs posted on
`Instagram, and appeared in photographs uploaded by others to Instagram. Ms. Whalen was not aware
`that any facial recognition data or other biometric data was being collected by Facebook through her
`Instagram use.
`Plaintiff S.M., by and through her guardian, Tachah Wade (her mother), is a minor
`13.
`child and a resident and citizen of the state of Illinois and a resident of Kendall County, Illinois. S.M.
`is the owner of an Instagram account, which includes content she has posted.
`During the relevant time period, S.M. accessed Instagram on her phone to post
`14.
`photographs, view content posted by other users, and react to that content via comments and “likes.”
`In addition to photographs of herself that she uploaded to her account, S.M. was frequently tagged in
`photographs uploaded by others to Instagram. S.M. was not aware that any facial recognition data or
`other biometric data was being collected by Facebook through her Instagram use.
`Plaintiff Victoria Edelstein is, and has been at all relevant times, a resident and citizen
`15.
`of the state of Illinois and a resident of Lake County, Illinois. Ms. Edelstein first created an Instagram
`account in 2017 and has used Instagram regularly since that time.
`During the relevant time period, Ms. Edelstein accessed Instagram on both her
`16.
`computer and phone to post photographs, view content posted by other users, and react to that content
`via comments and “likes.” Ms. Edelstein frequently tagged herself and others in photographs posted
`on Instagram, and appeared in photographs uploaded by others to Instagram. Ms. Edelstein was not
`aware that any facial recognition data or other biometric data was being collected by Facebook
`through her Instagram use.
`
`
`
`4
`CONSOLIDATED CLASS ACTION COMPLAINT
`
`1
`2
`3
`4
`5
`6
`7
`8
`9
`10
`11
`12
`13
`14
`15
`16
`17
`18
`19
`20
`21
`22
`23
`24
`25
`26
`27
`28
`
`
`

`

`Case 4:20-cv-06361-JST Document 37 Filed 01/26/21 Page 5 of 27
`
`
`
`
`Defendant Facebook is a Delaware corporation with its headquarters and principal
`17.
`executive offices at 1601 Willow Road, Menlo Park, California 94025. Facebook is a citizen of the
`states of Delaware and California. Facebook is also registered to conduct business in the State of
`Illinois (file number 66267067) and maintains an office in Cook County, Illinois.
`JURISDICTION AND VENUE
`III.
`This Court has jurisdiction pursuant to 28 U.S.C. §1332(d)(2) (the “Class Action
`18.
`Fairness Act”) because sufficient diversity of citizenship exists between the parties in this action, the
`aggregate amount in controversy exceeds $5,000,000, exclusive of interests and costs, and there are
`well in excess of 100 class members. Because it is estimated that the Class will have thousands of
`members and Defendant’s intentional and reckless violations of BIPA are punishable by statutory
`damages of $5,000 per violation, the amount in controversy is well in excess of $5,000,000. This
`Court has supplemental jurisdiction over the state law claims pursuant to 28 U.S.C. §1367.
`The Court has personal jurisdiction over Defendant because it has affirmatively
`19.
`established and maintained sufficient contacts with California in that Defendant is registered to do
`business in this State, is headquartered in this State, and conducts significant business in this State.
`Venue is proper under 28 U.S.C. §1391(b)(1) because Defendant’s principal place of
`20.
`business is in this judicial district.
`SUBSTANTIVE ALLEGATIONS
`IV.
`Biometric Information and the Illinois BIPA
`I.
`A “biometric identifier” (together with “biometric information,”6 “biometrics” or
`21.
`“biometric data") is any personal feature that is unique to an individual, including fingerprints, iris
`scans, DNA, facial features, and voice, among others.
`The Illinois Legislature has found that “[b]iometrics are unlike other unique identifiers
`22.
`that are used to access finances or other sensitive information.” 740 ILCS 14/5(c). “For example,
`social security numbers, when compromised, can be changed. Biometrics, however, are biologically
`
`
`6 The BIPA defines “biometric information” as “any information, regardless of how it is captured,
`converted, stored, or shared, based on an individual’s biometric identifier used to identify an
`individual.” 740 ILCS 14/10. Plaintiffs herein use the terms “biometric information” and “biometric
`identifier” interchangeably.
`
`
`
`5
`CONSOLIDATED CLASS ACTION COMPLAINT
`
`1
`2
`3
`4
`5
`6
`7
`8
`9
`10
`11
`12
`13
`14
`15
`16
`17
`18
`19
`20
`21
`22
`23
`24
`25
`26
`27
`28
`
`
`

`

`Case 4:20-cv-06361-JST Document 37 Filed 01/26/21 Page 6 of 27
`
`
`
`unique to the individual; therefore, once compromised, the individual has no recourse, is at heightened
`risk for identity theft, and is likely to withdraw from biometric-facilitated transactions.” Id.
`In recognition of this legitimate concern over the security of biometric data, the Illinois
`23.
`Legislature enacted the BIPA, which requires, inter alia, that companies in possession of biometric
`data establish and maintain a satisfactory biometric data retention and deletion policy. Section 15 (a)
`of the BIPA requires that “[a] private entity in possession of biometric identifiers or biometric
`information must develop a written policy, made available to the public, establishing a retention
`schedule and guidelines for permanently destroying biometric identifiers and biometric information
`when the initial purpose for collecting or obtaining such identifiers or information has been satisfied
`or within 3 years of the individual's last interaction with the private entity, whichever occurs first.”
`740 ILCS 14/15(a).
`As set forth more fully herein, Facebook has violated Section 15(a) of the BIPA by
`24.
`failing to develop and make available to the public the requisite retention and deletion plan and, upon
`information belief, by failing to destroy such biometrics when the purpose for collecting and obtaining
`the biometrics have been satisfied or within three years of Plaintiffs’ and Class Members’ last use of
`the app.
`Further, BIPA provides that:
`25.
`No private entity may collect, capture, purchase, receive through trade, or otherwise
`obtain a person’s or a customer’s biometric identifier or biometric information,
`unless it first:
`informs the subject or the subject’s legally authorized representative in
`(1)
`writing that a biometric identifier or biometric information is being collected or
`stored;
`
`informs the subject or the subject’s legally authorized representative in
`(2)
`writing of the specific purpose and length of term for which a biometric identifier or
`biometric information is being collected, stored, and used; and
`receives a written release executed by the subject of the biometric
`(3)
`identifier or biometric information or the subject’s legally authorized representative.
`
`740 ILCS 14/15(b).
`
`
`
`6
`CONSOLIDATED CLASS ACTION COMPLAINT
`
`1
`2
`3
`4
`5
`6
`7
`8
`9
`10
`11
`12
`13
`14
`15
`16
`17
`18
`19
`20
`21
`22
`23
`24
`25
`26
`27
`28
`
`
`

`

`Case 4:20-cv-06361-JST Document 37 Filed 01/26/21 Page 7 of 27
`
`
`
`
`As alleged herein, Facebook’s practices of collecting, storing, and using Instagram
`26.
`users’ biometric information without informed written consent violates all three prongs of §15(b) of
`the BIPA.
`Facebook has also violated Section 15(c) of the BIPA by selling, leasing, trading, or
`27.
`otherwise profiting from a person’s biometrics, as set forth more fully below.
`Facebook has likewise violated Sections 15(d)-(e) of the BIPA by disclosing,
`28.
`redisclosing, or otherwise disseminating the biometrics captured from media uploaded to Instagram,
`as set forth more fully below.
`Facebook Collects, Stores, Discloses, Profits from, and Otherwise Uses Plaintiffs
`II.
`and Class Members’ Biometric Data in Violation of the BIPA
`
`Instagram has over one billion users worldwide and millions of users in Illinois alone.
`29.
`Instagram allows its users to create a personal page where users can upload
`30.
`photographs and videos, participate in live video broadcasts, and communicate and interact with other
`Instagram users. Approximately 95 million photos are shared on Instagram each day, with over 40
`billion photos and videos shared on the platform since its inception.
`Facebook has employed its facial recognition technology continuously from the time
`31.
`it was first introduced in 2010, including the time period after its acquisition of Instagram in 2012,
`and continuing to the date of the filing of this Complaint.
`Facebook’s sophisticated facial recognition technology works by collecting and
`32.
`analyzing the facial features of individuals appearing in photographs and videos uploaded to
`Facebook and generating a “biometric signature” or “face template” of each individual’s face that
`appears therein. This facial template is based on each person’s facial geometry and is specific to that
`person. Facebook, upon information and belief, also collects biometric data from Instagram users. It
`scans photos, videos, or other content uploaded to Instagram for biometric data. As Facebook’s
`Instagram and Facebook users continue to manually tag friends, family, and other people they
`recognize in a photograph, Facebook’s software automatically compares those images to the face
`templates and other biometrics in its database. If there is a match, Facebook may identify the user.
`
`
`
`7
`CONSOLIDATED CLASS ACTION COMPLAINT
`
`1
`2
`3
`4
`5
`6
`7
`8
`9
`10
`11
`12
`13
`14
`15
`16
`17
`18
`19
`20
`21
`22
`23
`24
`25
`26
`27
`28
`
`
`

`

`Case 4:20-cv-06361-JST Document 37 Filed 01/26/21 Page 8 of 27
`
`
`
`
`1
`2
`3
`4
`5
`6
`7
`8
`9
`10
`11
`12
`13
`14
`15
`16
`17
`18
`19
`20
`21
`22
`23
`24
`25
`26
`27
`28
`
`
`Facebook is then able to identify the individuals whose biometrics it has captured by
`33.
`cross referencing the biometric data of individuals appearing in Instagram photographs with face
`templates that it has already linked with an identified individual (for instance, the face template
`created for the individual by Facebook or companies with whom Facebook shares captured
`biometrics), and identify the individual when there is a match.
`Prior to January 1, 2020, Facebook has never informed Instagram users that it collects
`34.
`their biometric data. Rather, the Instagram Data Policy merely states that Facebook collects
`information “you and others provide” to the app, in the form of both posted content and anything users
`might see through the camera, and that its systems automatically process the content and
`communications provided by users to analyze context and what is in them (emphasis added).7
`In fact, Facebook actively mislead Instagram users about whether it was collecting
`35.
`facial recognition data. Instagram’s Data Policy states, “If you have it turned on, we use face
`recognition technology to recognize you in photos, videos and camera experiences.”8 However,
`Instagram users have no ability to turn off any facial recognition software within the app. Furthermore,
`the Instagram Data Policy states, “If we introduce face-recognition technology to your Instagram
`experience, we will let you know first, and you will have control over whether we use this technology
`for you.”9 As set forth below, these statements are untrue.
`On January 1, 2020, Facebook published, for the first time, its California Privacy
`36.
`Notice for its California users as a supplement to its current Data Policy in compliance with
`California’s Consumer Privacy Act (CCPA).10 Instagram admits in this notice that any of the
`information disclosed within the California Privacy Notice may have been collected from users over
`the past 12 months. While California is currently the only state requiring these types of disclosures to
`consumers, the content of the notice demonstrates that Facebook has been collecting biometric data
`from its Instagram users for, at minimum, the 2019 calendar year. The California Privacy Notice is
`reproduced in part below (emphasis added):
`
`
`7 See https://help.instagram.com/155833707900388 Section I: What Kinds of Information Do We
`Collect?
`8 See https://help.instagram.com/519522125107875 Section II: How Do We Use This Information?
`9 Id.
`10 See https://help.instagram.com/2482657248648591 “California Privacy Notice”
`8
`CONSOLIDATED CLASS ACTION COMPLAINT
`
`
`
`

`

`Case 4:20-cv-06361-JST Document 37 Filed 01/26/21 Page 9 of 27
`
`Examples of how Personal
`Information is used include:
`
`• Providing, personalizing, and
`improving our Products;
`• Facilitating transactions,
`providing measurement,
`analytics, advertising, and
`other business services;
`• Promoting safety, integrity,
`and security;
`• Communicating with you;
`• Researching and innovating
`for social good; and
`• To perform other business
`purposes.
`
`Parties with whom your
`information may be shared
`include:
`
`• People and accounts you
`share and communicate with;
`• People and accounts with
`which others share or reshare
`content about you;
`• Apps, websites, and third-
`party integrations on or using
`our Products;
`• New owners in the event of a
`change of ownership or
`control of all or part of our
`Products or their assets
`changes;
`• Partners, including partners
`who use our analytics
`services, advertisers,
`measurement partners,
`partners offering goods and
`services in our Products,
`vendors and service
`providers, and researchers
`and academics;
`• Law enforcement or other
`third parties in connection
`with legal requests; and
`• Facebook Companies.
`
`
`
`
`Categories of Personal
`Information we collect may
`include:
`
`• Identifiers;
`• Data with special protections,
`if you choose to provide it;
`• Commercial information, if
`you choose to provide it;
`• Photos and face imagery
`that can be used to create
`face-recognition templates
`if you or others choose to
`provide it and you have the
`setting turned on.
`• Internet or other electronic
`network activity information,
`including content you view or
`engage with;
`• Location-related information,
`including precise device
`location if you choose to
`allow us to collect it;
`• Audio or visual Information,
`including photos and videos,
`if you or others choose to
`provide it;
`• Professional or employment
`information, if you choose to
`provide it;
`• Education information, if you
`choose to provide it;
`• Financial information, if you
`choose to provide it; and
`• Information derived from
`other Personal Information
`about you, which could
`include your preferences,
`interests, and other
`information used to
`personalize your experience.
`
`Although Facebook’s California Privacy Notice indicates that it collects Instagram
`37.
`users’ protected biometrics “if you or others choose to provide it and you have the setting turned on,”
`
`
`
`9
`CONSOLIDATED CLASS ACTION COMPLAINT
`
`1
`2
`3
`4
`5
`6
`7
`8
`9
`10
`11
`12
`13
`14
`15
`16
`17
`18
`19
`20
`21
`22
`23
`24
`25
`26
`27
`28
`
`
`

`

`Case 4:20-cv-06361-JST Document 37 Filed 01/26/21 Page 10 of 27
`
`
`
`Facebook’s belated, after-the-fact notice to Instagram users cannot constitute compliance with the
`BIPA for a variety of reasons, including that Facebook only allowed Plaintiffs and Class Members to
`opt out after it collected their protected biometrics, and even then, only if Plaintiffs and Class
`Members knew to look for the opt-out option, which, upon information and belief, is not even possible
`through a user’s Instagram account.11
`In any event, Instagram users cannot opt out. Indeed, Instagram users are not even
`38.
`given an opportunity to provide a written release because Facebook automatically processes content
`and shares it across its platforms. Rochelle Nadhiri, a Facebook spokeswoman, said its system
`analyzes faces in users’ photos to check whether they match with those who have their facial
`recognition setting turned on. This means that users can never really “opt out” of Facebook’s use of
`facial recognition. So even if a user does not have facial recognition activated within their personal
`account, their photo may still be scanned, collected, and entered into Facebook’s database if it matches
`with a user’s data who does have the facial recognition setting activated.12 This also means that one
`can never truly “opt out” because Facebook must capture and compare the biometrics of a face before
`learning if that face, in fact, matches with faces of users who have their facial recognition setting
`turned on or off.
`Further, Facebook concedes that it collects information such as the location of a photo,
`39.
`Instagram users’ current location, where they live, the places they go, and the businesses and people
`they are near to “provide, personalize and improve our Products.” As such, Facebook knows, or
`should know, that Plaintiffs and Class Members are Illinois users.13
` Moreover, upon information and belief, Facebook disclosed Instagram users’
`40.
`biometric data not only to teams operating across its own various platforms, but also with third parties.
`Facebook concedes that biometrics harvested from Instagram’s photographs and videos may be shared
`with other apps, websites, and third-party integrations, Facebook’s partners, including partners who
`use Facebook’s analytics services, advertisers, measurement partners, partners offering goods and
`
`
`11 See https://help.instagram.com/519522125107875, directing Instagram users to “opt out” via settings
`on their Facebook profile.
`12 See https://www.nytimes.com/2018/07/09/technology/facebook-facial-recognition-privacy.html
`13 See https://help.instagram.com/155833707900388
`10
`CONSOLIDATED CLASS ACTION COMPLAINT
`
`
`
`1
`2
`3
`4
`5
`6
`7
`8
`9
`10
`11
`12
`13
`14
`15
`16
`17
`18
`19
`20
`21
`22
`23
`24
`25
`26
`27
`28
`
`
`

`

`Case 4:20-cv-06361-JST Document 37 Filed 01/26/21 Page 11 of 27
`
`
`
`services within Facebook’s products, vendors and service providers, researchers and academics, law
`enforcement, and Facebook Companies, including Facebook Payments Inc., Onavo, Facebook
`Technologies, LLC, Facebook Technologies Ireland Limited, WhatsApp Inc., WhatsApp Ireland
`Limited, and CrowdTangle (collectively, “Facebook Companies”).14
`Facebook and Instagram share infrastructure, systems, and technology with other
`41.
`Facebook Companies and process information about the user across the Facebook Companies.15 This
`includes, upon information and belief, using Facebook’s facial recognition technology to process
`biometrics collected from Instagram users, which are then used to enhance already-existing facial
`templates of those users.
`For example, Facebook is currently the subject of antitrust litigation in Germany,
`42.
`where it is alleged to have broken competition laws by combining personal data collected about users
`across its different platforms, including Instagram, to create “super profiles” for users.16 A ruling
`from German regulators prohibited Facebook from combining Facebook user account data with user
`data on company services like WhatsApp and Instagram.17
`Upon information and belief, Facebook’s shared infrastructure, systems, and
`43.
`technology and processing of user information across the Facebook Companies includes using the
`biometrics harvested from its Instagram users’ uploaded material to improve the algorithms that power
`its facial recognition abilities across all of its platforms, including, but not limited to, its Facebook
`application where, for example, Facebook uses its facial recognition to suggest tags to Facebook users
`and lets Facebook users know when their photos are uploaded by someone else.18
`Upon information and belief, Facebook also includes the biometrics captured from
`44.
`Instagram users’ uploaded material, as well as Instagram users’ tagging information, to bolster its
`databases of biometrics, face templates, and tagging information that enables Facebook’s facial
`recognition to continue learning and improving, which, in turn, enhances all of Facebook’s facial
`
`
`14 See https://help.instagram.com/2482657248648591
`15 See https://help.instagram.com/155833707900388 Section IV: How Do the Facebook Companies
`Work Together?
`16 See https://www.nytimes.com/2020/06/23/technology/facebook-antitrust-germany.html
`17 See https://www.nytimes.com/2019/02/07/technology/germany-facebook-data.html
`18 See https://www.facebook.com/help/122175507864081 What is the face recognition setting on
`Facebook and how does it work?
`
`
`
`11
`CONSOLIDATED CLASS ACTION COMPLAINT
`
`1
`2
`3
`4
`5
`6
`7
`8
`9
`10
`11
`12
`13
`14
`15
`16
`17
`18
`19
`20
`21
`22
`23
`24
`25
`26
`27
`28
`
`
`

`

`Case 4:20-cv-06361-JST Document 37 Filed 01/26/21 Page 12 of 27
`
`
`
`recognition products, including, for example, its predictive tagging feature on the Facebook
`application.19 Several of Facebook’s products, such as Moments, an application Facebook introduced
`in 2015, capitalizes on Facebook’s facial recognition technology.20
`Several of Facebook’s prior patent filings further attest to Facebook’s commercial
`45.
`purposes in developing its facial recognition technologies. These patents reportedly described one
`system that could detect consumers within stores and match those shoppers’ faces with their social
`networking profiles, and another in which cameras near checkout counters could capture shoppers’
`faces and match them with their social networking profiles.21
`As such, Facebook profits from its use of its Instagram users’ protected biometrics by
`46.
`using them to improve the accuracy of its own facial recognition services, to expand the datasets
`which enable its facial recognition software, and to cement its market-leading position in facial
`recognition and social media.
`Accordingly, Facebook and Instagram have collected, captured, or otherwise obtained
`47.
`Instagram users’ biometric identifiers or biometric information, as those terms are defined in Section
`10 of BIPA, from content that Instagram users uploaded to Instagram.
`Facebook and Instagram are in possession of Instagram users’ biometric identifiers or
`48.
`biometric information from content that Instagram users uploaded to Instagram.
`Facebook and Instagram scan photographs, videos, or other content uploaded to
`49.
`Instagram for biometric identifiers or biometric information.
`In direct contravention of Section 15(a) of the BIPA, Facebook has failed to develop
`50.
`and make available to the public its requisite retention and deletion plan and, upon information belief,
`by has failed to destroy such biometrics when the purpose for collecting and obtaining the biometrics
`have been satisfied or within three years of Plaintiffs’ and Class Members’ last use of the app.
`
`
`19 See https://www.npr.org/sections/alltechconsidered/2016/05/18/477819617/facebooks-facial-reco
`gnition-software-is-different-from-the-fbis-heres-why#:~:text=Facebook-,Facebook's%20Moments
`%20app%20uses%20facial%20recognition%20technology%20to%20group%20photos,friends%20w
`ho%20are%20in%20them.&text=When%20someone%20tags%20you%20in,reminder%20of%20a%
`20shared%20memory. (describing the benefit to facial recognition algorithms of additional photographs
`and tagging information).
`20 See https://techcrunch.com/2015/06/15/facial-recogbook/
`21 See https://www.nytimes.com/2018/07/09/technology/facebook-facial-recognition-privacy.html
`12
`CONSOLIDATED CLASS ACTION COMPLAINT
`
`
`
`1
`2
`3
`4
`5
`6
`7
`8
`9
`10
`11
`12
`13
`14
`15
`16
`17
`18
`19
`20
`21
`22
`23
`24
`25
`26
`27
`28
`
`
`

`

`Case 4:20-cv-06361-JST Document 37 Filed 01/26/21 Page 13 of 27
`
`
`
`
`1
`2
`3
`4
`5
`6
`7
`8
`9
`10
`11
`12
`13
`14
`15
`16
`17
`18
`19
`20
`21
`22
`23
`24
`25
`26
`27
`28
`
`
`In direct contravention of §15(b) of the BIPA, Facebook collected Plaintiffs’ and Class
`51.
`Members’ biometrics without informing them that it would collect, store, and use their biometric
`facial data, without informing Instagram users of the specific purpose and length of term for which
`their biometric data would be collected, stored, and used, and without receiving a written release from
`Instagram users before it began to collect, store, disclose, profit from, and otherwise use their
`biometric data.
`In direct contravention of §15(c) of the BIPA, Facebook profited from Plaintiffs’ and
`52.
`Class Members’ protected biometrics.
`In direct contravention of §15(d)-(e) of the BIPA, Facebook voluntarily disclosed and
`53.
`otherwise disseminated Plaintiffs’ and Class Members’ protected biometrics.
`Plaintiffs and Class Members’ Injuries and Damages
`III.
`54.
`As alleged herein, as a result of Facebook’s unlawful conduct, Plaintiffs and Class
`Members have already sustained injuries and face many more imminent and certainly impending
`injuries, which they will continue to suffer.
`Facebook’s unlawful conduct has resulted in, among other injuries: (a) Plaintiffs’ and
`55.
`Class Members’ unique biometric identifiers and information being collected, captured, obtained,
`disc

This document is available on Docket Alarm but you must sign up to view it.


Or .

Accessing this document will incur an additional charge of $.

After purchase, you can access this document again without charge.

Accept $ Charge
throbber

Still Working On It

This document is taking longer than usual to download. This can happen if we need to contact the court directly to obtain the document and their servers are running slowly.

Give it another minute or two to complete, and then try the refresh button.

throbber

A few More Minutes ... Still Working

It can take up to 5 minutes for us to download a document if the court servers are running slowly.

Thank you for your continued patience.

This document could not be displayed.

We could not find this document within its docket. Please go back to the docket page and check the link. If that does not work, go back to the docket and refresh it to pull the newest information.

Your account does not support viewing this document.

You need a Paid Account to view this document. Click here to change your account type.

Your account does not support viewing this document.

Set your membership status to view this document.

With a Docket Alarm membership, you'll get a whole lot more, including:

  • Up-to-date information for this case.
  • Email alerts whenever there is an update.
  • Full text search for other cases.
  • Get email alerts whenever a new case matches your search.

Become a Member

One Moment Please

The filing “” is large (MB) and is being downloaded.

Please refresh this page in a few minutes to see if the filing has been downloaded. The filing will also be emailed to you when the download completes.

Your document is on its way!

If you do not receive the document in five minutes, contact support at support@docketalarm.com.

Sealed Document

We are unable to display this document, it may be under a court ordered seal.

If you have proper credentials to access the file, you may proceed directly to the court's system using your government issued username and password.


Access Government Site

We are redirecting you
to a mobile optimized page.





Document Unreadable or Corrupt

Refresh this Document
Go to the Docket

We are unable to display this document.

Refresh this Document
Go to the Docket