`
`CARLSON LYNCH, LLP
`TODD D. CARPENTER (234464)
`1350 Columbia Street, Suite 603
`San Diego, CA 92101
`Tel:
`619-762-1910
`Fax: 619-756-6991
`tcarpenter@carlsonlynch.com
`Attorneys for Plaintiff and the Proposed Class
`[Additional counsel listed on signature page.]
`
`
`
`8/10/2020
`
`SUPERIOR COURT OF CALIFORNIA
`COUNTY OF SAN MATEO
`20-CIV-03346
`KELLY WHALEN, Individually and on Behalf of
`Case No.
`All Others Similarly Situated,
`CLASS ACTION COMPLAINT
`Plaintiff,
`DEMAND FOR JURY TRIAL
`
`v.
`FACEBOOK, INC.,
`Defendant.
`
`Plaintiff Kelly Whalen, individually and on behalf of all others similarly situated, through
`undersigned counsel, brings this Class Action Complaint for Violations of the Illinois Biometric
`Information Privacy Act (“BIPA”), 740 ILCS 14/1 et seq., against defendant Facebook, Inc.
`(“Facebook” or “Defendant”), and alleges the following upon information and belief, except as to the
`allegations within Plaintiff’s personal knowledge. Plaintiff believes that substantial additional
`evidentiary support will exist for the allegations set forth herein after a reasonable opportunity for
`discovery.
`I.
`
`SUMMARY OF THE ACTION
`Facebook, Inc. is a social media conglomerate founded in 2004. It owns its eponymous
`1.
`social networking platform in addition to a host of subsidiaries.
`Instagram is a photo and video-sharing social networking service that is owned by
`2.
`Facebook, Inc. It was initially released as an application for the iOS mobile operating system in 2010
`before being acquired by Facebook in 2012. Since its acquisition by Facebook, Instagram has steadily
`
`
`
`1
`CLASS ACTION COMPLAINT
`
`1
`2
`3
`4
`5
`6
`7
`8
`9
`10
`11
`12
`13
`14
`15
`16
`17
`18
`19
`20
`21
`22
`23
`24
`25
`26
`27
`28
`
`
`

`

`
`
`amassed new users worldwide. In 2019, there were more approximately 118 million users in the
`United States alone.
`Facebook’s social media platform offers a multi-faceted approach for users to connect
`3.
`with one another. In addition to sharing photos and videos, Facebook is a social networking service
`which allows users to share news articles, create special interest groups, shop, and more. Instagram,
`on the other hand, is more limited in its scope of use. Its primary features are photo and video sharing,
`direct messaging, and “stories,” which are photos and/or videos which disappear from a user’s profile
`after 24 hours.
`Earlier this year Facebook agreed to pay $650 million to settle a class action that
`4.
`accuses the company of illegally harvesting the protected biometrics of users of its Facebook platform.
`As set forth below, Facebook also illegally harvests the protected biometrics of users of its Instagram
`application.
`In direct violation of Sections 15(a)-(e) of the BIPA, Facebook is actively collecting,
`5.
`storing, disclosing, profiting from, and otherwise using the biometric information of its reportedly
`more than 100 million Instagram users without any written notice or informed written consent,
`including millions of Illinois residents.
`Facebook has readily admitted to its collection of biometrics from Instagram users. Its
`6.
`facial recognition software works by scanning faces of unnamed people in photos or videos to analyze
`details of individuals’ faces and creating a corresponding “face template” for each face, and then
`storing that face template for later use and/or matching it to those already in a database of identified
`people. Facebook has said that users are in charge of that process, but in reality, people cannot actually
`control the technology because Facebook scans their faces in photos and videos uploaded by other
`users, even if their individual facial recognition setting is turned off.1
`Facebook surreptitiously captures its Instagram users’ protected biometrics without
`7.
`their informed consent and, worse yet, without actually informing them of its practice. Upon
`information and belief, once Facebook captures its Instagram users’ protected biometrics, it uses them
`to bolster its facial recognition abilities across all of its products, including the Facebook application,
`
`
`1 See https://www.nytimes.com/2018/07/09/technology/facebook-facial-recognition-privacy.html
`2
`CLASS ACTION COMPLAINT
`
`
`
`1
`2
`3
`4
`5
`6
`7
`8
`9
`10
`11
`12
`13
`14
`15
`16
`17
`18
`19
`20
`21
`22
`23
`24
`25
`26
`27
`28
`
`
`

`

`
`
`and shares this information among various entities. Facebook does all of this without providing any
`of the required notices or disclosures required by Illinois law.
`Plaintiff brings this action individually and on behalf of a proposed class in order to
`8.
`stop Facebook’s violations of the BIPA and to recover statuary damages for Facebook’s unauthorized
`collection, storage, disclosure, profiting from, and use of their biometric information in violation of
`the BIPA.
`II.
`
`PARTIES
`Plaintiff Kelly Whalen is, and has been at all relevant times, a resident and citizen of
`9.
`the state of Illinois and a resident of Cook County, Illinois. Plaintiff first created an Instagram account
`on November 17, 2011 and has used Instagram regularly since that time.
`During the relevant time period, Ms. Whalen accessed Instagram on both her computer
`10.
`and phone to post photographs, view content posted by other users, and react to that content via
`comments and “likes.” Ms. Whalen frequently tagged herself and others in photographs posted on
`Instagram, and appeared in photographs uploaded by others to Instagram. Plaintiff was not aware that
`any facial recognition data or other biometric data was being collected by Facebook through her
`Instagram use.
`Defendant Facebook is a Delaware corporation with its headquarters and principal
`11.
`executive offices at 1601 Willow Road, Menlo Park, California 94025. Facebook is a citizen of the
`states of Delaware and California. Facebook is also registered to conduct business in the State of
`Illinois (file number 66267067) and maintains an office in Cook County.
`III.
`
`JURISDICTION AND VENUE
`This Court has jurisdiction over this class action pursuant to Cal. Civ. Proc. Code
`12.
`§410.10 and Article VI, §10 of the California Constitution.
`The Court has personal jurisdiction over Defendant because it has affirmatively
`13.
`established and maintained sufficient contacts with California in that Defendant is registered to do
`business in this State, is headquartered in this State, and conducts significant business in this State.
`Venue is proper in this County pursuant to California Civ. Proc. Code §395.5 as
`14.
`StubHub’s principal place of business is in this county, and pursuant to Cal Civ. Code §1780(d) as
`
`
`
`3
`CLASS ACTION COMPLAINT
`
`1
`2
`3
`4
`5
`6
`7
`8
`9
`10
`11
`12
`13
`14
`15
`16
`17
`18
`19
`20
`21
`22
`23
`24
`25
`26
`27
`28
`
`
`

`

`
`
`Defendant’s principal place of business is in this county and a substantial portion of the transactions
`and allegations complained of herein occurred here.
`IV. SUBSTANTIVE ALLEGATIONS
`Biometric Information and the Illinois BIPA
`I.
`15.
`A “biometric identifier” is any personal feature that is unique to an individual including
`fingerprints, iris scans, DNA, facial features and voice, among others.2
`The Illinois Legislature has found that “[b]iometrics are unlike other unique identifiers
`16.
`that are used to access finances or other sensitive information.” 740 ILCS 14/5(c). “For example,
`social security numbers, when compromised, can be changed. Biometrics, however, are biologically
`unique to the individual; therefore, once compromised, the individual has no recourse, is at heightened
`risk for identity theft, and is likely to withdraw from biometric-facilitated transactions.” Id.
`In recognition of this legitimate concern over the security of biometric information,
`17.
`the Illinois Legislature enacted the BIPA, which provides, inter alia, that:
`No private entity may collect, capture, purchase, receive through trade, or otherwise
`obtain a person’s or a customer’s biometric identifier or biometric information,
`unless it first:
`informs the subject or the subject’s legally authorized representative in
`(1)
`writing that a biometric identifier or biometric information is being collected or
`stored;
`
`informs the subject or the subject’s legally authorized representative in
`(2)
`writing of the specific purpose and length of term for which a biometric identifier or
`biometric information is being collected, stored, and used; and
`receives a written release executed by the subject of the biometric
`(3)
`identifier or biometric information or the subject’s legally authorized representative.
`
`740 ILCS 14/15(b).
`Section 15(a) of the BIPA further provides that:
`18.
`A private entity in possession of biometric identifiers or biometric information must
`develop a written policy, made available to the public, establishing a retention
`schedule and guidelines for permanently destroying biometric identifiers and
`biometric information when the initial purpose for collecting or obtaining such
`
`2 The BIPA defines “biometric information” as “any information, regardless of how it is captured,
`converted, stored, or shared, based on an individual’s biometric identifier used to identify an individual.
`Biometric information does not include information derived from items or procedures excluded under
`the definition of biometric identifiers.” 740 ILCS 14/10. Plaintiff herein uses the terms “biometric
`information” and “biometric identifier” interchangeably.
`4
`CLASS ACTION COMPLAINT
`
`
`
`1
`2
`3
`4
`5
`6
`7
`8
`9
`10
`11
`12
`13
`14
`15
`16
`17
`18
`19
`20
`21
`22
`23
`24
`25
`26
`27
`28
`
`
`

`

`
`
`
`1
`2
`3
`4
`5
`6
`7
`8
`9
`10
`11
`12
`13
`14
`15
`16
`17
`18
`19
`20
`21
`22
`23
`24
`25
`26
`27
`28
`
`
`identifiers or information has been satisfied or within 3 years of the individual’s last
`interaction with the private entity, whichever occurs first.
`
`740 ILCS 14/15(a).
`As alleged herein, Facebook’s practices of collecting, storing, and using Instagram
`19.
`users’ biometric information without informed written consent violates all three prongs of §15(b) of
`the BIPA. Facebook’s failure to provide a publicly available written policy regarding its schedule and
`guidelines for the retention and permanent destruction of Instagram users’ biometric information
`within the earlier of 3 years of a user’s last interaction with Facebook or whenever the initial purpose
`for collecting the biometric information is satisfied violates §15(a) of the BIPA.
`Facebook has also violated Section 15(c) of the BIPA by selling, leasing, trading, or
`20.
`otherwise profiting from a person’s biometrics, as set forth more fully below.
`Facebook has likewise violated Sections 15(d)-(e) of the BIPA by disclosing,
`21.
`redisclosing, or otherwise disseminating the biometrics captured from media uploaded to Instagram,
`as set forth more fully below.
`Facebook Collects, Stores, Discloses, Profits from, and Otherwise Uses Plaintiffs’
`II.
`and Class Members’ Biometric Information in Violation of the BIPA
`
`Instagram has over one billion users worldwide and millions of users in Illinois alone.
`22.
`Instagram allows its users to create a personal page where members can upload
`23.
`photographs and videos, participate in live video broadcasts, and communicate and interact with other
`Instagram users. Approximately 95 million photos are shared on Instagram each day, with over 40
`billion photos and videos shared on the platform since its inception.
`Facebook has employed its facial recognition technology continuously from the time
`24.
`it was first introduced in 2010, including the time period after its acquisition of Instagram in 2012,
`and continuing to the date of the filing of this Complaint.
`Facebook’s sophisticated facial recognition technology works by collecting and
`25.
`analyzing the facial features of individuals appearing in photographs and videos uploaded to
`Instagram and generating a “biometric signature” or “face template” of each individual’s face that
`appears therein. This facial template is based on each person’s facial geometry and is specific to that
`
`
`
`5
`CLASS ACTION COMPLAINT
`
`

`

`
`
`person. Facebook, upon information and belief, stores those face templates taken from Instagram in a
`large database of face templates, which database additionally includes face templates Facebook has
`made from photographs its users have uploaded to other platforms besides Instagram, including
`photographs uploaded to Facebook. As Facebook’s Instagram and Facebook users continue to
`manually tag friends, family, and other people they recognize in a photograph, Facebook’s software
`automatically compares those images to the face templates in its database. If there is a match,
`Facebook may identify the user.
`Facebook is then able to identify the individuals whose biometrics it has captured by
`26.
`cross referencing the face templates of individuals appearing in Instagram photographs with face
`templates that it has already linked with an identified individual (for instance, face templates taken
`from a face that Instagram or Facebook users have tagged, or with face templates that have been
`identified via other platforms or companies that Facebook shares its protected biometrics with), and
`identify the individual when there is a match.
`Prior to January 1, 2020, Facebook has never informed Instagram users that it collects
`27.
`their biometric data. Rather, the Instagram Data Policy merely states that Facebook collects
`information “you and others provide” to the app, in the form of both posted content and anything users
`might see through the camera, and that its systems automatically process the content and
`communications provided by users to analyze context and what's in them (emphasis added).3
`In fact, Facebook actively mislead Instagram users about whether it was collecting
`28.
`facial recognition data. Instagram’s Data Policy states, “If you have it turned on, we use face
`recognition technology to recognize you in photos, videos and camera experiences.”4 However,
`Instagram users have no ability to turn off any facial recognition software within the app. Furthermore,
`the Instagram Data Policy states, “If we introduce face-recognition technology to your Instagram
`experience, we will let you know first, and you will have control over whether we use this technology
`for you.”5 As set forth below, these statements are untrue.
`
`
`3 See https://help.instagram.com/155833707900388 Section I: What Kinds of Information Do We
`Collect?
`4 See https://help.instagram.com/519522125107875 Section II: How Do We Use This Information?
`5 Id.
`
`
`
`6
`CLASS ACTION COMPLAINT
`
`1
`2
`3
`4
`5
`6
`7
`8
`9
`10
`11
`12
`13
`14
`15
`16
`17
`18
`19
`20
`21
`22
`23
`24
`25
`26
`27
`28
`
`
`

`

`
`
`
`On January 1, 2020, Facebook published, for the first time, its California Privacy
`29.
`Notice for its California users as a supplement to its current Data Policy in compliance with
`California’s Consumer Privacy Act (CCPA).6 Instagram admits in this notice that any of the
`information disclosed within the California Privacy Notice may have been collected from users over
`the past 12 months. While only California currently requires these types of disclosures to consumers,
`the contents of the notice demonstrate that Facebook has been collecting biometric data from its
`Instagram users for, at minimum, the 2019 calendar year. The California Privacy Notice is reproduced
`in part below (emphasis added):
`
`Categories of Personal
`Information we collect may
`include:
`
`• Identifiers;
`• Data with special protections,
`if you choose to provide it;
`• Commercial information, if
`you choose to provide it;
`• Photos and face imagery
`that can be used to create
`face-recognition templates
`if you or others choose to
`provide it and you have the
`setting turned on.
`• Internet or other electronic
`network activity information,
`including content you view or
`engage with;
`• Location-related information,
`including precise device
`location if you choose to
`allow us to collect it;
`• Audio or visual Information,
`including photos and videos,
`if you or others choose to
`provide it;
`• Professional or employment
`information, if you choose to
`provide it;
`
`Examples of how Personal
`Information is used include:
`
`• Providing, personalizing, and
`improving our Products;
`• Facilitating transactions,
`providing measurement,
`analytics, advertising, and
`other business services;
`• Promoting safety, integrity,
`and security;
`• Communicating with you;
`• Researching and innovating
`for social good; and
`• To perform other business
`purposes.
`
`Parties with whom your
`information may be shared
`include:
`
`• People and accounts you
`share and communicate with;
`• People and accounts with
`which others share or reshare
`content about you;
`• Apps, websites, and third-
`party integrations on or using
`our Products;
`• New owners in the event of a
`change of ownership or
`control of all or part of our
`Products or their assets
`changes;
`• Partners, including partners
`who use our analytics
`services, advertisers,
`measurement partners,
`partners offering goods and
`services in our Products,
`vendors and service
`providers, and researchers
`and academics;
`• Law enforcement or other
`third parties in connection
`with legal requests; and
`• Facebook Companies.
`
`
`6 See https://help.instagram.com/2482657248648591 “California Privacy Notice”
`7
`CLASS ACTION COMPLAINT
`
`
`
`1
`2
`3
`4
`5
`6
`7
`8
`9
`10
`11
`12
`13
`14
`15
`16
`17
`18
`19
`20
`21
`22
`23
`24
`25
`26
`27
`28
`
`
`

`

`Examples of how Personal
`Information is used include:
`
`Parties with whom your
`information may be shared
`include:
`
`
`
`
`Categories of Personal
`Information we collect may
`include:
`
`• Education information, if you
`choose to provide it;
`• Financial information, if you
`choose to provide it; and
`• Information derived from
`other Personal Information
`about you, which could
`include your preferences,
`interests, and other
`information used to
`personalize your experience.
`
`Although Facebook’s California Privacy Notice indicates that it collects Instagram
`30.
`user’s protected biometrics “if you or others choose to provide it and you have the setting turned on,”
`Facebook’s belated after-the-fact notice to Instagram users cannot constitute compliance with the
`BIPA for a variety of reasons, including that Facebook only allowed Class Members’ to opt out after
`it collected their protected biometrics, and even then, only if Class Members knew to look for the opt-
`out option, which, upon information and belief, is not even possible through a user’s Instagram
`account.7
`In any event, Instagram users cannot opt out. Indeed, Instagram users are not even
`31.
`given an opportunity to provide a written release because Facebook automatically processes content
`and shares it across its platforms. Rochelle Nadhiri, a Facebook spokeswoman, said its system
`analyzes faces in users’ photos to check whether they match with those who have their facial
`recognition setting turned on. This means that users can never really “opt out” of Facebook’s use of
`facial recognition. Even if a user does not have facial recognition activated on their personal account,
`their photo may still be scanned, collected, and entered into Facebook’s database if it matches with a
`user’s data who does have the facial recognition setting activated.8 This further means that one can
`never truly “opt out” because Facebook must capture and compare the biometrics of a face before
`
`
`7 See https://help.instagram.com/519522125107875, directing Instagram users to “opt out” via settings
`on their Facebook profile.
`8 See https://www.nytimes.com/2018/07/09/technology/facebook-facial-recognition-privacy.html
`8
`CLASS ACTION COMPLAINT
`
`
`
`1
`2
`3
`4
`5
`6
`7
`8
`9
`10
`11
`12
`13
`14
`15
`16
`17
`18
`19
`20
`21
`22
`23
`24
`25
`26
`27
`28
`
`
`

`

`
`
`learning if that face in fact matches with faces of users who have their facial recognition setting turned
`on or off.
`Further, Facebook concedes that it collects information such as the location of a photo,
`32.
`Instagram users’ current location, where they live, the places they go, and the businesses and people
`they’re near-to to “provide, personalize and improve our Products.” As such Facebook knows, or
`should know, that Plaintiffs’ and Class Members are Illinois users.9
` Moreover, upon information and belief, Facebook disclosed Instagram users’
`33.
`protected facial templates not only across various teams operating across its own various platforms,
`but with third parties. Facebook concedes that biometrics harvested from Instagram’s photographs
`and videos may be shared with other apps, websites, and third-party integrations, Facebook’s partners,
`including partners who use Facebook’s analytics services, advertisers, measurement partners, partners
`offering goods and services in Facebook’s products, vendors and service providers, researchers and
`academics, law enforcement, and Facebook Companies, including Facebook Payments Inc., Onavo,
`Facebook Technologies, LLC and Facebook Technologies Ireland Limited, WhatsApp Inc.,
`WhatsApp Ireland Limited, and CrowdTangle.10
`Facebook and Instagram share infrastructure, systems, and technology with other
`34.
`Facebook Companies and process information about the user across the Facebook Companies.11 This
`includes, upon information and belief, using Facebook’s facial recognition technology to process
`biometrics collected from Instagram users, which is then used to create new facial templates and/or
`enhance already-existing facial templates of those users.
`For example, Facebook is currently the subject of antitrust litigation in Germany,
`35.
`where they are alleged to have broken competition laws by combining personal data collected about
`users across its different platforms, including Instagram, to create “super profiles” for users.12 A
`
`
`9 See https://help.instagram.com/155833707900388
`10 See https://help.instagram.com/2482657248648591
`11 See https://help.instagram.com/155833707900388 Section IV: How Do the Facebook Companies
`Work Together?
`12 See https://www.nytimes.com/2020/06/23/technology/facebook-antitrust-germany.html
`
`
`
`9
`CLASS ACTION COMPLAINT
`
`1
`2
`3
`4
`5
`6
`7
`8
`9
`10
`11
`12
`13
`14
`15
`16
`17
`18
`19
`20
`21
`22
`23
`24
`25
`26
`27
`28
`
`
`

`

`
`
`ruling from German regulators prohibited Facebook from combining Facebook user account data with
`user data on company services like WhatsApp and Instagram.13
`Upon information and belief, Facebook’s shared infrastructure, systems, and
`36.
`technology and processing of user information across the Facebook Companies includes using the
`face templates harvested from its Instagram’s users’ uploaded material to improve the algorithms that
`power its facial recognition abilities across all of its platforms, including but not limited to its
`Facebook application where, for example, Facebook uses its facial recognition to suggest tags to
`Facebook users and lets Facebook users known when their photographs are uploaded by someone
`else.14
`Upon information and belief, Facebook also includes the face templates captured from
`37.
`Instagram users’ uploaded material, as well as Instagram users’ tagging information, to bolster its
`databases of face templates and tagging information that enables Facebook’s facial recognition to
`continue learning and improving, which in turn enhances all of Facebook’s facial recognition
`products, including, for example, its predictive tagging feature on the Facebook application.15 Several
`of Facebook’s products, such as Moments, an application Facebook introduced in 2015, capitalizes
`on Facebook’s facial recognition technology.16
`Several of Facebook’s prior patent filings further attest to Facebook’s commercial
`38.
`purposes in developing its facial recognition technologies. These patents reportedly described one
`system that could detect consumers within stores and match those shoppers’ faces with their social
`networking profiles and another in which cameras near checkout counters could capture shoppers’
`faces and match them with their social networking profiles.17
`
`
`13 See https://www.nytimes.com/2019/02/07/technology/germany-facebook-data.html
`14 See https://www.facebook.com/help/122175507864081 What is the face recognition setting on
`Facebook and how does it work?
`15
`https://www.npr.org/sections/alltechconsidered/2016/05/18/477819617/facebooks-facial-
`See
`recognition-software-is-different-from-the-fbis-heres-why#:~:text=Facebook-
`,Facebook's%20Moments%20app%20uses%20facial%20recognition%20technology%20to%20group
`%20photos,friends%20who%20are%20in%20them.&text=When%20someone%20tags%20you%20i
`n,reminder%20of%20a%20shared%20memory.
`(describing
`the benefit
`to
`facial
`recognition
`algorithms of additional photographs and tagging information).
`16 See https://techcrunch.com/2015/06/15/facial-recogbook/
`17 See https://www.nytimes.com/2018/07/09/technology/facebook-facial-recognition-privacy.html
`10
`CLASS ACTION COMPLAINT
`
`
`
`1
`2
`3
`4
`5
`6
`7
`8
`9
`10
`11
`12
`13
`14
`15
`16
`17
`18
`19
`20
`21
`22
`23
`24
`25
`26
`27
`28
`
`
`

`

`
`
`
`1
`2
`3
`4
`5
`6
`7
`8
`9
`10
`11
`12
`13
`14
`15
`16
`17
`18
`19
`20
`21
`22
`23
`24
`25
`26
`27
`28
`
`
`As such, Facebook profits from its use of its Instagram users’ protected biometrics by
`39.
`using them to improve the accuracy of its own facial recognition services, to expand the datasets
`which enable its facial recognition software, and to cement its market-leading position in facial
`recognition and social media.
`In direct contravention of §15(a) of the BIPA, Facebook has collected Plaintiff’s and
`40.
`Class Members’ face templates without developing a written policy establishing a retention schedule
`and guidelines for permanently destroying biometric identifiers and biometric information when the
`initial purpose for collecting such identifiers or information has been satisfied or within 3 years of the
`individual’s last interaction with Facebook.
`In direct contravention of §15(b) of the BIPA, Facebook collected Plaintiff’s and Class
`41.
`Members’ face templates without informing them that it would collect, store, and use their biometric
`facial information, without informing Instagram users of the specific purpose and length of term for
`which their biometric information would be collected, stored, and used, and without receiving a
`written release from Instagram users before it began to collect, store, disclose, profit from, and
`otherwise use their biometric information.
` In direct contravention of §15(c) of the BIPA, Facebook profited from Plaintiff’s and
`42.
`Class Members’ protected face templates.
`In direct contravention of §15(d)-(e) of the BIPA, Facebook voluntarily disclosed and
`43.
`otherwise disseminated Plaintiff’s and Class Members’ protected face templates.
`Plaintiff’s and Class Members’ Injuries and Damages
`III.
`44.
`As alleged herein, as a result of Facebook’s unlawful conduct, Plaintiff and Class
`Members have already sustained injuries and face many more imminent and certainly impending
`injuries, which injuries they will continue to suffer.
`Facebook’s unlawful conduct has resulted in, among other things: (a) Plaintiff’s and
`45.
`Class Members’ unique biometric identifiers and information being collected, captured, obtained,
`disclosed, and otherwise disseminated without the requisite notice having been given and without the
`requisite releases having been obtained; and (b) Plaintiff and Class Members being deprived of the
`very control over their biometric identifiers and information that BIPA was designed to protect.
`
`
`
`11
`CLASS ACTION COMPLAINT
`
`

`

`
`
`
`To this day, Plaintiff and Class Members do not know which, or how many, individuals
`46.
`or entities have received, obtained, accessed, stored, disclosed, or otherwise made use of Plaintiff’s
`and Class Members’ biometric identifiers and information, exposing them to the imminent and
`certainly impending injuries of identity theft, fraud, stalking, surveillance, social engineering, and
`other invasions of privacy.18
`As a result of Facebook’s misconduct, Plaintiff and Class Members have no recourse
`47.
`for the fact that their biologically unique information has been compromised. Moreover, Plaintiff and
`Class Members are likely to withdraw from biometric-facilitated transactions and other facially-
`mediated electronic participation.
`Plaintiff’s Personal Experiences
`IV.
`48.
`Plaintiff is a resident of Palos Heights, Illinois. Plaintiff signed up for an Instagram
`account in Palos Heights, Illinois in 2011, and has since then uploaded numerous photographs.
`Since joining Instagram, Plaintiff has uploaded and posted many photographs to
`49.
`Facebook’s network from Instagram that include images of her face, and Plaintiff has tagged herself
`in many of those photographs. Plaintiff’s face has also appeared in many photographs that other
`Instagram users have uploaded to Instagram, and Plaintiff’s face has been tagged by other Instagram
`users in many such photographs.
`50. Many of these photographs were taken in Illinois and were uploaded from Plaintiff’s
`computer in Illinois.
`As is the case for Class Members, Facebook has, upon information and belief, captured
`51.
`biometric identifiers and information from Plaintiff’s photographs by automatically locating and
`scanning Plaintiff’s face, and by extracting geometric data relating to the contours of her face and the
`distances between her eyes, nose, and ears, data which Facebook then used to create a unique template
`of Plaintiff’s face, as set forth more fully below.
`
`
`18
`Rewards,
`and
`Risks
`on
`Views
`10
`Tech:
`Facial
`Recognition
`https://www.forbes.com/sites/forbestechcouncil/2018/04/03/facial-recognition-tech-10-views-on-
`risks-and-rewards/#54d3e1716b3c
`
`
`
`12
`CLASS ACTION COMPLAINT
`
`1
`2
`3
`4
`5
`6
`7
`8
`9
`10
`11
`12
`13
`14
`15
`16
`17
`18
`19
`20
`21
`22
`23
`24
`25
`26
`27
`28
`
`
`

`

`
`
`
`1
`2
`3
`4
`5
`6
`7
`8
`9
`10
`11
`12
`13
`14
`15
`16
`17
`18
`19
`20
`21
`22
`23
`24
`25
`26
`27
`28
`
`
`The resulting unique face template was, upon information and belief, stored and used
`52.
`by Facebook for research purposes to develop its own facial recognition technologies across the
`various services and products it offers in connection with its Facebook Companies.
`Facebook stores, discloses, profits from, and otherwise uses these face templates
`53.
`without Plaintiff’s knowledge or consent.
`Plaintiff did not receive notice that Facebook would collect, store, profit from, disclose,
`54.
`or otherwise use her biometric information when she used the Instagram app.
`Plaintiff never provided informed consent, in writing or otherwise, to Facebook’s
`55.
`collection, creation, storage, or use of her face template or any of her biometric information.
`Plaintiff accordingly was never provided an opportunity to prohibit or prevent
`56.
`Facebook from collecting, storing, disclosing, or profiting from, or otherwise using her protected
`biometrics.
`V.
`
`CLASS ACTION ALLEGATIONS
`Plaintiff brings this lawsuit on behalf of the following proposed class (the “Class”),
`57.
`pursuant to pursuant to Cal. Civ. Proc. Code § 382, defined as follows:
`All Illinois residents who had their biometric identifiers, including scans of their
`face geometry collected, captured, received or otherwise obtained by Facebook
`through photographs uploaded to the Instagram app.
`Subject to additional information obtained through further investigation and discovery,
`58.
`the foregoing definition of the Class may be expanded or narrowed by amendment or amended
`complaint.
`Specifically excluded from the Class are Defendant, its officers, directors, agents,
`59.
`trustees, parents, children, corporations, trusts, representatives, employees, principals, servants,
`partners, joint-venturers, or any entities controlled by Defendant, and its heirs, successors, assigns, or
`other persons or entities related to or affiliated with Defendant and/or its officers and/or directors, the
`judge assigned to this action, and any member of the judge’s immediate family.
`Numerosity. The members of the Class are so numerous that individual joinder is
`60.
`impracticable. Upon information and belief, plaintiff alleges that the Class contains many thousands
`of members. Although the precise number of Class members is unknown to plaintiff, the true number
`
`
`
`13
`CLASS ACTION COMPLAINT
`
`

`

`
`
`of Class members is known by Defendant, and thus, may be notified