Instagram Could Be Fined Up To $500 Billion in Fines for Illegally Collecting Biometric Data of Millions of Users

We give Instagram a whole lot of information about our lives. So is it really a surprise the company is allegedly collecting even more information 😳 (user biometric data) without consent?

That’s what a new lawsuit filed in Illinois is accusing Facebook, which owns Instagram, of doing. According to the suit, Facebook uses Insta’s face-tagging tool to identify people and create a “face template” that is stored in its database. 

Instagram supposedly tells its users about this in its terms of service, but the lawsuit claims the tool automatically scans the faces of everyone in your posts—including people who don’t use Instagram and never agreed to its terms of services. That violates Illinois state law that prohibits companies from collecting biometric data like a facial recognition scan without their knowledge or consent. 🙅‍♀️

Facebook could end up being fined between $1,000 and $5,000 per violation for as many as 100 million Instagram users, which could total $500 billion if the tech giant is found responsible! 

What Exactly is Biometric Data?

Biometrics refers to physical characteristics that can be used to verify someone’s identity. This includes stuff like your fingerprints, eyes, ears, voice, face, and DNA. Many users understandably find the thought of this type of very personal information being analyzed and shared without their permission pretty disturbing. That, unfortunately, is what Instagram allegedly did.

The lawsuit is accusing Instagram of illegally building a database of face templates using the faces of people in pictures shared on the platform. It was filed on behalf of Kelly Whalen, an Illinois resident who has been an Instagram user since 2011. 

“Once Facebook captures its Instagram users’ protected biometrics, it uses them to bolster its facial recognition abilities across all of its products, including the Facebook application, and shares this information among various entities,” the plaintiffs in Whalen v. Facebook wrote in their complaint. “Facebook does all of this without providing any of the required notices or disclosures required by Illinois law.” 

Biometric privacy has become a hot-button topic 😡 in the U.S. and internationally in recent years, with critics calling for stricter consumer data protection laws. Illinois was the first state to protect its residents against illegal collection and storage of biometric data with the passage of the Biometric and Information Privacy Act (BIPA) in 2008. 

A few other states have passed similar laws since then, but Illinois remains the only state that allows private individuals to file a lawsuit for damages stemming from a violation. That’s where the $1,000 to $5,000 fine per violation that Instagram faces comes from. 

A Facebook spokesperson called the lawsuit “baseless” and said Instagram doesn’t use its facial recognition in that way. But this isn’t the social media giant’s first rodeo with biometrics data; in March 2020, Facebook offered $650 million to settle a similar lawsuit in Illinois that accused it of illegally collecting biometric data without consent through the Facebook app’s photo-tagging feature. 

Is Facebook the Only Culprit?

Facebook and Instagram aren’t the only platforms being sued over the illegal collection of personal data. Last week, TikTok reportedly agreed to pay $92 million 🤑 to settle 21 federal lawsuits accusing it of harvesting personal data from 89 million U.S. users without consent. It’s among the largest payouts for privacy-related violations in history. 

“First, it provides compensation for TikTok users, but equally as important, it ensures TikTok will respect its users’ privacy going forward,” Katrina Carroll, one of the attorneys representing the TikTok users, told the press. “Social media seems so innocuous, but troubling data collection, storage, and disclosure can happen behind the scenes.” 

The lawsuit claims TikTok “clandestinely vacuumed up” an insane amount of private data that could be used to identify users without consent. The company allegedly shared this data with Facebook, Google, and other companies. All of those dance challenges and funny skits come at a pretty heavy cost. The scary part is that a majority of the plaintiffs are minors, some as young as 8 years old! 

Under the proposed terms of the settlement, TikTok will stop harvesting user biometric information, including facial characteristics collected using facial recognition technology. It will also stop tracking its users’ location using GPS data and will no longer send U.S. users’ data to servers in China. 

Hopefully, the Instagram lawsuit will also have a positive outcome, but that case will likely drag on for years. The BIPA-violation lawsuit that Facebook settled for $650 million last year started in 2015 and spent five years in court. Whalen v. Facebook still has a long way to go. 🛣️

It can be tough to know your rights when it comes to data and personal privacy on social media. If you have any doubts about what Facebook, Instagram, TikTok, or any of these platforms can collect, consider contacting a social media attorney for guidance.