Passed in 2008, the Illinois Biometric Information Privacy Act (BIPA) regulates collection of biometric markers such as fingerprints or facial metrics. Since its passage, the Illinois BIPA has been used to restrict technology giants and their use of users’ personal information, particularly photographs. To understand the scale of this, Facebook reported in a 2013 whitepaper that its users have uploaded more than 250 billion photos. It was estimated in 2017 that the total number of digital photos stored in electronic databases was around 5 trillion.
Documenting and categorizing the faces of a significant percentage of the world’s population represents a major opportunity for technology and data companies. Ten years into enforcement and a figurative eternity into the technological evolution of the process, the Illinois BIPA has been an unavoidable feature of the big data landscape. Though potentially impactful cases remain pending (or on appeal), technology companies largely have been unable to convince courts that their facial recognition technologies should escape regulation under BIPA.
BIPA requires explicit consent before a company may, among other things, collect a “scan of . . . face geometry.” (740 ILCS 14/10, 14/15). Facebook, Google, Snapchat and Shutterfly all have facial recognition features hat potentially fall under the BIPA’s regulatory umbrella. By and large, courts have classified these as being subject to BIPA. In one case (In Re Facebook Biometric Information Privacy Litigation, 185 F. Supp. 3d 1155 (N.D. Cal. 2016), Facebook argued that its technology does not perform a “scan of . . . face geometry” because it does not measure distances and angles of human features for identification. Rather, it uses machining learning models to recognize human faces based on detection of “fiducial points” at the pixel level. 2018 U.S. Dist. LEXIS 81044. While the court declined to opine on the operation of Facebook’s facial recognition technology, it interpreted the terms “scan” and “geometry” broadly—and not to require actual or express measurements of spatial or traditionally “geometric” quantities, like distance, depth, or angles, of an entire facial feature. Id. at *11-12.
Technology defendants have also argued for application of BIPA’s photograph exception. BIPA defines two regulated categories: biometric identifiers and biometric information. Biometric identifiers include “retina or iris scan[s], fingerprint[s], voiceprint[s], or scan[s] of...
