Apple 'faceprints' case tests reach of biometric privacy law

By Jenna Greene

Oct 16 (Reuters) - A picture might be worth a thousand words, but for plaintiffs in a massive privacy class action against Apple, photographs could contain something more legally consequential: biometric data.

The tech giant faces a jury trial this spring after an Illinois federal judge in a ruling unsealed last week refused to dismiss most claims that Apple's Photos app surreptitiously creates and stores "faceprints" of people appearing in users' photographs.

The case could help define the reach of the Illinois Biometric Information Privacy Act, which is intended to prevent the misuse of people’s physical identifiers such as fingerprints, retinal scans and facial geometry.

There’s nothing new about using biometrics for identification – as U.S. District Judge Nancy Rosenstengel noted in her ruling, fingerprints recorded in clay to seal business deals date back thousands of years. But as biometric technology grows increasingly complex, so have the legal questions surrounding it.

The Apple litigation offers what could become one of the biggest tests yet of how the landmark 2008 Illinois law applies to newer technologies, including AI, that identify or distinguish people. Apple argues that its advanced face recognition technology doesn't actually “know” anyone's identity in a way that would trigger the statute.

The implications go beyond Apple. Companies including SpaceXAI, Amazon subsidiary Ring and Alphabet’s Google also face proposed class actions over the collection and use of biometric data, part of a growing wave of litigation that’s forcing courts to reconsider the bounds of the law.

Apple, which did not respond to a request for comment, denies wrongdoing in court papers.

Lawyers for the plaintiffs estimate the certified class consists of about 8 million Illinois residents. Violations of the Illinois law carry a maximum penalty of $5,000 per person, which potentially would put Apple on the hook for $40 billion if a jury finds that the company acted intentionally or recklessly.

The case began in 2020, when plaintiffs represented by Schlichter Bogard’s Andrew Schlichter sued Apple in East St. Louis federal court.

They allege Apple’s Photos app, which comes pre-installed on the company’s iPhones, tablets and computers and cannot be removed, automatically collects facial biometric data. Apple allegedly does not inform users or obtain their written consent before doing so.

The app uses facial recognition technology to group photos into albums on a person’s device – a feature that the company says is intended to help users “easily sort and find photos of the important people and pets in their lives.”

On my iPhone, for example, the app identified 1,512 photos of my son - group shots and portraits – from infancy through college graduation, and placed them in an unlabeled album in my photo library. It did the same with thousands of images of my daughter, my husband, my parents and my dog.

It seems innocuous enough, but the plaintiffs argue that biologically unique identifiers such as scans of people’s faces demand the strictest privacy protections.

“Unlike other identifiers such as Social Security or credit card numbers, which can be changed if compromised or stolen, biometric identifiers” cannot be modified, the complaint states.

The plaintiffs say Apple's actions violate Illinois' biometric law, which restricts the collection and possession of scans of "face geometry" without proper notice and consent.

But Apple argues its faceprint technology doesn’t actually create legally regulated scans.

It’s just a “string of numbers,” Apple lawyer Arturo González, a partner at Morrison & Foerster, told Rosenstengel at a hearing in late August, not a measure of angles and distances between features that could be used to recreate a face.

Facebook made a similar argument in an earlier class action involving its facial recognition “tag suggestions” software, which the company said merely analyzed pixels. It failed to sway a federal judge in California, who rejected the notion that “scan of face geometry” must mean “an express measurement of human facial features.” The company settled the case for $650 million in 2020.

Here, Apple isn’t trying to identify anyone, González argued. “Our technology simply asks, ‘Do these two pictures look alike,’ that's all, without asking ‘Is this John’ or ‘Is it Jane?’” he said, according to a transcript of the Aug. 27 proceedings.

González, who did not respond to a request for comment, also said Apple cannot access its customers’ photo album data. When the information is saved to iCloud, it’s encrypted and only accessible to the user.

To be held liable under the statute, Apple would have to “control” the information, González argued, but here, the company cannot decipher it.

In a decision issued Sept. 30 and made public on Oct. 8, Rosenstengel denied most of Apple’s motion for summary judgment, rejecting the company's argument that its encryption protocols mean it no longer controls the data.

She compared it to a collector of Ancient Egyptian artifacts inscribed with hieroglyphics. The collector might have no idea what the writing means, she wrote, but would nonetheless have a degree of control over the contents. He could add “a few random hieroglyphic characters of his choosing,” the judge noted, or post the hieroglyphs in some public forum. He could even destroy the artifact altogether.

Because Apple controls the software and the servers where the data is maintained, Rosenstengel wrote, it “undoubtedly could (among other things) re-write, make available to the public, remove encryption from, or delete entirely, the faceprint data.”

She scheduled trial for April 2027, leaving it to a jury to decide questions including whether Apple’s faceprints constitute a scan of face geometry and if they are capable of identifying an individual.

Four new lawyers -- all partners at Gibson, Dunn & Crutcher -- last week filed notices of appearance with the court on behalf of Apple, supplementing the Morrison & Foerster team.

Schlichter, who represents the plaintiffs, told me he is eager to take the case to trial. The litigation raises serious privacy concerns, he said, adding that "We look forward to presenting the evidence of Apple's alleged violations of law to the jury."