Apple faces $32.5B lawsuit over Photos app's facial recognition
What's the story
Apple is facing a massive $32.5 billion class-action lawsuit in Illinois, The Times reported. The legal action accuses the tech giant of collecting biometric data from photos without user consent. The lawsuit specifically targets the Photos app on iPhones, which allegedly uses facial recognition technology to scan and create unique "faceprints" for individuals appearing in images.
Data concerns
Allegations against Apple in the lawsuit
The lawsuit alleges that the process to create these faceprints is said to occur without user consent, raising serious privacy concerns.
The suit claims that after enough samples are collected, an algorithm is used to identify the iPhone user and store this data within the Photos app on their device.
Data transfer
iCloud syncing biometric data may also be a violation
The lawsuit also claims that photographs and associated data are synchronized across devices using iCloud, which is presumed to include biometric data.
This practice is said to violate Illinois law.
The suit has been filed on behalf of 6.5 million consumers in Illinois, potentially raising the total value of the lawsuit to a staggering $32.5 billion if Apple loses.
Court battle
Apple has tried to dismiss the lawsuit
Apple has tried to get the lawsuit dismissed, questioning whether its processes count as biometric identifiers.
The company insists that there are privacy safeguards in place so that the vectors used to organize photo albums cannot recreate a face or be linked to a person's name or identity.
Despite these assertions, an Illinois judge ruled in June that the lawsuit met class action requirements.
Legal framework
Illinois Biometric Information Privacy Act
The lawsuit hinges on the Illinois Biometric Information Privacy Act, a state law that came into force in 2008.
The law regulates how private companies use biometric information, including identifiers such as retina or iris scans, fingerprints, voiceprints, and faceprints.
Under this act, companies must get consent from individuals to collect or disclose personal biometric identifiers and store them securely.