14 ms·

9th Circuit says users can sue Facebook over unlawful use of facial recognition

373 points by datapolitical 7y ago

saagarjha 7y ago
This only appears to apply in Illinois, unfortunately.
- munk-a 7y ago
  It's sad it's so limited, but it might spread!
  - dvtrn 7y ago
    It appears limited according to the article because of an existing statute found in Illinois law. Does anyone know if other states have similar laws? Wonder what type of momentum would have to manifest for other state legislatures to get a similar bill into committee for debate
    - _jal 7y ago
      A related effort is restricting what state and local gov can do with facial recognition. The cities of San Francisco, CA and Somerville, MA have passed ordinances, and NYC is considering it (as if the NYPD cares) but city bans obviously have major limitations. It looks to me like momentum on facial recognition is building now. Call your state reps, tell your friends, find folks who feel the same way and make some noise.
- casperc 7y ago
  I wonder how this case would play out with EU laws. Any idea?
thwythwy 7y ago
9th Circuit.
- datapolitical 7y ago
  I had it right initially but got confused because Illinois isn't 9th circuit. But Facebook is.
windexh8er 7y ago
How would this apply in a situation wherein a person uploads a picture of a minor that they are not the legal guardian for? Could that person sue the uploader of the photo for damages of having to go after Facebook? If situations like that are feasible under this then I would expect K-12 school districts to implement swift measure to ban all teachers from taking pictures of students as to avoid putting themselves in the middle. I find it egregious public schools don't have better policy on banning social media uploads of minors since it's such a gray area right now.
- jedberg 7y ago
  My wife's school had a social media policy 10 years ago. She wasn't allowed to upload any picture with a child in it unless she had explicit permission from every child's parent to upload that particular photo. Permission had to be requested for every photo. She was allowed to have a private photo site that all of the parents in the class had access to, and upload photos there. The parents were not supposed to re-share those, but some did.
- cgriswald 7y ago
  When my kid was in elementary school we were expected to sign a “students in media” waiver that basically let them use the pictures they took of the children however they wanted. I don’t know if it was required but it was heavily pushed and included with a packet of about a thousand things to sign, most of which were required. I never signed it. I just included the unsigned piece of paper (among others I disagreed with) in amongst the pile of papers I turned in to them. Nothing ever came of not signing but I suspect I could sue them now.
  - cameronbrown 7y ago
    Honestly, I think this practice is horrible. Kids don't deserved to be plastered all over Facebook by their school. It's deeply uncomfortable.
    - astronautjones 7y ago
OldHand2018 7y ago
This case is about whether they can be held accountable; it has already been established that they knowingly violated the law. The law says that the aggrieved party can sue for $1000 to $5000 per violation, and Facebook violated the law millions of times.
- pmiller2 7y ago
  Oh, well, another pitiful few billion dollars in fines. When are we going to start standing up to companies who violate our privacy like this?
  - dgzl 7y ago
    This isn't just a fine, it's compensation.
    - pmiller2 7y ago
      That’s slightly better, but still not enough. 1 million violations at $5000 a pop would be a pitiful $5 billion. IMO, millions of privacy violations are worth more than that.
      - rtpg 7y ago
        "pitiful $5 billion" is such a dumb take on these kinds of rulings. The ruling is specifically about the facial recognition part of FB. They could end up paying $5 billion just because of facial recognition stuff . Imagine if you put the Konami Code on the Google homepage, and got sued and lost for it. Then got fined $1 billion for it. You'd feel like you made a pretty bad decision there. Obviously facial recognition is closer to the core of what FB is doing in general but it's still a lot of money for an incidental part of their system! They can pay it, but that's $5 billion they can no longer use to buy like... 10 startups or whatever.
        dave5104 7y ago
        Apples to oranges. Google losing $1 billion over putting the Konami Code on their homepage hurts because they won't make $1 billion off of doing that. Facebook is likely making a lot of money off of, as you claim, something that is close to the core of what Facebook is doing. It makes $5 billion closer to a small cost of doing business.
isoskeles 7y ago
I find this sort of litigiousness to be bullshit because it incentivizes signing up for Facebook. I can't be party to some lawsuit against Facebook if I don't have an account ("users"). I deleted my Facebook a few years ago, so if some class-action suit comes out for people who were users in 2018+, where's my payout? How is such a system fair to people who had the sense to either delete before whatever time horizon is used in a case or people who never created an account? None of these people who could win the lottery in court suffered a real loss.
- matt-tingen 7y ago
  Why do you feel entitled to a payout for an event in which you were not involved and for which you experienced no damages?
  - thatcat 7y ago
    People can upload your photos without you having an account
  - isoskeles 7y ago
    I don't. I don't think anyone is entitled to a payout, as Facebook users did not pay Facebook causing some sort of breach of contract. They are owed nothing IMO. Yet the legal system gives people an incentive here to sign up for free services so they can one day reap the rewards when Free Service X slips up and breaks State Law Y. Admittedly, the rewards will be small. But nonetheless, it is an incentive and aggregated across society it isn't nothing. This sort of litigious behavior just slides us further and further into a culture of dishonesty and makes a mockery of the justice system. Also, let me be more specific given there's another thread on here about this. What makes anyone think they're entitled to "$5,000" for signing up for a free service and uploading their photos to it? This is absurd. Please explain specifically how running a facial recognition algorithm on person's photos is equivalent to "$5,000" worth of damages. Where did that number come from? Why not $1 or $1,000,000?
    - mikeash 7y ago
bubble_talk 7y ago
2009: Are you smart enough to be a Facebook engineer? 2019: Are you scummy enough to be a Facebook engineer?
- thecupisblue 7y ago
  This is so true. The way they are acting I feel like with people inclining towards "ethical" side of the spectrum leaving facebook and the culture is going to shift more and more into unethical.
  - disgruntledphd2 7y ago
    I feel like people have been saying this (lack of ethics amongst FB employees) for at least ten years.
    - Avamander 7y ago
      Because it has been true for at least ten years?
  - yulaow 7y ago
    honest question: do you think there was a moment in the history of facebook in which it was ethical, excluding the very beginning period?
    - thecupisblue 7y ago
      Well depends on what you define as the beginning period. I'd pinpoint the shift from 'ethical-ish' to 'unethical-ish' at about the time they changed feed from 'friends' to 'relevant for you' which is basically 'what our bidders want you to see'
    - hoseja 7y ago
      The very beginning? Doesn't the famous Zuck quote put even that into the scummy period?
fiter 7y ago
In an opinion by Judge Ikuta, the court “concludes that the development of a face template using facial-recognition technology without consent (as alleged here) invades an individual’s private affairs and concrete interests.” As the court explained, “the facial-recognition technology at issue here can obtain information that is ‘detailed, encyclopedic, and effortlessly compiled,’ which would be almost impossible without such technology.” Possessing a picture of someone's face is OK, but creating a model that represents that face is not OK if that model can be compared to another picture to categorize it. Possessing a picture of someones face is OK, and having a human create a mental model that represents that face is OK as well even if that can be compared to another picture to categorize it. The argument seems to center around how easy/hard or expensive/cheap the process is.
- akersten 7y ago
  The argument to me centers around the same terrible "but do it on a computer" sentiment that's been brandished to outlaw things that would otherwise be perfectly legal in meatspace. But something about doing normal things electronically is scary, and since it's easy to ban, that's the hammer we have. Other examples include: * Trading card game booster packs vs. video game loot boxes * Taking notes about people who visit your physical store vs. taking notes about people who browse to your website That said - I do realize I'm in the minority opinion here re: GDPR, etc. But the inconsistency really disturbs me, I don't agree with a ban on facial recognition: who is to tell someone what they can and can't do with a bucket of bits? What about other automated recognition for content moderation - surely automatically detecting nudity is OK by the law? But what if those recognition models wind up doing some form of emergent facial recognition via unsupervised learning? How could someone even verify that?
  - thecupisblue 7y ago
    Because it's incredibly faster to process, use, replicate, distribute and earn using that data. That is what makes it scary. Also loot boxes - imagine if Wizards of the Coast walked and gave away MTG booster packs on the street for free but told you "pay 10 cents to open it and you could get this cool stuff". Sets a completely different mental model in your head.
dfeojm-zlib 7y ago
One or more US federal agencies place innocent people who happen to work in a sensitive industry on one or more types of watch list that they scrape associated metadata and facial recognition to detect an association with suspicious people/criminals/persons of interest. I know this for a fact because one of my friends at a big name malware forensics got a call from his manager that the government noticed he was tagged in a picture at a conference after-party with someone who was on a "baddies" watchlist.
mnw21cam 7y ago
Why just users? Surely people who haven't signed up to Facebook, but have their photos uploaded by someone else and subsequently analysed, should be included?
onetimemanytime 7y ago
here comes the lawsuit settlement: $147 Million for the lawyers, $5 million for the state and $3 million total for the users that spend 10 hours filling forms. In other words, this is ineffective. I hope EU cripples them, not even $5B FTC fines scare them.
samstave 7y ago
Ok well at risk of being cease and desisted again by FB, in addition to them doing facial recognition - they take pictures and track every vehicle that drives by their HQ and report all those license plates back to Menlo Park. Its an invasion of privacy of all cars and drivers in the vicinity and should be illegal. Fuck facebook.
toxicFork 7y ago
Google photos is tracking my face and anyone else whose photos I have taken from my phone and I cannot turn this off. They enable a "search photos by people" feature. I find this creepy and ominous. I never asked for this. Can I sue them for them to stop?
- WilTimSon 7y ago
  I would assume they have a clause about this in their user agreement, specifically because of this. Expect all big corporations to do the same soon and stop trusting them with photos because I don't think Facebook will turn the tide. This is likely going to be a one-off with other tech giants quickly patching the loopholes to make sure they can mine your data without any punishments. Not real ones, at least.
  - toxicFork 7y ago
    Yeah... I will look for alternatives for photo storage now, what a shame.
    - mxuribe 7y ago
      You can always switch to NextCloud, and it comes with an added bonus of no longer needing dropbox, google drive, etc. for syncing files. HOWEVER, NextCloud is not "free"; you'd either have to pay a provider to host your NextCloud instance for you, or self-host (both options are cheap by the way, but not free like google's option).
      - WilTimSon 7y ago
        Well, can we really call Google's option free when it feeds off of our own data? I'd rather spend a few pounds a month on storage that isn't looking for ways to monetize me then save that cost and end up losing my privacy. What's more of a hassle is the setup since quite a few people will always choose Dropbox and Drive over taking the time to set up NextCloud.
- drusepth 7y ago

373 points by datapolitical 7y ago

saagarjha 7y ago

This only appears to apply in Illinois, unfortunately.

munk-a 7y ago
It's sad it's so limited, but it might spread!
- dvtrn 7y ago
  It appears limited according to the article because of an existing statute found in Illinois law. Does anyone know if other states have similar laws? Wonder what type of momentum would have to manifest for other state legislatures to get a similar bill into committee for debate
  - _jal 7y ago
    A related effort is restricting what state and local gov can do with facial recognition. The cities of San Francisco, CA and Somerville, MA have passed ordinances, and NYC is considering it (as if the NYPD cares) but city bans obviously have major limitations. It looks to me like momentum on facial recognition is building now. Call your state reps, tell your friends, find folks who feel the same way and make some noise.
casperc 7y ago
I wonder how this case would play out with EU laws. Any idea?

thwythwy 7y ago

9th Circuit.

datapolitical 7y ago
I had it right initially but got confused because Illinois isn't 9th circuit. But Facebook is.

windexh8er 7y ago

How would this apply in a situation wherein a person uploads a picture of a minor that they are not the legal guardian for? Could that person sue the uploader of the photo for damages of having to go after Facebook? If situations like that are feasible under this then I would expect K-12 school districts to implement swift measure to ban all teachers from taking pictures of students as to avoid putting themselves in the middle. I find it egregious public schools don't have better policy on banning social media uploads of minors since it's such a gray area right now.

jedberg 7y ago
My wife's school had a social media policy 10 years ago. She wasn't allowed to upload any picture with a child in it unless she had explicit permission from every child's parent to upload that particular photo. Permission had to be requested for every photo. She was allowed to have a private photo site that all of the parents in the class had access to, and upload photos there. The parents were not supposed to re-share those, but some did.
cgriswald 7y ago
When my kid was in elementary school we were expected to sign a “students in media” waiver that basically let them use the pictures they took of the children however they wanted. I don’t know if it was required but it was heavily pushed and included with a packet of about a thousand things to sign, most of which were required. I never signed it. I just included the unsigned piece of paper (among others I disagreed with) in amongst the pile of papers I turned in to them. Nothing ever came of not signing but I suspect I could sue them now.
- cameronbrown 7y ago
  Honestly, I think this practice is horrible. Kids don't deserved to be plastered all over Facebook by their school. It's deeply uncomfortable.
  - astronautjones 7y ago

OldHand2018 7y ago

This case is about whether they can be held accountable; it has already been established that they knowingly violated the law. The law says that the aggrieved party can sue for $1000 to $5000 per violation, and Facebook violated the law millions of times.

pmiller2 7y ago
Oh, well, another pitiful few billion dollars in fines. When are we going to start standing up to companies who violate our privacy like this?
- dgzl 7y ago
  This isn't just a fine, it's compensation.
  - pmiller2 7y ago
    That’s slightly better, but still not enough. 1 million violations at $5000 a pop would be a pitiful $5 billion. IMO, millions of privacy violations are worth more than that.
    - rtpg 7y ago
      "pitiful $5 billion" is such a dumb take on these kinds of rulings. The ruling is specifically about the facial recognition part of FB. They could end up paying $5 billion just because of facial recognition stuff . Imagine if you put the Konami Code on the Google homepage, and got sued and lost for it. Then got fined $1 billion for it. You'd feel like you made a pretty bad decision there. Obviously facial recognition is closer to the core of what FB is doing in general but it's still a lot of money for an incidental part of their system! They can pay it, but that's $5 billion they can no longer use to buy like... 10 startups or whatever.
      - dave5104 7y ago
        Apples to oranges. Google losing $1 billion over putting the Konami Code on their homepage hurts because they won't make $1 billion off of doing that. Facebook is likely making a lot of money off of, as you claim, something that is close to the core of what Facebook is doing. It makes $5 billion closer to a small cost of doing business.

isoskeles 7y ago

I find this sort of litigiousness to be bullshit because it incentivizes signing up for Facebook. I can't be party to some lawsuit against Facebook if I don't have an account ("users"). I deleted my Facebook a few years ago, so if some class-action suit comes out for people who were users in 2018+, where's my payout? How is such a system fair to people who had the sense to either delete before whatever time horizon is used in a case or people who never created an account? None of these people who could win the lottery in court suffered a real loss.

matt-tingen 7y ago
Why do you feel entitled to a payout for an event in which you were not involved and for which you experienced no damages?
- thatcat 7y ago
  People can upload your photos without you having an account
- isoskeles 7y ago
  I don't. I don't think anyone is entitled to a payout, as Facebook users did not pay Facebook causing some sort of breach of contract. They are owed nothing IMO. Yet the legal system gives people an incentive here to sign up for free services so they can one day reap the rewards when Free Service X slips up and breaks State Law Y. Admittedly, the rewards will be small. But nonetheless, it is an incentive and aggregated across society it isn't nothing. This sort of litigious behavior just slides us further and further into a culture of dishonesty and makes a mockery of the justice system. Also, let me be more specific given there's another thread on here about this. What makes anyone think they're entitled to "$5,000" for signing up for a free service and uploading their photos to it? This is absurd. Please explain specifically how running a facial recognition algorithm on person's photos is equivalent to "$5,000" worth of damages. Where did that number come from? Why not $1 or $1,000,000?
  - mikeash 7y ago

bubble_talk 7y ago

2009: Are you smart enough to be a Facebook engineer? 2019: Are you scummy enough to be a Facebook engineer?

thecupisblue 7y ago
This is so true. The way they are acting I feel like with people inclining towards "ethical" side of the spectrum leaving facebook and the culture is going to shift more and more into unethical.
- disgruntledphd2 7y ago
  I feel like people have been saying this (lack of ethics amongst FB employees) for at least ten years.
  - Avamander 7y ago
    Because it has been true for at least ten years?
- yulaow 7y ago
  honest question: do you think there was a moment in the history of facebook in which it was ethical, excluding the very beginning period?
  - thecupisblue 7y ago
    Well depends on what you define as the beginning period. I'd pinpoint the shift from 'ethical-ish' to 'unethical-ish' at about the time they changed feed from 'friends' to 'relevant for you' which is basically 'what our bidders want you to see'
  - hoseja 7y ago
    The very beginning? Doesn't the famous Zuck quote put even that into the scummy period?

fiter 7y ago

In an opinion by Judge Ikuta, the court “concludes that the development of a face template using facial-recognition technology without consent (as alleged here) invades an individual’s private affairs and concrete interests.” As the court explained, “the facial-recognition technology at issue here can obtain information that is ‘detailed, encyclopedic, and effortlessly compiled,’ which would be almost impossible without such technology.” Possessing a picture of someone's face is OK, but creating a model that represents that face is not OK if that model can be compared to another picture to categorize it. Possessing a picture of someones face is OK, and having a human create a mental model that represents that face is OK as well even if that can be compared to another picture to categorize it. The argument seems to center around how easy/hard or expensive/cheap the process is.

akersten 7y ago
The argument to me centers around the same terrible "but do it on a computer" sentiment that's been brandished to outlaw things that would otherwise be perfectly legal in meatspace. But something about doing normal things electronically is scary, and since it's easy to ban, that's the hammer we have. Other examples include: * Trading card game booster packs vs. video game loot boxes * Taking notes about people who visit your physical store vs. taking notes about people who browse to your website That said - I do realize I'm in the minority opinion here re: GDPR, etc. But the inconsistency really disturbs me, I don't agree with a ban on facial recognition: who is to tell someone what they can and can't do with a bucket of bits? What about other automated recognition for content moderation - surely automatically detecting nudity is OK by the law? But what if those recognition models wind up doing some form of emergent facial recognition via unsupervised learning? How could someone even verify that?
- thecupisblue 7y ago
  Because it's incredibly faster to process, use, replicate, distribute and earn using that data. That is what makes it scary. Also loot boxes - imagine if Wizards of the Coast walked and gave away MTG booster packs on the street for free but told you "pay 10 cents to open it and you could get this cool stuff". Sets a completely different mental model in your head.

dfeojm-zlib 7y ago

One or more US federal agencies place innocent people who happen to work in a sensitive industry on one or more types of watch list that they scrape associated metadata and facial recognition to detect an association with suspicious people/criminals/persons of interest. I know this for a fact because one of my friends at a big name malware forensics got a call from his manager that the government noticed he was tagged in a picture at a conference after-party with someone who was on a "baddies" watchlist.

mnw21cam 7y ago

Why just users? Surely people who haven't signed up to Facebook, but have their photos uploaded by someone else and subsequently analysed, should be included?

onetimemanytime 7y ago

here comes the lawsuit settlement: $147 Million for the lawyers, $5 million for the state and $3 million total for the users that spend 10 hours filling forms. In other words, this is ineffective. I hope EU cripples them, not even $5B FTC fines scare them.

samstave 7y ago

Ok well at risk of being cease and desisted again by FB, in addition to them doing facial recognition - they take pictures and track every vehicle that drives by their HQ and report all those license plates back to Menlo Park. Its an invasion of privacy of all cars and drivers in the vicinity and should be illegal. Fuck facebook.

toxicFork 7y ago

Google photos is tracking my face and anyone else whose photos I have taken from my phone and I cannot turn this off. They enable a "search photos by people" feature. I find this creepy and ominous. I never asked for this. Can I sue them for them to stop?

WilTimSon 7y ago
I would assume they have a clause about this in their user agreement, specifically because of this. Expect all big corporations to do the same soon and stop trusting them with photos because I don't think Facebook will turn the tide. This is likely going to be a one-off with other tech giants quickly patching the loopholes to make sure they can mine your data without any punishments. Not real ones, at least.
- toxicFork 7y ago
  Yeah... I will look for alternatives for photo storage now, what a shame.
  - mxuribe 7y ago
    You can always switch to NextCloud, and it comes with an added bonus of no longer needing dropbox, google drive, etc. for syncing files. HOWEVER, NextCloud is not "free"; you'd either have to pay a provider to host your NextCloud instance for you, or self-host (both options are cheap by the way, but not free like google's option).
    - WilTimSon 7y ago
      Well, can we really call Google's option free when it feeds off of our own data? I'd rather spend a few pounds a month on storage that isn't looking for ways to monetize me then save that cost and end up losing my privacy. What's more of a hassle is the setup since quite a few people will always choose Dropbox and Drive over taking the time to set up NextCloud.
drusepth 7y ago