This is a research prototype. The data and analyses are preliminary and not yet validated — we'd welcome your .
Facebook agreed to a $550 million settlement following a class-action lawsuit alleging that its 'Tag Suggestions' facial recognition feature collected and stored biometric data without user consent. The lawsuit, which began in 2015, claimed violations of the Illinois Biometric Information Privacy Act. The company subsequently changed its facial recognition settings to be opt-in only.
Facebook’s initial version of the its Tag Suggestions feature where users were offered suggestions about the identity of people's faces in photos allegedly stored biometric data without consent, violating the Illinois Biometric Information Privacy Act.
Domain classification, causal taxonomy, severity scores, and national security assessments were LLM-classified and may contain errors.
AI systems that memorize and leak sensitive personal data or infer private information about individuals without their consent. Unexpected or unauthorized sharing of data and information can compromise user expectation of privacy, assist identity theft, or cause loss of confidential intellectual property.
The AI system compromised user privacy by obtaining and storing sensitive biometric face templates without explicit user consent.
Human
Due to a decision or action made by humans
Intentional
Due to an expected outcome from pursuing a goal
Post-deployment
Occurring after the AI model has been trained and deployed
The privacy risk was caused by Facebook's deliberate managerial decision to deploy the facial recognition feature by default and collect biometric data without user consent.
Facebook settled a class-action lawsuit for 550 million dollars over its Tag Suggestions feature, which collected and stored biometric data of Illinois users without consent. While representing a massive violation of user privacy and civil rights, the national security impact is minor and manageable within standard domestic legal frameworks, posing no immediate threat to physical, sovereign, or intelligence infrastructure.
The 'Tag Suggestions' tool scans photos and 'offers suggestions about who that person might be,' which augments human tagging capabilities but relies on human confirmation.
High Risk: The system utilizes facial recognition technology to identify individuals. Under the EU AI Act, biometric identification systems are classified as High Risk due to their significant implications for fundamental rights and privacy.
The primary function of the Tag Suggestions tool is to perform facial recognition on uploaded photos to suggest user tags.
The report provides clear, unambiguous details regarding the legal settlement, the specific AI system involved, the developer, and the nature of the privacy violation.
None.
Technology
Automatic Facial Recognition
Scanned user photos to suggest tags using facial recognition algorithms.
Biometric Data Storage
Stored biometric templates of users' faces without obtaining proper consent.
Data Inputs
Unconsented Photo Scanning
Processed biometric details directly from uploaded user photographs.
Human Factors
Passive User Acceptance
Users left default settings enabled without understanding the privacy impact.
Process and Methods
Default-On Activation
Enabled facial recognition by default for all users instead of as an opt-in.
Opaque System Disclosures
Did not transparently explain facial recognition tech to users until 2018.
Management
Slow Policy Shift to Opt-In
Took years to transition the facial recognition platform to opt-in only.
Regulatory Environment
BIPA Legal Requirements
Failed to comply with Illinois Biometric Information Privacy Act regulations.
AI system involved
Identified by automated extraction; can differ from the alleged developers above.
