Screenshot via Suzanne Kantra/Techlicious generated by ChatGPT
A federal judge in Illinois has certified a class-action lawsuit against Apple that could expose the company to as much as $32.5 billion in damages, on behalf of an estimated 6.5 million Illinois iPhone users. The case, Doe v. Apple Inc.(PDF), accuses Apple's Photos app of automatically scanning faces in a user's photo library and building a biometric identifier called a faceprint, without first getting consent.
Photos has long included a "People" feature that automatically groups pictures by who's in them, scanning faces across a user's library and clustering similar ones together so search and memories work without manual tagging. The lawsuit alleges that process creates and stores a faceprint for each person, then syncs that data across a user's devices through iCloud, all without the specific consent Illinois law requires for biometric data.
Read more: Amazon Photos makes it easy to find old photos with natural language search
That law is the Illinois Biometric Information Privacy Act (BIPA), a 2008 statute that requires a business to get written consent before collecting biometric identifiers such as fingerprints, iris scans, voiceprints, or face geometry, and to publish a policy for how it stores and eventually destroys that data. Violations carry damages of $1,000 each, or $5,000 if a court finds the violation was intentional or reckless. In a case such as this, covering millions of people, that can add up to a multibillion-dollar figure on paper.
Illinois' privacy law has produced large settlements before. Facebook paid $650 million in 2021 to resolve a BIPA case over its own photo-tagging feature, and Google has faced similar claims tied to its photo services, which resulted in a $100 million payment.
Apple has argued the process doesn't meet the legal definition of a biometric identifier, saying the data it uses to organize photo albums can't be used to reconstruct a face and isn't linked to a person's name or Apple ID. That argument hasn't gotten the case dismissed, and it will now play out with the class-action label attached.
