Microsoft Photos App Facial Recognition Technology Illinois Class Action

Microsoft Corporation makes Windows operating systems, including Windows 10 and Windows 11, which each has Microsoft’s “Photos” application. The complaint alleges that the Photos application applies facial recognition technology to faces in photos, including to those of persons in Illinois, and that Microsoft’s use of this technology violates the Illinois Biometric Information Privacy Act (BIPA).

The class for this action is all individuals whose facial biometric identifiers or biometric information were collected, captured, stored, transmitted, disseminated, or otherwise used by Microsoft within Illinois at any time within the applicable limitations period.

The Microsoft Photos application’s facial recognition technology, the complaint alleges, “automatically identifies images that feature people and determines certain characteristics about the individual in the images, such as their facial expressions.” The complaint says it also “has the ability to automatically recognize a specific person’s facial characteristics and find and group together all images featuring that specific person.”

BIPA covers residents of Illinois. “However,” the complaint claims, “while [Microsoft’s] Photos application obtains the facial biometrics of Illinois residents … from computers located in Illinois, [Microsoft has failed to comply with BIPA’s regulations and does not obtain individuals’ consent to gather their facial biometrics.”

Microsoft invites Photos users to “search to find a specific person, place, or thing. The app recognizes faces and object in images and adds tags to help you find what you need without endless scrolling. For example, try searching for ‘beach,’ ‘dog,’ or ‘smile,’ or select a face shown in the search pane to see all the photos that person is in.”

Biometrics are unlike other forms of identification. If a credit card number is stolen, the person can cancel the card and get another one, with a new number. But if fingerprints are stolen, the person cannot get another set of fingers with new prints.

Under BIPA, businesses that want to take, store, or use biometrics must do certain things:

• They must inform the subject in writing that biometrics will be collected or stored.
• They must inform the subject in writing of the particular purpose of the biometrics collection and length of time for which the information will be collected, stored, or used.
• They must obtain a written release from the subject permitting them to collect the biometrics.
• They must put out a publicly-available retention policy for permanently destroying the biometrics, either when the original purpose has ended or within three years of the subject’s last interaction with the business, whichever comes first.

The complaint alleges that Microsoft has not done these things.

Article Type: Lawsuit
Topic: Privacy
Tags: BIPA, Biometric Data, Taking/Storing/Using Biometric Data, Your Privacy