This article is educational and does not constitute legal advice. Consult a qualified attorney for advice specific to your situation.
In February 2021, Facebook agreed to pay $650 million to settle a class action lawsuit brought under Illinois’ Biometric Information Privacy Act. The allegation: Facebook’s “Tag Suggestions” feature had been scanning users’ faces in uploaded photos to suggest names — without written consent — since at least 2011. Six million Illinois residents were eligible for approximately $200 each, making it the largest BIPA settlement ever reached at that point. The feature had been running quietly for years. Facebook called it a convenience tool. Illinois law had a different interpretation, and a federal court agreed.
The number is worth sitting with. $650 million. Not for a data breach. Not for leaked health records. It was for face geometry: measurements extracted from photos to recognise a person, collected without asking.
The short answer: Your face, voice, and fingerprints are “biometric data,” a category the law treats as especially sensitive. Your rights depend heavily on where you live. Illinois’s BIPA is the strongest US law and lets individuals sue directly. GDPR (EU and UK) treats biometrics as “special category” data needing explicit consent. Most other US states have weak or no biometric-specific protection. Practical steps at the end let you find and delete face templates regardless of your location.
What is biometric data?
Biometric data is information derived from your physical or behavioural characteristics that can uniquely identify you. Under Illinois BIPA (740 ILCS 14), the statutory definition is broad. It covers retina or iris scans, fingerprints, voiceprints, and scans of hand or face geometry. It also covers any “identifier based on an individual’s biophysical characteristics.” Under GDPR Article 9, biometric data processed to uniquely identify a natural person is “special category” data. That is the same tier as health records, political opinions, and information about sexual orientation.
That classification is not symbolic. It triggers specific legal requirements: explicit consent, prohibition on processing without a lawful basis, mandatory data minimisation, and, in practice, a higher bar for litigation damages when breached. The EU chose to put biometric data alongside health data deliberately. Biometrics are permanent. You can change your password, cancel a credit card, and move house. You cannot change your iris, your face geometry, or the shape of your fingerprint ridges.
A facial recognition template — the numerical representation of your face’s spatial measurements — is not the photo itself. It is derived data, a mathematical fingerprint of your face. BIPA and GDPR both regulate the template, not just the underlying photograph. This distinction matters because companies frequently argue that “we only store photos” while building recognition systems on top of them.
Can I sue under BIPA? Illinois set the standard, and it has teeth
The Illinois Biometric Information Privacy Act, passed in 2008, remains the most enforceable biometric privacy law in the United States. What makes it different from most privacy legislation is the private right of action — any individual can sue without needing to prove actual harm. The statute sets out:
- Written notice before collecting biometric data, explaining what is being collected and why.
- Written consent signed or electronically agreed to before collection begins.
- A published retention policy stating how long data will be held and the criteria for destruction.
- Prohibition on profiting from biometric data — selling it, leasing it, or trading it.
- Mandatory destruction when the purpose for collection is complete, or within three years, whichever comes first.
Violate these requirements negligently: $1,000 per person per violation. Do it intentionally or recklessly: $5,000. In a class action with millions of class members, the arithmetic moves fast.
BIPA has been applied well beyond social media. Six Flags Entertainment faced a lawsuit over fingerprint scanning used to process season pass holders entering parks — the plaintiff, a 14-year-old minor, hadn’t provided written consent. The Illinois Supreme Court ruled in 2019 that each separate scan was a discrete BIPA violation, not just the initial collection, multiplying potential damages significantly. Factory floors using fingerprint time clocks have faced multiple class actions from employees who were never given the required written disclosure. Healthcare providers using palm vein readers for patient identification have been sued under the same statute. The law does not distinguish between a tech company and a manufacturing plant — if you collect biometric identifiers in Illinois without written consent, you are exposed.
The Facebook settlement worked out to about $200 per class member. The $650 million fund was divided among roughly 1.6 million claimants who submitted valid claims, out of the six million eligible. Not everyone claimed. That is a consistent pattern in privacy settlements: most eligible people never file. The payout for those who do claim ends up meaningfully larger as a result.
Clearview AI: what happens in the absence of regulation
Clearview AI built a facial recognition database by scraping more than three billion photos from public internet sources. The scraped sources include Facebook profiles, LinkedIn pages, Instagram accounts, news sites, and mugshot databases. The resulting system lets a customer upload a photo of an unknown person’s face. It then returns a list of potential matches, each linked back to the source page where the photo appeared. Clearview sold access primarily to US law enforcement agencies, with some international clients.
The company’s legal argument is simple: public photos are public data. If you posted a photo on a platform whose terms of service allow indexing, Clearview argues it had every right to index it. This argument has not fared well where there is a statute specifically addressing the collection of biometric identifiers.
The Illinois Attorney General sued Clearview in May 2022. The claim: Clearview had violated BIPA’s ban on collecting biometric data without written consent. In a settlement announced in May 2024, Clearview agreed to stop selling database access to private entities for use against Illinois residents. It also agreed to stop selling access to Illinois-based businesses. The settlement did not require Clearview to delete the Illinois data it had already collected, and the company continues to operate.
The FTC reached a separate settlement with Clearview in May 2023 over deceptive practices. It required deletion of data from non-law-enforcement clients and limited future commercial use. But it imposed no financial penalty and did not directly restrict the facial recognition database itself.
Clearview is instructive precisely because it shows what is legally possible when a company operates mostly in states without biometric-specific statutes. In the 40-plus US states that have no equivalent to BIPA, scraping public photos to build a recognition database is effectively unregulated. The law caught up in Illinois. Elsewhere, it has not.
GDPR and what “explicit consent” actually requires
GDPR Article 9 prohibits processing biometric data to uniquely identify natural persons unless one of ten narrow bases applies. In practice, for consumer services, the relevant basis is explicit consent. And explicit consent under GDPR is substantially more demanding than a buried checkbox in a terms-of-service update.
Explicit consent must meet five conditions. It must be freely given (the service cannot be withheld for refusing). It must be specific to the particular processing purpose. It must be informed (you must know what you are consenting to). It must be unambiguous (a genuine affirmative action, not silence or pre-ticked boxes). And it must be separate from other consents. A single “I agree to our privacy policy” does not cover biometric collection. The European Data Protection Board’s 2022 guidelines on facial recognition in social media make this clear. Consent to use a photo-tagging feature is not the same as consent to generate and store a biometric template of your face. These are legally distinct processing activities that need distinct consent.
Supervisory authorities have enforced this. In August 2019, Sweden’s Data Protection Authority (Datainspektionen) fined a school in Skellefteå 200,000 SEK (approximately €20,000). The school had used facial recognition to track student attendance, with no valid legal basis for processing minors’ biometric data. The amount was modest, but the principle was unambiguous: convenience and operational efficiency are not lawful bases under Article 9.
The UK Information Commissioner’s Office issued Clearview AI an enforcement notice in May 2022. It ordered the company to stop collecting data on UK residents, delete existing UK data, and stop giving UK customers access to the system. The ICO also imposed a fine of £7.5 million (later contested on appeal, which Clearview challenged extensively). The key legal finding was clear. Clearview had collected UK residents’ biometric data without their knowledge, without a lawful basis, and without any meaningful way for affected individuals to exercise their rights.
Which US states protect your biometric data?
Illinois remains the gold standard because it is the only state with a private right of action for biometric violations. Texas passed its Capture or Use of Biometric Identifier law in 2009. It is structurally similar to BIPA but contains no private right of action. Enforcement is left entirely to the state Attorney General, which historically reduces the number of cases pursued.
Washington’s My Health My Data Act, signed in April 2023, covers biometric data in healthcare contexts and includes a private right of action. But its scope is narrower than BIPA. Colorado, Connecticut, and Virginia have comprehensive privacy laws with biometric data provisions. These include rights to access, correct, and delete biometric data, plus opt-out rights for certain uses. But they do not impose BIPA’s pre-collection consent and notice requirements. And none of them lets individuals sue without proving harm.
California’s Consumers Legal Remedies Act and CCPA provide some biometric protections, but enforcement requires documented harm or AG action. Several California municipalities — San Francisco, Oakland, Berkeley — have banned facial recognition use by local government agencies. Massachusetts has similar prohibitions on police use. These moratoriums address government surveillance specifically; they do not govern private companies.
The practical consequence is that your legal position depends almost entirely on your ZIP code. An Illinois resident has meaningful private enforcement rights that a Texas resident sitting at the same desk, buying from the same platforms, does not.
What you can do now
If you are in Illinois: you have direct legal recourse. If an employer, retailer, gym, or other business collected your fingerprints, facial scans, or voiceprints without first giving you written notice and obtaining written consent, that is a BIPA violation. Several law firms specialise in BIPA class action work — a search for firms with active BIPA dockets in Chicago will surface them. The most common unaddressed violations are workplace time-clock systems using fingerprint or facial recognition. Many employers implemented these systems without understanding their BIPA obligations.
If you are in the EU or UK: submit a Subject Access Request to any company you believe holds biometric data on you. Under GDPR Article 15 and UK GDPR, they have one month to respond. If the company has generated a biometric template from your face — even from publicly sourced photos — that is personal data you are entitled to request. Article 17 gives you the right to request deletion where the processing lacked a valid legal basis. The ICO has a template for submitting complaints about organisations that ignore or refuse deletion requests.
Across all platforms: go into your social media account settings and look for any facial recognition or “face recognition features” setting. Instagram, Facebook, and LinkedIn have all offered these in various forms. Disable them where they exist. If a platform has already generated face templates, request deletion through the data settings page or a formal deletion request. Facebook (now Meta) specifically lets you view and delete your face recognition data in its data settings.
For anyone: be deliberate about photo tagging. A photo tagged with your full name on a public or semi-public profile teaches any system scraping that platform to associate your face geometry with your identity. Audit who can tag you in photos. Review and remove existing tags on your own profile. The tagged photos may remain, but removing the tag stops your name being linked to the face for scraping purposes.
Run a periodic reverse image search using a recent photo of yourself. Services such as Google Images, TinEye, and Yandex Images index differently and cover different parts of the web — running all three takes under ten minutes. If your face appears on a site where you did not post it, that site may have a removal request mechanism. If it does not, and the site operates under EU or UK jurisdiction, a GDPR deletion request to the site operator is your next step.
Check people-search data brokers. Sites such as Spokeo, Whitepages, BeenVerified, and their equivalents often aggregate social media profile photos alongside name, address, and phone number records. Many pull from platforms you have used. That ties your face to your identity across databases you never opted into. Most brokers have opt-out processes. They are deliberately tedious, but they work.
The regulatory direction
The EU AI Act passed in 2024, with provisions taking effect in stages through 2026. It classifies real-time remote biometric identification in publicly accessible spaces as a “prohibited AI practice” when used by law enforcement. The exceptions are narrow: targeted searches in serious criminal matters, subject to judicial authorisation. Private employers using workplace biometric systems face classification as “high-risk AI.” That triggers conformity assessments, registration requirements, and mandatory transparency with affected workers. This is the first legislation to frame biometric AI as a category requiring pre-deployment risk assessment rather than post-breach accountability.
In the US, the National Biometric Information Privacy Act would create a federal version of Illinois BIPA. It has been introduced in Congress multiple times, most recently in 2023. It has not passed. The state-level patchwork is the operative legal reality, and for the foreseeable future, Illinois residents will continue to have rights that residents of most other states do not.
The Facebook settlement happened because Illinois residents had a law that let them sue. The Clearview cases happened because Illinois and the ICO had specific statutory authority to act. The pattern repeats: where specific biometric statutes exist, enforcement follows. Where they do not, the collection continues.
Your face is a permanent identifier. The laws protecting it are not permanent — they were written, amended, and can be changed. The gap between where enforcement exists and where it does not is large, and it is not shrinking quickly.
See what a scan finds → walks through an example report of the kinds of personal data brokers expose. KnytX Shield isn’t live yet; join the waitlist to run your own scan at launch.