Facebook's $650M Biometric Settlement: The Full Story
In 2020, a class-action lawsuit over Facebook's facial recognition practices ended in one of the largest privacy settlements in tech history. Here is exactly what happened, how the payouts worked, and how I ended up receiving three separate payments from it myself.
What Was the Case?
In 2020, Facebook users in the U.S. state of Illinois filed a class-action lawsuit against Facebook, now known as Meta. The claim: Facebook had been collecting and storing biometric data — specifically facial recognition templates built from users' photos — without notifying them or asking for explicit consent.
The case ended in a settlement worth $650 million, making it one of the largest privacy settlements in the history of the tech industry.
How Did Facebook Collect Facial Recognition Data?
Facebook ran a feature called "Tag Suggestions," which kicked in automatically whenever a photo was uploaded. Upload a picture with a friend's face in it, and Facebook would suggest tagging them by name before you typed a single letter.
The problem: Facebook had been doing this since June 2011 without clear notice or consent — a direct violation of BIPA. Facebook denied any wrongdoing throughout the case, but ultimately agreed to settle rather than take it to trial.
Case Timeline
- June 2011
Facebook officially began collecting and storing biometric facial data from Illinois users as part of the "Tag Suggestions" feature.
- 2015
The first lawsuits were filed against Facebook for violating Illinois's BIPA law.
- 2020
A federal court certified the case as a class action and settlement negotiations began.
- February 2021
The court approved the $650 million settlement. Facebook agreed to pay without admitting legal liability.
- May 2022
Meta began sending payments to eligible users by mail or PayPal, ranging roughly between $200 and $400 per person.
- March 2023
A second supplemental payment of $30.61 went out to roughly 1.3 million Illinois users.
- October 2023
A third and final supplemental payment of $7.20 was sent to eligible users.
Payment Details
The settlement was not a single lump sum — it arrived in three separate phases over roughly a year and a half.
| Phase | Date | Amount Per Person | Notes |
|---|---|---|---|
| First payment | May 2022 | ~$397 | Via mail, PayPal, or check |
| Second payment | March 2023 | $30.61 | For roughly 1.3 million users |
| Third payment | October 2023 | $7.20 | Final supplemental payment |
| Total | ~$434.81 | Per eligible user | |
Who Was Eligible for Compensation?
The court defined the eligible class precisely — it was narrower than a lot of people assumed at the time:
- You were a Facebook user and a resident of Illinois.
- Facebook had actually created and stored a face template for you after June 7, 2011.
- You had lived in Illinois for at least 183 days (6 months).
- Simply having a Facebook account was not enough — Facebook had to have actually built a face template tied to you.
- Users outside Illinois were not covered, since BIPA is an Illinois-only law.
How I Personally Received a Payment — Even Though I Didn't Meet the Conditions
I shared the news back in October 2020 on Facebook so my followers could benefit from it. I own several test accounts that I use for security research — I've reported more than 11 vulnerabilities in Facebook alone — as well as for programming and app development work. One of those accounts happened to be registered to a city in Illinois.
The settlement notification landed on that account. It seems Facebook's system did not rigorously verify the accuracy of the underlying data, likely because the number of people who actually filed claims was far lower than the number of genuine affected users in Facebook's own internal figures. I used a U.S. PayPal account for the payout, since PayPal did not support Palestine at the time and my original account had been frozen for 180 days. In total, I received $434.81 across the three separate payments.
Why Does This Case Matter to You?
This case reaches far beyond the borders of Illinois — it set a legal precedent that continues to shape how technology companies handle biometric data everywhere.
The case also fed into broader legislative conversations elsewhere, including EU member states enforcing the GDPR and several countries in the Arab world that have since begun drafting their own personal data protection laws.
- Google & location tracking (2022): Google paid $391.5 million in a settlement with 40 U.S. states over tracking users' locations without their knowledge.
- TikTok & BIPA (2021): TikTok agreed to pay $92 million in a class-action settlement over collecting biometric data without consent.
- Meta & GDPR (2023): Meta was fined €1.2 billion in Europe over unlawful transfers of user data to the United States.
Frequently Asked Questions
Can I still file a claim today?
No. The claims window closed after the third supplemental payment went out in October 2023. This article is a record of the case, not an active claims guide.
Why was the payout different for every phase?
The settlement fund was distributed based on how many verified claimants ultimately came forward and how much interest and unclaimed funds remained after the first distribution — which is why the second and third payments were smaller top-ups rather than fixed amounts set in advance.
Does this affect Instagram or WhatsApp too?
The BIPA case specifically concerned Facebook's own "Tag Suggestions" facial recognition feature. It did not extend to Instagram or WhatsApp, which use separate systems and were not named in this particular lawsuit.
Who to Contact for More Information
If you are an Illinois resident and want to look into the case further, these were the parties involved: