๐ What Was the Case?
In 2020, Facebook users in the U.S. state of Illinois filed a class-action lawsuit against Facebook (now known as Meta). The reason: Facebook had been collecting and storing biometric data โ specifically facial recognition templates โ from users' photos without notifying them or obtaining explicit consent.
The case ended in a landmark settlement worth $650 million, making it one of the largest privacy settlements in the history of the tech industry.
๐ How Did Facebook Collect Facial Recognition Data?
Facebook offered a feature called "Tag Suggestions", which appeared automatically whenever a photo was uploaded to the platform. When you uploaded a photo containing a friend's face, Facebook would automatically suggest "tagging" them by name.
The problem was that Facebook had been doing this since June 2011 without any clear notice to users and without obtaining their consent โ a direct violation of Illinois's BIPA law. Facebook denied all wrongdoing, but ultimately agreed to settle.
๐ Case Timeline
- June 2011
Facebook officially began collecting and storing biometric facial data from Illinois users as part of the "Tag Suggestions" feature.
- 2015
The first lawsuits were filed against Facebook for violating Illinois's BIPA law.
- 2020
The major class-action lawsuit: a federal court certified the case as a class action and settlement negotiations began.
- February 2021
The court approved the $650 million settlement. Facebook agreed to pay without admitting any legal liability.
- May 2022
Meta (Facebook) began sending payments to eligible users via mail or PayPal, ranging between $200 and $400 per person.
- March 2023
A second supplemental payment of $30.61 was sent to approximately 1.3 million Illinois users.
- October 2023
A third and final supplemental payment of $7.20 was sent to eligible users.
๐ฐ Payment Details
The settlement was not paid out in a single lump sum โ it came in three phases:
| Phase | Date | Amount Per Person | Notes |
|---|---|---|---|
| First Payment | May 2022 | ~$397 | Via mail, PayPal, or check |
| Second Payment | March 2023 | $30.61 | For ~1.3 million users |
| Third Payment | October 2023 | $7.20 | Final supplemental payment |
| Total | ~$434.81 | Per eligible user | |
โ Who Was Eligible for Compensation?
The court precisely defined the class of eligible claimants as follows:
- โYou were a Facebook user and a resident of Illinois
- โFacebook had created and stored a face template for you after June 7, 2011
- โYou had lived in Illinois for at least 183 days (6 months)
- โSimply having a Facebook account was not enough โ Facebook must have actually built a face template for you
- โThe settlement did not cover users outside of Illinois (BIPA is an Illinois-only law)
๐งโ๐ป How I Personally Received a Payment โ Even Though I Didn't Meet the Conditions!
I shared the news in October 2020 on Facebook so my followers could benefit. I own several test accounts that I use for security research โ I've discovered more than 11 vulnerabilities in Facebook alone โ as well as for programming and app development purposes. One of those accounts was registered to a city in Illinois.
The settlement notification arrived on that account. It appears Facebook's system did not rigorously verify the accuracy of the data, possibly because the number of people who actually filed claims was far lower than the number of genuine victims according to Facebook's internal figures.
I used a U.S. PayPal account (since PayPal did not support Palestine at the time and my original account had been frozen for 180 days). In total, I received $434.81 across three separate payments.
๐ Why Does This Case Matter to You?
This case goes far beyond the borders of Illinois โ it set an important legal precedent that is changing how technology companies handle our biometric data.
The case also opened the door to serious legislative discussions in other countries, including EU member states that enforce the GDPR, and several Arab countries that have begun drafting personal data protection laws.
- โขGoogle & Location Tracking (2022): Google paid $391.5 million in a settlement with 40 U.S. states for tracking users' locations without their knowledge.
- โขTikTok & BIPA (2021): TikTok agreed to pay $92 million in a class-action settlement for collecting biometric data without consent.
- โขMeta & GDPR (2023): Meta was fined โฌ1.2 billion in Europe for unlawfully transferring user data to the United States.
๐ How to Inquire If You Were Among the Eligible Claimants
If you are an Illinois resident and want to learn more, you can contact the following parties: