Texas sues Meta over Facebook’s facial-recognition practices

The lawsuit, filed in state district court in Marshall by Texas Attorney General Ken Paxton, seeks civil penalties in the hundreds of billions of dollars, according to a person familiar with the matter.

In a statement, Mr. Paxton said the company’s capture of facial geometry in photographs that users uploaded from 2010 to late last year resulted in “tens of millions of violations” of Texas law.

“Facebook has been secretly harvesting Texans’ most personal information—photos and videos—for its own corporate profit,” Mr. Paxton said. “Texas law has prohibited such harvesting without informed consent for over 20 years. While ordinary Texans have been using Facebook to innocently share photos of loved ones with friends and family, we now know that Facebook has been brazenly ignoring Texas law for the last decade.”

In a statement, Meta said the claims against Facebook “are without merit and we will defend ourselves vigorously.”

Meta says that before it decided to shut down its facial recognition system, users were always provided with notice and an opportunity to consent when they used those services.

Facebook previously settled another lawsuit over its facial-recognition practices for about $650 million. That class-action suit filed in 2015 was brought under Illinois’s biometric privacy law, which is similar in some respects to the Texas law. Both laws require individuals’ consent before their biometric identifiers can be captured.

In the class-action case, Facebook’s lawyers said the Illinois law didn’t apply to its method for identifying users in photos. The company also said it had given users the ability to opt out of the feature.

Facebook’s efforts to dismiss the class-action case were unsuccessful, and the company settled the case in 2020.

The Texas lawsuit—in particular the size of the civil penalties being sought—points to the impact that increasingly widespread privacy laws could have on big tech companies’ operations.

The case shows that “states and individuals have a major role to play in privacy protection,” said John Davisson, senior counsel at the Electronic Privacy Information Center, a research and advocacy group.

“We can’t count on Congress and even the FTC [Federal Trade Commission] to be on top of every data abuse,” Mr. Davisson said. “It’s important that there be other avenues.”

After Facebook’s settlement of the Illinois class-action case became known, Texas sent its own civil subpoena to the company seeking information about the facial-recognition system. Facebook announced it was ending its facial recognition system last November.

“These procedural protections are particularly crucial in our digital world because technology now permits the wholesale collection and storage of an individual’s unique biometric identifiers—identifiers that cannot be changed if compromised or misused,” U.S. District Judge James Donato wrote in the class-action case. “When an online service simply disregards the Illinois procedures, as Facebook is alleged to have done, the right of the individual to maintain her biometric privacy vanishes into thin air.”

Texas says Facebook’s facial-recognition system ignored that state’s legal requirements for capturing users’ facial features.

“For over a decade, while holding itself out as a trusted meeting place for Texans to connect and share special moments with family and friends, Facebook was secretly capturing, disclosing, unlawfully retaining—and profiting off of—Texans’ most personal and highly sensitive information: records of their facial geometries, which Texas law refers to as biometric identifiers,” the state argues in the complaint.

The Texas law makes it unlawful to capture people’s biometric identifiers without their informed consent and prohibits sharing that information.

Unlike the Illinois law that led to the class-action suit, the Texas law can only be enforced by the state’s attorney general. The Texas law also provides for a penalty of $25,000 per violation. The complaint estimates that at least 20 million Texans were members of Facebook in 2021.

The civil subpoena issued by Texas demanded all the materials that Facebook had produced in response to the class-action lawsuit.

Facebook’s announcement that it would stop using its facial-recognition system cited public concern over the technology. “We’re shutting down the Face Recognition system on Facebook,” the company said in a blog post, explaining that it would “delete more than a billion people’s individual facial recognition templates.”

It said that “the many specific instances where facial recognition can be helpful need to be weighed against growing concerns about the use of this technology as a whole.”

Texas officials say in their suit that they are seeking to recover civil penalties for past violations of the law and that they would try to stop any future improper uses—suggesting Meta might still retain some of the facial-recognition data it collected.

“Facebook announced, in November 2021, that it would cease use of the face-recognition feature on its Facebook social-media platform,” the complaint says. “Facebook has made no such commitment with respect to any of the other platforms or operations under its corporate umbrella, such as Instagram, WhatsApp, Facebook Reality Labs, or its upcoming virtual-reality metaverse.”

In a blog post announcing that it was ending its use of facial recognition, Facebook said that it would “continue working on these technologies and engaging outside experts…[But] amid this ongoing uncertainty, we believe that limiting the use of facial recognition to a narrow set of use cases is appropriate.”

The Texas suit also says Facebook has obtained patents for systems “where consumers wandering in stores or standing at checkout counters have their faces scanned and matched with their social-networking profiles.”

Mr. Paxton brought in two outside companies—Keller Lenkner LLC and McKool Smith P.C.—to help out because the case against Meta is complex and raises technical issues, he said. The case was filed in state court in Marshall because it has become a popular choice for technology litigation, he added.

The Texas investigation itself might have slowed at least some of the facial-recognition system’s shutdown. Following the company’s announcement in early November, Texas authorities demanded that relevant data be preserved while the state investigated.

In a follow-up letter on Nov. 10, Texas officials said Facebook had confirmed that Meta “will not delete any source code related to Facebook’s Facial Recognition system,” and would “preserve all metadata related to the system” including data sufficient to identify Texas users, which users had facial recognition enabled, and which users had face templates saved.

Facebook said it believed the face templates themselves weren’t material and could be deleted, according to the Nov. 10 letter from the Texas attorney general’s office. The attorney general’s office expressed concern about that, and demanded that Meta not delete any face template information for past or present Texas residents.