It seems the famous saying “what happens on your device stays on your device” does not always exempt Apple from falling under the scope of old laws! Apple is currently facing a massive class-action lawsuit in the U.S. state of Illinois that could cost it a staggering $32.5 billion. The reason? The “People” album feature in the Photos app on iPhone, iPad, and Mac devices, which uses facial recognition technology without obtaining prior written consent from users, in accordance with the local Biometric Information Privacy Act.
The Privacy Conflict and a Law Dating Back to 2008
This legal battle began in March 2020, when a group of iPhone users filed a lawsuit accusing Apple of violating the Biometric Information Privacy Act (BIPA) enacted in 2008 in Illinois. This law was passed to protect citizens from the collection of their biometric data—such as fingerprints, retinal scans, and face prints—without prior notification and explicit written consent.
The strange irony here is that when Apple launched the facial recognition feature in iOS 10 in 2016, it designed it with a strong focus on privacy; all processing is done entirely on the device itself without sending data to Apple’s servers. In fact, it initially did not even sync face data via the iCloud Photos library. However, the plaintiffs argue that the mere act of the device scanning and generating a “face print” automatically without prior written permission constitutes a clear violation of the law, regardless of data security or storage location.
How Did the Amount Reach $32.5 Billion?
The BIPA law stipulates damages of $1,000 for each negligent violation, and up to $5,000 for each intentional or reckless violation. Initially, the plaintiffs tried to expand the pool of affected parties to include everyone whose face appeared in a photo taken or stored on an Apple device within the state since 2015, which would have meant including more than 12.7 million people and pushing potential damages to the $100 billion mark!
However, Judge Nancy Rosenstengel narrowed the scope of the class action to only include Illinois residents who own Apple devices and have actually used the facial recognition feature since the launch of iOS 10 in September 2016. Despite this narrowing, the remaining group is estimated at about 6.5 million users, which could bring the maximum financial penalty to $32.5 billion.
Practically speaking, class-action lawsuits against tech companies rarely reach a trial and jury verdict to enforce the maximum legal penalty. Large companies like Meta and Google have faced similar cases under the same law, ending in much smaller financial settlements; Facebook paid $650 million, Google $100 million, and Instagram $68.5 million, providing affected users with amounts ranging between $32.5 and $397 per person.
It is highly expected that Apple will follow the same path and move toward a legal settlement in the hundreds of millions to avoid the risk of a multi-billion dollar fine. It is also expected that Apple will add an explicit consent screen for the “People” album feature in future iOS updates for residents of the state. The real battle here boils down to the clash between old laws drafted in an era when on-device intelligent processing did not exist alongside modern protection technologies.
Source:
Leave a Reply