For at least a decade, Illinois has had the country’s toughest biometric privacy law on the books. The Biometric Information Privacy Act (BIPA) prevents using fingerprints, iris scans and facial recognition software from being exploited for commercial purposes without an individual’s consent.
Now Google’s parent, Alphabet Inc., is trying to defang BIPA by exempting photos from its reach – an interesting move because it is facing multiple lawsuits claiming billions in damages because the plaintiffs allege the search engine violated BIPA by gathering and storing pictures of their face without permission. State Senator Bill Cunningham originally introduced legislation amending BIPA to save a nursing home in his district from litigation. Google and the Illinois Chamber of Commerce stepped in, offering a new version that would exempt photos from the law.
But this creates a conundrum for Google.

“Historically, Google has gone out of its way to give people a choice about whether they want to be in a face recognition system,” Ivaro Bedoya told Bloomberg. He is executive director of the Center on Privacy and Technology at Georgetown University’s Law Center. “Their support for this amendment would mark a complete reversal in the company’s approach to this powerful and invasive technology. It would be deeply disappointing.”
As a privacy and data security lawyer, my sense is that what Alphabet is trying to do is avoid the mountain of current and likely future lawsuits against Google filed by the state’s residents who get “tagged” and thus have their likeness stored and accessible without their consent. But along with ordinary biometric data, the right of a person to control how their photo is used lies at the heart of BIPA. To exempt facial recognition software would effectively strip the law of its most-meaningful element.

Facebook, which has its own set of problems involving the use – and misuse – of data is supporting the amendment through its membership in the Illinois Chamber of Commerce. While it disavows any involvement in the Chamber’s initiative, the social media behemoth lobbied hard in 2016 for a similar change in the law but was stymied by privacy advocates. It also failed to persuade a federal judge to dismiss a BIPA lawsuit and in July will face trial in a case brought on behalf of some 6-million users in Illinois that seeks as much as $5,000 for each BIPA violation per person.
Google Photos uses a very similar technology to that employed by Facebook, which prompted a similar lawsuit with a comparable class of plaintiffs. Yet Google is arguing vociferously that photos do not belong in BIPA, thus risking becoming known as an organization that places a higher priority on avoiding litigation than on user consent or data privacy. Changing the law might well put an end to the lawsuits.
Senator Cunningham is trying to find a compromise between Google, Facebook, other businesses and privacy advocates. He says, “It’s my goal to find a middle ground where we protect the privacy of citizens and their biometric material but do it in a way that allows people in Illinois to access technologies and applications everyone else in the country is accessing.”

Cunningham is likely referring to what may be considered by some as an unintended consequence of BIPA. Services such as Google’s Arts & Culture app, which locates museum portraits that resemble a person based on a selfie, are not available in Illinois due to the law.