A $32.5 billion class-action lawsuit involving the Illinois Biometric Privacy Act and iPhone Photos has been pared down, with the judge partially granting an Apple motion for summary judgment and decertifying one subclass.
In August, a lawsuit surfaced alleging that Apple violated the Illinois Biometric Privacy Act (BIPA). It was claimed that Apple collected biometric data without user consent, via the Photos app.
However, in a September 30 filing by U.S. District Judge Nancy Rosenstengel, the class-action fight has been severely cut back. In a 34-page filing, the judge partially agrees with an Apple motion, while decertifying one of the subclasses in the suit.
The original lawsuit alleges that Photos uses facial recognition technology to scan people's faces and create a "faceprint." With enough samples, the faceprint is enough for an algorithm to identify the iPhones user and other people, which is then stored by the Photos app.
The real problem is that the photos and associated data is synchronized across devices using iCloud. Since this faceprint is thought to be biometric data, it theoretically goes against BIPA.
Apple moved for a summary judgment to be made, on the argument that it neither collects nor possesses any biometric identifiers nor biometric information. The plaintiffs, led by a "Jane Doe," also wanted a partial summary judgment about Apple's liability on the matter.
The result was that, while Apple's motion was mostly denied, it did succeed in relation to something called "Face Crops."
BIPA
A state law that came into force in 2008, BIPA is intended to regulate how biometric information is used by private companies. This includes fingerprints, retina and iris scans, voiceprints, and faceprints, which companies need to get consent to use, or sufficiently disclose their use.
Companies must also store them securely and destroy them in a timely fashion.
This is not the first time the law has been used against big-tech companies, with both Facebook and Google hit by it. In 2021, Facebook paid out a $650 million settlement to end its lawsuit.
Apple argued that faceprints should not qualify as biometric identifiers under BIPA in its case, due to how its system functions. It uses a neural network to analyze pixels, rather than measuring the physical geometry of someone's face.
The plaintiffs disagreed, insisting that the neural network learns facial characteristics, including geometric relationships. These are then used to identify individuals.
The judge agreed with the plaintiffs to a point, saying there was enough evidence for a jury to potentially agree. The previous Facebook lawsuit was cited, in that the law doesn't limit the types of measurements used for facial geometry scans.
Apple also argued that Photos simply groups images that contain the same faceprint together, rather than outright identifying a person or establishing an identity. The court believed there was enough evidence that they could be used for identification purposes.
Neither side really won or lost here, as the judge granted Apple's motion in part, but denied others.
Cropped faces
One area that Apple did succeed in was Apple's use of face crops. These are images that are created by Apple's face detection algorithm, which Apple insists does not map coordinates of the user's face.
Facial landmark information does get used, but only to determine the coordinates and size of a bounding box to create the best "crop" of the image. The resulting crop is just an image, with no further landmark details.
Apple Photos can even identify pets for use in Memories.
The plaintiffs didn't really dispute those facts, but asserted the detection algorithm uses geometric information about the location of the face in the image. At that point, facial features are used to adjust the bounding box.
The Court sided with Apple, as the location of a face in a photograph doesn't say anything about that face's geometry. Therefore, it granted summary judgment on that point of argument.
Face data collection
Apple argued that it did not collect or possess biometric information under the terms of the law, because of local processing and encryption. Aside from any data stored on an iPhone, faces uploaded to a user's iCloud account is not accessible to Apple, because it is encrypted.
The judge rejected that interpretation on numerous factors. That includes how Apple can determine how faceprints are created, as well as how they are stored and secured.
It is viewed that Apple can upload faceprints to iCloud under specific circumstances, but control is the issue. There's a difference between being able to access and use data, and simply holding it.
The judge gives an example in the form of hieroglyphic scripts, which were not understood for centuries until a breakthrough was made with the Rosetta Stone. The argument is that scholars were able to possess ancient artifacts without necessarily knowing what they said.
Since Apple possesses the data on iCloud, even in encrypted form, there's still an expectation of a level of control over it.
There's also the ever-present threat of Apple changing its encryption processes, allowing it to have free access to the data in the future. As such, the court shut down encryption as a defense strategy here.
Class changes
For Apple, the filing means the lawsuit can roll on, though it has managed to poke a few holes.
In its conclusion, the Court decertified the iCloud Subclass, one of the three involved in the suit. This was a class of Illinois residents whose Photos' People album was associated with iCloud and had identifying labels.
The Local Device Subclass was made up of residents whose photographs were in the People album, since 2016. That class remains certified.
The third iCloud Faceprint Subclass involves residents whose faceprints were uploaded to iCloud under the newer synchronization system since July 2024. For the moment, the class remains, pending revisions on class notices.
To Apple, this is not a complete loss. It still has to face the lawsuit as it proceeds through the system, and it will have to rethink some of its arguments when it comes to encryption, data possession, and BIPA in general.
However, to the industry at large, the lawsuit could impact how companies use facial recognition and similar features in the future, as well as how that data is handled.
