Apple faces a $32.5 billion lawsuit over how its Photos app scans and stores faces. A federal judge cleared the case to proceed as a class action late last month, allowing millions of Illinois iPhone owners to join.
The case has been years in the making, and Apple has fought to shut it down at nearly every turn. Now it heads back to the court, with the company’s privacy practices on trial.
Inside the Apple Photos lawsuit
The Apple Photos lawsuit centers on the app’s People album, which groups pictures based on faces in them. Plaintiffs say the feature allows Apple to build a unique “faceprint” for people who appear in the Photos libraries – including people who don’t even own an iPhone. And once enough images pile up, the software allegedly uses an algorithm to match stored faceprints to the device owner. This data then gets stored directly on the iPhone in the Photos app.
The lawsuit claims this information syncs across devices via iCloud, which happens whenever a user signs in using their Apple Account, and that the company has also started storing faceprints directly on its own servers for some users.
Court records have shown that the update applies to users with iCloud Photos turned on. Those accounts also need to use at least 10GB of storage and contain at least 5,000 photos and videos. Plaintiffs say all this amounts to collecting biometric data without consent, putting Apple squarely at odds with Illinois law.
Apple’s defense, and what the judge said
Apple has pushed back, saying the numerical vectors used to sort photo albums cannot be used to re-create a face. The company added that it doesn’t have access to the vector data, nor can it be used to tie it to a user’s name.
Despite those arguments, a judge ruled last month that the case meets the requirements for a class action. The ruling allows the lawsuit to proceed on behalf of three groups of Illinois residents.
The biggest group covers roughly 6.5 million people. A smaller iCloud group adds about a million more. The third group, tied to the newer server-side feature, could add another 2.6 million people.
Apple had asked for permission to appeal the decision, but the request was denied. This cleared the way for the case to head back to the district court.
“The allegation that Apple created faceprints of people appearing in photos, including children, and stored those faceprints on its cloud-based servers — without obtaining consent or telling device users what it was doing — raises serious privacy concerns,” Andrew Schlichter, lawyer for the plaintiffs, told British publication The Times. “We are pleased with the court’s decision to certify a class, which means that Apple will have to answer for its alleged conduct as to all affected Illinois citizens.”
The law behind the billion-dollar number
On its website, Apple outlines the Photos app’s ability to recognize people and pets, making it easy for users to find images of friends, family members and fur babies.
“The Photos app scans your photos to help you quickly recognize the people, scenes, and objects within the photos. And in iOS 17, iPadOS 17, and later, the Photos app can recognize dogs and cats, too,” Apple says. “Depending on the number of photos that you have, you can watch a Memory movie of them. And when you have iCloud Photos turned on, the people you favorite or name stay up to date across your Apple devices.”
The Apple Photos lawsuit relies on Illinois’ Biometric Information Privacy Act. Passed in 2008, the law covers fingerprints, iris scans, voiceprints and face geometry. It requires companies to obtain written consent before collecting this kind of data from state residents.
Violations carry a fine of $1,000 each, which increases to $5,000 if the court finds the behavior was intentional or reckless. Multiply the top figure by 6.5 million potential class members, and Apple’s worst-case exposure lands somewhere around $32.5 billion.
The law already proved costly for other tech companies. Facebook paid $650 million in 2021 to settle a similar lawsuit, and Instagram paid $68.5 million in 2023 over its biometric data practices.
Plaintiffs filed the case in the U.S. District Court for the Southern District of Illinois (case number 3:20-cv-00421-NJR). The lawsuit was originally filed in Illinois state court in March 2020, before Apple moved it to federal court.
