On Monday, Facebook's parent company, Meta Platforms Inc. (Facebook), was sued by the Texas attorney general for violating Texas's Capture or Use of Biometric Identifier Act (CUBI) in Texas state court. The lawsuit seeks hundreds of billions of dollars based on Facebook's practice of collecting facial geometry information from photographs posted on its social media site. In dramatic tones, the State of Texas alleges that Facebook's "omnipresent [social media] empire was built on deception, lies, and brazen abuses of Texans' privacy rights—all for Facebook's own commercial gain." The lawsuit also alleges that Facebook's conduct put its users' "most personal and valuable possessions—records of their facial geometry—at risk from hackers and bad actors, all to build an AI-powered virtual-reality empire."
CUBI provides, among other things, that an entity collecting biometric information must: (a) obtain informed consent before capturing an individual's biometric information; (b) not disclose biometric information to third parties (with limited exceptions, such as disclosures to law enforcement); (c) delete biometric information within a reasonable time, not to exceed one year after the purpose of the collection has been achieved; and (d) use reasonable care in handling biometric information. A violation of CUBI can result in a $25,000 penalty for each violation, and the State of Texas alleges that Facebook engaged in "billions" of violations.
The State of Texas also included within its complaint a count for violation of the Texas Deceptive Trade Practices Act (DTPA), alleging that Facebook failed to disclose that it was collecting biometric information and made false representations that it was not collecting biometric information from its users. The DTPA provides for penalties of up to $10,000 per violation. In addition to monetary relief under CUBI and the DTPA, the lawsuit seeks injunctive relief, including an order that would require Facebook to discontinue the use of biometric information previously captured without consent and destroy any biometric information that remains in Facebook's possession.
The Texas action against Facebook comes on the heels of a $650 million settlement between Facebook and a class of Illinois residents arising from Facebook's collection of facial geometry information without obtaining informed, written consent. The Texas action is a major development for companies that use biometric technologies because, to date, the most noteworthy enforcement of biometric privacy rights has come through private class action cases filed under Illinois's Biometric Information Privacy Act ("BIPA"). Unlike Illinois's BIPA, CUBI does not allow for a private right of action. Texas's case against Facebook could signal a shift to enforcement under other state laws that have long been on the books, but seen little enforcement activity. As other jurisdictions continue taking action to protect individuals' biometric privacy rights, companies that interact with biometric information must take notice to avoid either private litigation or regulatory enforcement actions like the one asserted by the State of Texas.