By: Douglas DeBettencourt
Google is in trouble again for allegedly violating the privacy rights of millions of Illinois residents through different YouTube features that supposedly store their data. In Marschke v. YouTube LLC, Brad Marschke brought a class action suit against YouTube, which is owned by Google, alleging that YouTube had violated Illinois’ Biometric Information Privacy Act (“BIPA”) by storing, collecting, and using biometric facial data without the user’s knowledge or consent. Marschke is alleging that faceprints are stored through YouTube’s facial blur and thumbnail image features without going through the proper steps to obtain consent from the users. Given the importance of biometric data, the storage and usage of this data will continue to be a topic of importance until people feel their data and rights are being protected.
Currently, there are no federal statutes that regulate the collection of biometric data. In 2008, Illinois enacted BIPA which was the first state statute to regulate how people’s biometric information could be used. BIPA creates a private cause of action for any violations of the statute to protect people from non-consensual capturing and storing of their biometric data through different identifiers. BIPA defines biometric identifiers as retina or iris scans, fingerprints, voiceprints, or scans of hands or face geometry. The main provisions in BIPA require that people are informed in writing that their biometric data is going to be collected before it occurs, and that if it is collected, that the purpose and length of time the data is being obtained be disclosed to the individual. This is what Marschke alleges YouTube’s facial blur and thumbnail image features are violating.
YouTube’s facial blur is used to blur certain people’s faces during the editing of videos. The feature uses, “state-of-the-art facial recognition technology to scan videos, locate human faces and create and store scans of face geometry.” Each face is assigned a “Face ID” which is used to blur out faces by matching the Face ID to the facial geometry that is captured and stored on YouTube’s servers.
The other feature in question is YouTube’s automatic thumbnail image generator. This feature scans videos for faces (particularly more expressive faces) and uses that facial data to create a thumbnail image for the video. According to the suit, the purpose of this feature is to generate more clicks on the video, since faces tend to get more attention, clicks, and sharing. The amount of time the facial data is being stored for is allegedly unknown.
In the current case, Marschke accuses YouTube of violating BIPA through both of these features and seeks to recover $1,000 for each negligent violation and $5,000 for every intentional and reckless violation. The suit alleges that YouTube is not getting consent to gather people’s faceprints and that this data is being stored for an unknown period of time. Marschke’s legal team has also conducted tests of the thumbnail feature to bolster some of their claims. According to the suit, Marschke’s lawyers posted three one-minute videos on YouTube that only had a face in it for less than two seconds. YouTube “automatically generated thumbnail images using the faces and made them the primary thumbnail image for the video, despite their brief appearances.” Marschke argues this is evidence that YouTube’s thumbnail generator is using software to detect faces.
Although some people have made the comparison of these types of cases to incidents of stolen social security numbers or even credit cards, they are not the same. According to BIPA, “[b]iometrics are unlike other unique identifiers that are used to access finances or other sensitive information. For example, social security numbers, when compromised, can be changed. Biometrics, however, are biologically unique to the individual; therefore, once compromised, the individual has no recourse and is at heightened risk for identity theft.” Statutes like BIPA were enacted to create a private cause of action for people whose biometric data was being improperly used or stored. This is an important way to give power back to the individuals so they can hold big tech companies accountable when dealing with sensitive data.
Some supporters of tech companies using biometric data have argued that the collection of biometric data is protected under basic contract law, and that when people sign up for these services, they are consenting to this information being used and stored in exchange for using the platform. However, this theory does not apply if the current allegations are true. Marschke alleges that YouTube, while saying they store data for a short period of time, is potentially storing data permanently. If true, this would violate the original agreement. Furthermore, this contract theory would only apply to parties in privity, that is YouTube and the users, and would not necessarily justify the use of biometric data by third parties.
Whether the allegations in this case are true or not, states and citizens need to continue to crack down on big tech companies and the secret practices they use for collecting and storing data, especially biometric data. Google already has a history of violating BIPA and recently agreed to pay $100 million to settle claims about the Google Photos service which was illegally storing faceprints as well. This seems to be an Orwellian trend for many big tech companies like Google who cannot seem to abide by data privacy laws. The danger, though, is that if compromised, there is no way to get a new face print as if it were a credit card. Since this information is so permanent and personal, people need to continue to bring suits of misuse to highlight the biometric data practices of these companies in a public forum.
Student Bio: Douglas DeBettencourt is a second-year day student at Suffolk University Law School. He serves as a staff member for the Journal of High Technology Law, a fellow in the Marshall-Brennan Constitutional Literacy Project, and President of Suffolk University Law School’s Chapter of the Federalist Society. Douglas received a Master of Science Degree and Bachelor of Science Degree in Criminology and Criminal Justice with a minor in Mathematics from the University of Tampa.
Disclaimer: The views expressed in this blog are the views of the author alone and do not represent the views of JHTL or Suffolk University Law School.
