Privacy & Information Security Law Blog

On June 17, 2024, the United States Court of Appeals for the Ninth Circuit issued an opinion in Zellmer v. Meta Platforms, Inc., No. 22-16925, (9th Cir. June 17, 2024) affirming the Northern District of California’s order granting summary judgment in favor of Meta and dismissing the action for lack of standing. Clayton Zellmer, an individual who had never used Facebook, brought claims against the social media company under the Illinois Biometrics Information Privacy Act (“BIPA”), alleging that Meta had improperly obtained his biometric data from photos Zellmer’s friends had uploaded to the platform. Zellmer alleged that Facebook’s “Tag Suggestions” feature, which created a “face signature” using photos of Zellmer, violated Sections 15(a) and 15(b) of BIPA by collecting, using, and storing his biometric identifiers without first obtaining his written consent or establishing a public retention schedule. On appeal, the Ninth Circuit held that “face signatures” are not biometric information or identifiers, and thus are not subject to BIPA.

When Facebook users enable the platform’s “Tag Suggestions” feature, Meta analyzes whether the user’s Facebook friends are in photos uploaded by that user. If there is a match, Meta suggests the user “tag” his or her friend. During this process, Meta first analyzes the photo to determine if it includes any human faces, then produces a cropped image of each face it finds. Second, it standardizes each of these cropped images by centering and scaling them. During the third step, which was the focus of this appeal, Meta creates a “face signature,” a string of numbers that represents a particular image of a face. In the fourth and final step, Meta compares the face signature with “face templates” of Facebook users who have both enabled face recognition and are connected to the user who uploaded the photo. Regardless of whether the comparison yields a match, the face signature is immediately deleted.

In March 2022, the District Court granted summary judgment to Meta on Zellmer’s Section 15(b) claim, finding that this provision of BIPA, which requires entities to secure written consent before obtaining a person’s biometric information, did not protect the privacy interests of non-users like Zellmer. The District Court initially denied Meta summary judgment on Zellmer’s Section 15(a) claim, finding that Meta’s arguments about how face signatures were created and stored involved factual disputes to be resolved at trial. However, a few months later, the District Court dismissed the remaining claim for lack of Article III standing, finding Zellmer failed to allege he suffered any concrete and particularized harm due to Meta’s alleged failure to develop a written policy or establish a retention schedule for biometric information.

The Circuit Court reviewed the District Court’s rulings de novo and affirmed on different grounds. First, it rejected the District Court’s basis for granting summary judgment on Zellmer’s Section 15(b) claim. While the District Court highlighted the practical impossibility of Meta’s complying with BIPA if it had to obtain consent from everyone whose photo was uploaded to Facebook before it employed Tag Suggestions, the Circuit Court found that the plain text of Section 15(b) nevertheless applied to everyone—even non-users—whose biometric data might be held by Meta.

Instead, the Circuit Court focused on a more fundamental question: whether Meta had collected or captured Zellmer’s biometric data at all. To answer this question, the Court needed to determine if the “face signature” was a biometric identifier or information under BIPA. Considering the statutory text, the ordinary meanings of the terms, and the evidence offered by the parties, the Court found that there was no dispute that the face signatures could not identify a person. As such, they were neither biometric information nor biometric identifiers. As the Court explained, the face signatures do not reveal information about a face’s geometric information, or reveal facial features or the distances between them. The Court held that face signatures “are simply numbers—an abstract, numerical representation of the aligned face crop created in previous stages. No one—not even Meta—can reverse-engineer the numbers comprising a given face signature to derive information about a person. And even if the reverse-engineering of a face signature were technically possible, face signatures exist for only a tiny fraction of a second—they are neither saved nor stored after the final stage of the Tag Suggestions process.”

Because the Court found Meta had not collected biometric information or identifiers, it held that Meta did not need to obtain written consent to create face signatures, and affirmed summary judgment as to Zellmer’s Section 15(b) claim. The Court also affirmed the District Court’s dismissal of Zellmer’s Section 15(a) claim for lack of standing. Given the Court’s conclusion that face signatures were not biometric identifiers or information, Zellmer could not show that his biometric data was ever in Meta’s possession, let alone that Meta needed to disseminate a written policy about that data’s retention. As such, Zellmer could not allege that he had been harmed in any particularized way.