Google’s Face Grouping Allegedly Collected and Analyzed Users’ Facial Structure without Consent, Violated BIPA

A class-action lawsuit alleged Google failing to provide notice, obtain informed written consent, or publish data retention policies about the collection, storage, and analysis of its face-grouping feature in Google Photos, which violated Illinois Biometric Information Privacy Act (BIPA).

Risk classification

• Primary risk domain: 2 Privacy & Security
• Primary risk subdomain: 2.1 Compromise of privacy by obtaining, leaking or correctly inferring sensitive information

The incident involved Google's face grouping AI scanning and analyzing private photos to extract and store biometric facial geometry without user consent, directly compromising user privacy.

Causal factors

• Entity: Human
• Intent: Unintentional
• Timing: Post-deployment

The privacy risk arose post-deployment due to Google's decision to run the face grouping AI on users' photos without obtaining prior consent, which was an unintentional legal and privacy risk resulting from their product design goals.

EU AI Act risk tier

• Risk tier: 4 Minimal or No Risk

Minimal or No Risk: The face grouping tool is a consumer feature used in Google Photos for entertainment and organization, posing low risk to users when proper consent is obtained.

AI system and alleged parties

• AI system: Google Photos face grouping tool (Google)
• AI purpose: Face Recognition; Data Grouping
• Behaviour type: Tool
• Alleged developer: Google
• Alleged deployer: Google
• Alleged harmed parties: Illinois residents, Google Photos users residing in Illinois, Google Photos users

Harm severity

Severity ratings are based on this scale.

Highest direct severity in any category: Severe. Severity is scored from Negligible to Catastrophic in each harm category, for harm the reports describe as caused directly or indirectly by the AI system.

• Physical: direct Negligible, indirect Negligible
• Infrastructure: direct Negligible, indirect Negligible
• Property: direct Negligible, indirect Negligible
• Financial: direct Severe, indirect Substantial
• Environmental: direct Negligible, indirect Negligible
• Malicious content: direct Negligible, indirect Negligible
• Differential treatment: direct Negligible, indirect Negligible
• Civil rights: direct Negligible, indirect Negligible
• Democracy: direct Negligible, indirect Negligible
• Privacy: direct Severe, indirect Negligible
• Psychological: direct Negligible, indirect Negligible
• Epistemic: direct Negligible, indirect Negligible
• Child sexual exploitation and abuse: direct Negligible, indirect Negligible

Financial

Reported: Yes, the report describes a $100 million settlement to resolve the class-action lawsuit.

Directly caused: Google agreed to pay a $100 million settlement, which represents the direct financial cost to the company for the BIPA violations.

Indirectly caused: Class action attorneys will receive up to $40 million in fees plus costs and expenses from the settlement fund.

Privacy

Reported: Yes, the report explicitly describes biometric privacy violations under Illinois law.

Directly caused: Google's face grouping tool collected and analyzed users' facial geometry (personally identifiable biometric information) from Google Photos without obtaining prior written consent or providing required disclosures.

Inferred additional harm: It is likely that millions of Illinois residents had their biometric privacy compromised over the seven-year period the tool operated without explicit opt-in consent.

People affected

• Occurrences reported: 1
• People reportedly harmed: 5
• People reportedly exposed: 5

Potential causes

Management

• Inadequate Compliance Oversight: Management failed to align the product features with regional privacy laws.
• Prioritizing Feature Rollout: Convenience of face grouping was prioritized over regulatory compliance.

Technology

• Automatic Facial Recognition: The tool automatically analyzed facial structures in uploaded photos.
• Lack of Built-In Consent Gates: The software lacked technical blocks to prevent scanning without consent.

Data Inputs

• Unconsented Biometric Collection: Facial geometry data was harvested directly from user-uploaded photos.
• Lack of Data Retention Policies: No clear policies were published regarding how long face data is stored.

Human Factors

• Lack of User Awareness: Users were unaware that uploaded photos were scanned for biometric data.

Process and Methods

• No Opt-In Consent Process: The face grouping feature was enabled by default without user opt-in.
• Inadequate Disclosure Procedures: Google failed to provide written notice explaining the biometric scanning.

Regulatory Environment

• Strict State Privacy Laws: Illinois BIPA requires explicit written consent for biometric collection.

Information quality

• Classification confidence: High
• Reason for confidence: The reports provide clear, consistent details about the legal settlement, the specific AI feature involved (face grouping), the nature of the BIPA violations, and the estimated financial impact. There is no conflicting information regarding the core facts of the case.
• Ambiguities identified: The exact number of affected users (class members) is not explicitly stated, only estimated through the settlement value and individual payout ranges.

Google agreed to a $100 million settlement to resolve a class-action lawsuit alleging its Photos face grouping feature violated Illinois biometric privacy laws. While representing a significant consumer privacy and civil liberties concern regarding unauthorized biometric data collection, the incident has negligible direct national security implications and is managed through standard legal frameworks.

• Overall national security impact: Minor
• Scope: Single nation
• Primary target: United States
• Alleged perpetrator: Google

Threat characteristics

• Imminence: Long-term. The incident relates to a historical class-action settlement for activities occurring between 2015 and 2022, posing no immediate national security threat.
• Autonomy: Human-supervised. The face grouping AI operates automatically on user-uploaded photos but within a consumer application supervised by user settings and platform controls.
• Novelty: Established threat. Similar biometric privacy lawsuits and settlements have occurred previously with other major technology firms.

Impact by dimension

• Physical security: Negligible. No threat to physical systems, critical infrastructure, or human safety was identified in this incident.
• Information security: Negligible. No evidence of state-sponsored information warfare, intelligence compromise, or classified data theft.
• Sovereignty: Negligible. The incident is a domestic regulatory compliance issue and does not threaten state authority or core government operations.
• Economic security: Negligible. The $100 million settlement represents a negligible economic impact on the national scale and does not threaten strategic industries.
• Societal stability: Minor. The unauthorized collection of biometric data from millions of citizens raises civil liberties and privacy concerns, though it was addressed via standard civil litigation.