Illinois Residents File Class Action Lawsuit Against Facial Recognition Technology Companies for Allegedly Violating BIPA

A class action lawsuit was filed against several facial recognition technology companies for allegedly violating the Illinois Biometric Information Privacy Act (BIPA). The defendants are accused of offering a facial recognition search engine called Pimeyes, which collects images from databases across the internet and scans them into their database seemingly without consent. This action is claimed to invade the privacy of millions of Americans. The lawsuit argues that Pimeyes lacks publicly available policies regarding data storage and deletion, in contravention of BIPA's requirements for informed written consent before collecting biometric data.

Risk classification

• Primary risk domain: 2 Privacy & Security
• Primary risk subdomain: 2.1 Compromise of privacy by obtaining, leaking or correctly inferring sensitive information

The incident involves the unauthorized collection, scanning, and storage of biometric facial templates of millions of individuals, directly compromising their privacy.

Causal factors

• Entity: Human
• Intent: Intentional
• Timing: Post-deployment

The privacy violations occurred because humans intentionally designed, built, and deployed the Pimeyes facial recognition search engine to scrape and process biometric data.

EU AI Act risk tier

• Risk tier: 1 Unacceptable

Unacceptable Risk: The AI system involves the untargeted scraping of facial images from the internet to create a facial recognition database, which is a prohibited practice under the EU AI Act.

AI system and alleged parties

• AI system: Pimeyes
• AI purpose: Face Recognition; Image Search
• Behaviour type: Tool
• Alleged developer: Transaction Cloud, Public Mirror, PimEyes, Lukasz Kowalczyk, Giorgi Gobronidze, Face Recognition Solutions, EMEA Robotics, Does 1-25, Denis Tatina, Carribex
• Alleged deployer: Transaction Cloud, Public Mirror, PimEyes, Lukasz Kowalczyk, Giorgi Gobronidze, Face Recognition Solutions, EMEA Robotics, Does-125, Denis Tatina, Carribex
• Alleged harmed parties: Nicholas Clayton, Misty McGraw, Manuel Clayton, Illinois residents, Amy Newton, Amanda Curry

Harm severity

Severity ratings are based on this scale.

Highest direct severity in any category: Severe. Severity is scored from Negligible to Catastrophic in each harm category, for harm the reports describe as caused directly or indirectly by the AI system.

• Physical: direct Negligible, indirect Negligible
• Infrastructure: direct Negligible, indirect Negligible
• Property: direct Negligible, indirect Negligible
• Financial: direct Negligible, indirect Negligible
• Environmental: direct Negligible, indirect Negligible
• Malicious content: direct Negligible, indirect Negligible
• Differential treatment: direct Negligible, indirect Negligible
• Civil rights: direct Severe, indirect Negligible
• Democracy: direct Negligible, indirect Negligible
• Privacy: direct Severe, indirect Negligible
• Psychological: direct Negligible, indirect Negligible
• Epistemic: direct Negligible, indirect Negligible
• Child sexual exploitation and abuse: direct Negligible, indirect Negligible

Civil rights

Reported: The report explicitly describes violations of civil rights, specifically biometric privacy rights under Illinois law.

Directly caused: The defendants collected and stored the biometric data of the named plaintiffs and millions of other Americans without their informed written consent.

Inferred additional harm: It is likely that millions of individuals had their civil rights violated through the unauthorized scraping and scanning of their faces.

Privacy

Reported: The report explicitly describes privacy violations caused directly by the collection of biometric data without consent.

Directly caused: The defendants invaded the privacy of the named plaintiffs by collecting, scanning, and storing their biometric facial data without informed consent.

Inferred additional harm: The privacy of millions of Americans was compromised as their facial images were scraped and made searchable to anyone on the internet without their consent.

People affected

• Occurrences reported: 1
• People reportedly harmed: 5
• People reportedly exposed: 1000000

Potential causes

Management

• Negligent Risk Management: Prioritized growth and scraping over privacy laws and user rights.
• Lack of Operational Transparency: Management failed to publish clear policies on data handling practices.

Technology

• AI Facial Recognition Scanning: AI extracts biometric faceprints from internet photos without authorization.
• Unrestricted Search Engine: Allows anyone to search for and download photos of any person.

Data Inputs

• Unconsented Web Scraping: Harvesting millions of photos from online databases without consent.
• Continuous Database Ingestion: Automatically updating the database with newly scraped internet photos.

Human Factors

• User Misuse Potential: Customers can search for individuals without their knowledge or consent.

Process and Methods

• Lack of Consent Process: No process to inform users or get written release before harvesting data.
• Absent Data Retention Policy: No written, public policy on biometric data storage and destruction.

Regulatory Environment

• BIPA Violations: Failure to comply with Illinois Biometric Information Privacy Act rules.

Information quality

• Classification confidence: High
• Reason for confidence: The report clearly outlines the legal allegations, the specific AI technology (facial recognition search engine), the parties involved, and the nature of the privacy violations under BIPA. There is little ambiguity regarding the facts of the lawsuit.

The class action lawsuit against Pimeyes highlights substantial privacy and civil rights concerns regarding the unauthorized scraping and scanning of biometric data of millions of Americans. While it poses minor long-term risks to intelligence security through open-source tracking, the primary impact is on societal stability and human rights due to the erosion of privacy protections at scale.

• Overall national security impact: Substantial
• Scope: Single nation
• Primary target: United States
• Alleged perpetrator: Pimeyes

Threat characteristics

• Imminence: Long-term. This represents an ongoing regulatory and strategic privacy concern rather than an immediate national security crisis.
• Autonomy: Human-controlled. The AI system operates as a search tool, assisting human users who initiate and control the search queries.
• Novelty: Evolved capability. Facial recognition is an established technology, but the commercialization of a public, mass-scraped facial search engine represents an evolved capability.

Impact by dimension

• Physical security: Negligible. No physical security threat, kinetic attack, or critical infrastructure compromise is reported or indicated in the incident.
• Information security: Minor. The availability of mass facial search engines scraped from public data poses minor risks to intelligence security by facilitating open-source surveillance.
• Sovereignty: Negligible. No compromise of sovereign authority, government decision-making, or electoral systems is reported in this civil class action lawsuit.
• Economic security: Minor. The incident involves civil litigation and regulatory compliance issues for a commercial entity, representing minor economic and technological security implications.
• Societal stability: Substantial. The unauthorized scraping and scanning of biometric data of millions of individuals without consent constitutes a substantial violation of privacy rights and civil liberties.