This lawsuit seems dead on arrival.<p>From the article (emphasis my own):<p>"""
The suit alleges that Google is violating BIPA because it is “actively collecting, storing, and using—without providing notice, obtaining informed written consent or publishing data retention policies—the biometrics of millions of unwitting individuals <i>whose faces appear in photographs</i> uploaded to Google Photos in Illinois
"""<p>From the text of the BIPA law (again, emphasis my own):<p>"""
Biometric identifiers do not include writing samples, written signatures, <i>photographs</i>...
"""<p>This interpretation of BIPA would seem to require complex written consent for every corner store running a security camera and every wedding photographer, which clearly isn't the intent of the law. Since the law explicitly carves out photographs, the use to which Google is putting the material in question should be irrelevant; it's explicitly excluded from this law's coverage.
To save y'all a click: The alleged biometrics in question are the use of facial-recognition software on photos uploaded to Google Photos (without informed consent from the user).
If a friend clicks a photo of me and uploads it to Google Photos, IMO, it's not okay for Google to use my face to train models without explicit permission from me.<p>Unfortunately, as is often the case with technology, laws have not kept up with the lastest developments, and likely will not in my country for several more decades. Welp.
Whose consent is needed, according to the law? The person who took the photos, or the person being photographed? And is the consent required only if the product is used in Illinois? Or if the photo is taken in Illinois? Or if the person photographed is a resident of Illinois?<p>(I read the law, and it appears to cover the person being photographed, if the photograph is taken in Illinois. So basically according to the law Google ought not build face models from photographs taken in Illinois, except of people who have consented.)<p>I wonder if in the broadest configuration (basically any configuration other than "consent of the user, who is a resident of Illinois"), this law would probably be struck down as an unconstitutional restraint on interstate commerce? I guess we'll see! Should be exciting.
We have a large client/customer in Illinois who has decided against using our voice sdk in their iOS/Android app because of the fear of getting sued for BIPA violation. It's not that they think we're creating voice prints without consent, it's just that their legal team has warned them that if they get sued, it could be very costly to defend. We even changed our privacy policy to note that "biometrics" are not obtained, and even went to on-device speech recognition apis provided by Google and Apple.