Facebook Users Can Sue Over Facial Recognition, Court Rules Facebook users in Illinois claim the tech giant violated the state's Biometric Information Privacy Act, which requires companies to obtain consent when collecting their biometric information.

A federal appeals court is allowing a group of users to sue Facebook on claims the social network collected their facial data without consent.

On Thursday, the U.S. Court of Appeals for the Ninth Circuit rejected Facebook's efforts to dismiss the ongoing class-action lawsuit, which could potentially require the company to pay billions in compensation.

The lawsuit dates back to 2015 when three Facebook users living in the state claimed the tech giant had violated the Illinois Biometric Information Privacy Act, which requires companies to obtain consent when collecting their biometric information.

Since 2010, Facebook has been using its own facial-recognition technology for photo-tagging purposes. It works by generating a digital template from your photos, so that the company can detect whenever your face appears in other images posted across the social network.

The plaintiffs in the class-action lawsuit argue they never authorized the company to create a digital template of their face. According to privacy groups, most users were automatically enrolled in facial recognition. Facebook claims it inflicted no "concrete injury" on the users by scanning their photos.

In today's ruling, Circuit Judge Sandra Ikuta wrote: "We conclude that the development of a face template using facial-recognition technology without consent (as alleged here) invades an individual's private affairs and concrete interests."

Privacy groups are concerned facial-recognition systems risk paving the way for mass surveillance. And unlike a password or phone number, your biometric data cannot be changed. "The capability to instantaneously identify and track people based on their faces raises chilling potential for privacy violations at an unprecedented scale," said Nathan Freed Wessle, staff attorney with the American Civil Liberties Union.

"Both corporations and the government are now on notice that this technology poses unique risks to people's privacy and safety."

Under Illinois's biometric privacy act, companies can end up paying up to $5,000 per person for intentionally breaking the law. The fine drops to $1,000 per person if the company is found only "negligently" violating the act. Given that Illinois has millions of internet users, a potential fine against Facebook could be massive.

However, the company told Reuters it plans to appeal today's ruling. "We have always disclosed our use of face recognition technology and that people can turn it on or off at any time," the company said. Users can shut off the facial-recognition function by going to their profile's settings panel.