Meta Settles Texas Biometric Data Lawsuit for $1.4 Billion

Today, Texas Attorney General Ken Paxton announced his office reached a $1.4 billion settlement of a 2022 lawsuit against Meta that alleged the company “unlawfully captured the biometric identifiers of Texans for a commercial purpose without their informed consent, disclosed those identifiers to others, and failed to destroy collected identifiers within a reasonable time." Texas claimed Meta’s actions were in violation of the Texas Capture or Use of Biometric Identifier Act, an information privacy law passed in 2009.

“This historic settlement demonstrates our commitment to standing up to the world’s biggest technology companies and holding them accountable for breaking the law and violating Texans’ privacy rights,” said Attorney General Paxton in a statement. “Any abuse of Texans’ sensitive data will be met with the full force of the law.”

While Meta will have to suffer the fine, the settlement terms make it unlikely it would ever face such an action again. The settlement sets out a notice and dispute resolution process through which the company can inform the state about activities that may be subject to the same sorts of considerations as those in this dispute. It establishes a mechanism by which the company can resolve disputes in future without entering into litigation:

For all other conduct that is not disclosed by Meta pursuant to Paragraph II.G.1, the State shall provide written notice to Meta prior to bringing a civil enforcement action against Meta or seeking any other relief or remedies authorized for violations of the Biometric Laws related to such conduct. The notice must specify the bases on which the State contends Metas' conduct violates each Biometrics Law:

(a) The Parties shall have 60 days to confer and attempt to reach agreement regarding the legality of the conduct at issue, or modifications relating to the conduct that would render it lawful.

(b) The State may not bring a civil enforcement action against Meta or sek any other relief or remedies authorized for violations of the Biometrics Laws until it has complied with the notice and dispute resolution requirements of this Paragraph I.G.2.

The settlement announcement says that “Unbeknownst to most Texans, for more than a decade Meta ran facial recognition software on virtually every face contained in the photographs uploaded to Facebook, capturing records of the facial geometry of the people depicted.” The company deployed a feature that invited users to tag others in photos in 2011. Ten years later, in November 2021, Meta, then Facebook, announced it would end its use of facial recognition technology. At the time, the company cited “ongoing uncertainty” about the use of the technology, concluding that “we believe that limiting the use of facial recognition to a narrow set of use cases is appropriate.”

Google is also wrangling with the Texas Attorney General over a similar complaint regarding its use of biometric data in applications such as Nest and Google Photos. A similar case brought by the state of Illinois against Facebook in 2015 was settled in 2020 for $650 million. The proceeds were largely returned to Facebook users.