In a case called Weiss v. Google Inc., plaintiff Joseph Weiss has filed a potential class action accusing Google of stealing “face templates” from Google Photos without permission. The case was filed in Illinois Northern District Court and accuses Google of violating the Illinois Biometric Information Privacy Act (BIPA).

BIPA regulates the collection, use, and storage of “biometric information” or “biometric identifiers,” which is defined as any personal feature unique to an individual (e.g., fingerprints, DNA). According to the complaint biometric identifiers includes “face geometry.” The law requires that any private entity (i.e., Google in this case) obtain consent from the affected individuals whose data are being collected or used.

BIPA states:

No private entity may collect, capture, purchase, receive through trade, or otherwise obtain a person’s or a customer’s biometric identifier or biometric information, unless it first:

(1) informs the subject or the subject’s legally authorized representative in writing that a biometric identifier or biometric information is being collected or stored;

(2) informs the subject or the subject’s legally authorized representative in writing of the specific purpose and length of term for which a biometric identifier or biometric information is being collected, stored, and used; and

(3) receives a written release executed by the subject of the biometric identifier or biometric information or the subject’s legally authorized representative.

The complaint alleges that Google has captured “face prints” without the required consent in violation of BIPA:

Google has created, collected and stored, in conjunction with its cloud-based “Google Photos” service, millions of “face templates” (or “face prints”) – highly detailed geometric maps of the face – from millions of Illinois residents. Google creates these templates using sophisticated facial recognition technology that extracts and analyzes data from the points and contours of faces that appear in photos taken on Google “Droid” devices and uploaded to the cloud-based Google Photos service. Each face template that Google extracts is unique to a particular individual, in the same way that a fingerprint or voiceprint uniquely identifies one and only one person.

The case seeks class action status on behalf of Illinois residents and at least $5,000,000 in damages plus attorneys fees.

SiliconBeat points out that related claims under BIPA against Shutterfly and Facebook were allowed to proceed. Both defendants in those pending cases have argued that the law only applies to scans that were collected or conducted “in person.” Google will likely make a similar argument.

Greg Sterling is a Contributing Editor at Search Engine Land. He writes a personal blog,