On October 20, 2022, Texas Attorney General Ken Paxton brought suit in Texas district court against Google for alleged violations of the Texas Capture or Use of Biometric Identifier Act (“CUBI”). The petition claims that Google violated CUBI by collecting, analyzing, and storing the facial geometry of individuals who appear in photos that have uploaded to the Google Photos app, and additionally, that Google violates CUBI via its Nest platform by recording and forming a voice print of individuals. While Illinois’ BIPA garners the headlines due to its private right of action, the Texas action is a reminder that biometric data implicates laws nationwide.
CUBI (Tex. Bus. & Com. Code § 503) restricts the collection and use of “biometric identifiers,” defined as a “retina or iris scan, fingerprint, voiceprint, or record of hand or face geometry.” Under the Act, it is unlawful to “capture” an individual’s biometric identifier for a commercial purpose unless the individual is informed and consents to having such information collected before capture. Further, the CUBI mandates that those who are in possession of individuals’ biometric identifiers must not disclose the information without consent and must destroy such information “within a reasonable time, but not later than the first anniversary of the date the purpose for collecting the [biometric] identifier expires.” Each violation is potentially subject to a civil penalty of up to $25,000.
Texas alleges that Google, since at least 2015, has violated CUBI by collecting photos and biometric data of individuals’ faces through a feature in Google Photos that it calls “Face Grouping.” Face grouping employs facial-recognition technology that allegedly detects an individual’s face and creates a record (or ‘face template’) for that specific face. Texas states that Google evaluates whether the faces detected in each new photo or video uploaded is similar to face templates Google has previously recorded from other photos and videos. Google then groups together any photos and videos depicting similar faces—known as “face groups”—based, in part, on the similarity of face geometry. However, Texas also argues that a face template is created for any minor child or any passerby who happens to be in the background the photo.
With respect to Nest, Texas argues that the platform violates CUBI via its ‘voice match’ feature. Specifically, Texas alleges that “Google uses each voice inflection, mumble, stutter, accent, pattern, and whisper to identify speakers and, through machine learning, to improve Google’s products and service.” The petition states that the Nest platform accomplishes this by “listening to and analyzing every voice it hears, without regard to whether a speaker has consented to Google’s indiscriminate voice printing,” and then storing their voiceprints indefinitely. Further, Texas claims that Google subcontractors “may have reviewed millions of recordings made by unsuspecting individuals speaking near a device with Google Assistant. In other words, Google had human beings listen to the most intimate conversations about everything that people discuss in the safety of their own home including sex, religion, politics, and health.”
This suit follows a prior case brought by Texas against Meta earlier this year, and a $100 million dollar settlement in a class action lawsuit against Google LLC for alleged violations of the Illinois Biometric Information Privacy Act.
While it may be tempting to dismiss the Texas action as a focus against big tech, it should serve as an alarm bell to companies that regulators are seriously focused on biometric identifiers. Accordingly, companies should carefully review its technology—especially security cameras, timekeeping procedures, and headsets or smartphone functionalities—to ensure that it is not unintentionally stepping into the crosshairs.
[View source.]
