Keypoint: The Texas Attorney General reached a $1.4 billion settlement with Meta over its alleged violations of Texas’ biometric privacy law.
On July 30, 2024, the Texas Attorney General announced that it has reached a $1.4 billion settlement with Meta over its alleged violations of Texas’ “Capture or Use of Biometric Identifier” Act (CUBI). The Attorney General’s press release represents that the settlement, which arises out of a 2022 complaint, is the first under CUBI. It also represents that the settlement “is the largest privacy settlement an Attorney General has ever obtained.”
In the below article, we provide a brief overview of CUBI and the underlying allegations in the complaint.
What is CUBI?
While most companies are aware of the Illinois Biometric Information Privacy Act (BIPA), the Texas Capture or Use of Biometric Identifier Act (CUBI) has received less attention because it lacks a private right of action like BIPA.
CUBI prohibits a person from capturing a biometric identifier of an individual for a commercial purpose unless the person: “(1) informs the individual before capturing the biometric identifier; and (2) receives the individual’s consent to capture the biometric identifier.” CUBI defines “biometric identifier” to mean “a retina or iris scan, fingerprint, voiceprint, or record of hand or face geometry.” The law does not define “commercial purpose” and does not state that the biometric identifier must be used to identify the individual. The law also does not specify how consent should be obtained (e.g., what type of disclosures need to be made).
In addition, CUBI restricts how a person can use a biometric identifier. Specifically, a biometric identifier captured for a commercial purpose cannot be sold, leased or otherwise disclosed to another person unless the transfer satisfies one of the law’s exceptions. CUBI also contains information security and destruction requirements. For more background on CUBI, please see the Texas Attorney General’s overview.
CUBI is enforceable only by the Texas Attorney General. The Attorney General can seek a civil penalty of up to $25,000 per violation. CUBI was first enacted in 2001 and recodified in 2009. As noted, this is the first settlement under the law.
Finally, it is important to note that the complaint was filed in 2022, which is before the Texas legislature passed the Texas Data Privacy and Security Act (HB 4) in May 2023.
What Does the Complaint Allege?
The Attorney General’s complaint arises out of Meta’s use of “tag suggestions.” According to the complaint, “Tag Suggestions worked by using Facebook’s proprietary facial-recognition process to capture and analyze the records of facial geometry – of both users and non users – obtained from user-uploaded photos and videos.” “Tag Suggestions would then use the captured records of face geometry to compare faces in the photo or video to the faces of individuals in its database. If the Tag Suggestions recognized and identified one of the faces appearing in the photograph, Facebook would suggest to the user the individual’s name, so that the user could tag the individual.” Facebook also used tags to train its facial-recognition algorithm.
The complaint alleges that Meta violated CUBI by failing to obtain informed consent, disclosing biometric identifiers to third parties, and failing to dispose of the biometric identifiers in a reasonable amount of time. Facebook reportedly ran the tag suggestions program from December 2010 until November 2021, when it ended the program after reaching a $650,000,000 BIPA settlement.
The complaint alleges that Meta violated CUBI as well as the Texas Deceptive Trade Practices Act.
[View source.]
