
Instagram faces $500B in fines alleging it harvested biometric data - cyrksoft
https://www.businessinsider.com/instagram-facing-500-billion-in-fines-in-facial-recognition-lawsuit-2020-8
======
helsinkiandrew
> the tool automatically scans the faces of people pictured in other users'
> posts, even if they don't use Instagram and didn't agree to the terms of
> service.

This suggests to me that the number of people affected is much more than the
100 million Instagram users, and the potential fine much higher.

~~~
clement_b
Sort of related. I always wondered how people in my photos would react knowing
Google Photo was essentially scanning their face without their approval. I am
sure this is covered by Google Photos T&Cs somehow, nevertheless, it's a real
problem. Should I disclose anyone I snap about this? Even someone walking in
the background?

~~~
izacus
I'm guessing the easiest way to fix this would be to just disable the feature?

According to documentation, Google mentiones that face groups are deleted when
you turn the feature off:
[https://support.google.com/photos/answer/6128838?hl=en](https://support.google.com/photos/answer/6128838?hl=en)

(And if they're not, winning a lawsuit against Google should be trivial.)

~~~
m463
I wonder if they are deleted from generated machine learning models?

------
rmrfstar
Today I learned: the idea that a corporation can commit a crime is a very new
one. [1]

People commit crimes, not companies.

[1] William Blackstone, Commentaries on the Laws of England 464 (1765) (“A
corporation cannot commit treason or felony or other crime in its corporate
capacity though it’s members may in their distinct individual capacities.”)

~~~
Hamuko
> _People commit crimes, not companies._

I thought corporations are people, my friend.

~~~
harryh
I really wish people would stop repeating this line thinking they are making
some kind of interesting point. Go watch the video:

[https://www.youtube.com/watch?v=St1wSWtm_BI](https://www.youtube.com/watch?v=St1wSWtm_BI)

Romney's point was that corporations are made up of people and that corporate
taxes are, in the end, taxes on people.

The fact that this was treated as some kind of gaffe at the time, and is still
being repeated almost a decade later is just terribly disappointing.

~~~
dtech
"Corporations are people" is literally in US law [1]. It has nothing to do
with a gaffe from Mitt Romney.

Very famously the US supreme court ruled in 2010 that corporations have free
speech and money is speech [2]

[1]
[https://en.wikipedia.org/wiki/Corporate_personhood#Legislati...](https://en.wikipedia.org/wiki/Corporate_personhood#Legislation_in_the_United_States)

[2]
[https://www.npr.org/templates/story/story.php?storyId=122805...](https://www.npr.org/templates/story/story.php?storyId=122805666)

~~~
harryh
1) The "my friend" at the end of OPs comment is the connection to Mitt Romney.
It's a relatively famous quote, much to my dismay.

2) No corporations are not people. That is, quite obviously, a non-sequitur.
They do, however, have some (but not all!) of the rights that people do
because of the fact that they are _made up of people._

------
WA
The most depressing part about this is: to me, as an individual who probably
has my biometric data harvested, I see nothing of this money and my data is
still gone. It’s almost as if there was a hidden price tag: "Do crime X and
pay Y to make money Z." As long as Y<Z and the business can continue to
operate with a new crime, it’s just like there was no law. Just costs.

~~~
creato
> my data is still gone

How exactly is your data "gone"?

~~~
Kuinox
If you reveal one of your secret, you no longer have a secret. Private data is
the same, it's not private anymore when public, it lost its value.

~~~
wolco
You chose to show your face in a public place. You have no expectation of
privacy. The value was already lost.

~~~
Zircom
>Go to private party on private property of a friend

>Someone who also attended takes picture of party and posts in on instagram

>Instagram harvests your face from said picture

No public places involved in that scenario.

------
BelleOfTheBall
It's pretty obvious that the fine won't be $500B since it was likely set that
high specifically so when it's knocked down it doesn't go to something absurd
like $1,000. However, I do hope this sees some traction, especially as
Facebook is now fully moving forward with its plan to merge Instagram,
WhatsApp and Facebook.

~~~
mdoms
How is that "pretty obvious"?

------
tonyztan
Article about the Illinois Biometric Information Privacy Act (BIPA) fails to
mention BIPA's name even once.

------
ipsum2
> In a statement to Business Insider, Facebook spokesperson Stephanie Otway
> said Instagram does not use facial recognition in the way the Facebook app
> does. "This suit is baseless. Instagram doesn't use Face Recognition
> technology," Otway said.

Later on in the article:

> Facebook did not immediately respond to a request for comment.

So, which one is it?

------
AnonHP
This sounds almost like the previous lawsuit (mentioned in the article) that
was settled by Facebook for $650 million, which was concerning Facebook’s use
of facial recognition, wasn’t noticed by the lawyers of this case. The best
they can hope for would be one more settlement that will be a tiny fraction of
a percentage of the $500 billion ask. Hopefully they have strong evidence
against Facebook’s statement that Instagram doesn’t do facial recognition.

~~~
OldHand2018
The judge hasn't allowed the settlement yet, and it is not clear that he will
allow it. He rejected the original $550 million

[https://www.courthousenews.com/judge-wont-sign-off-
on-550m-f...](https://www.courthousenews.com/judge-wont-sign-off-
on-550m-facebook-facial-data-settlement/)

> “The Illinois Legislature said this is meant to be an expensive violation,”
> U.S. District Judge James Donato said during a preliminary settlement
> approval hearing held via video Thursday.

> The Illinois statute carries civil penalties of $1,000 for each negligent
> violation and $5,000 for each knowing violation. With a class of millions of
> Facebook users who had photos of themselves uploaded in Illinois, damages
> could have reached tens of billions of dollars.

> Donato demanded lawyers for Facebook and the plaintiff class explain why the
> higher damages amount of $5,000 per violation was taken off the table.

> Last year, Facebook paid a $5 billion fine to the Federal Trade Commission
> to settle claims that it violated a 2012 FTC order by allegedly deceiving
> users about their ability to control private information. Donato said that
> settlement could provide adequate evidence to support a push for higher
> damages.

> “It looks to me that what Facebook did to violate the BIPA may also have
> been a violation of that prior FTC consent decree, in which case you have a
> pretty good argument that this is an intentional or reckless violation of
> BIPA that would warrant $5,000,” Donato said.

------
markholmes
Where do those fines go?

~~~
OldHand2018
> Where do those fines go?

They aren't fines. They are damages and go to the people affected.

In the case of the $650 million proposed settlement for Facebook proper (The
judge in the case already rejected a $550 million settlement agreement as "far
too little"), all Illinois Facebook users would get a check for $1000+

By the way, this article is really poorly written. The $5000 * 100 million
users is not the way it works. The Illinois law says it is $1000-$5000 per
violation, so the few million Illinois Instagram users (I have absolutely no
idea how many there are) would be entitled to $1000-$5000 every time Instagram
did a facial recognition lookup on them, which could easily cause a total
liability to be in the tens or hundreds of billions of dollars.

Facebook fought against their lawsuit for years until it was finally ruled
that they would have to go to trial. And now they are settling. That's likely
what is going to happen here too. If they can keep it out of the courtroom,
they'll pay nothing. If they can't, they'll offer up a few hundred million to
make it go away.

~~~
manquer
Given it is class action suit, I would say the lawyers make most of the money
and the people who have the standing to sue will get nowhere close to $1,000 .

------
youareostriches
It's about time. Facebook has been violating this law for years.

~~~
imhoguy
No FB user here. Is it possible to get myself labeled on FB-posted photos with
my full name by some FB user?

~~~
alpha_squared
Yes, though it would be equivalent to a label or sticker on an item in a store
(note: not a barcode). It wouldn't carry meaning from a technological
perspective (though I guess Facebook could try to mine that).

The problem with Facebook's facial recognition features is that it has to
recognize all faces, even faces that don't want to be recognized, to know
which faces to legally not recognize. It's an all-or-nothing feature across
its entire user base. It can't even be geofenced because users travel and
upload from all sorts of parts of the world and wind up in the background of
several photos.

Facial recognition is a "logical feature" in that it mimics how people
recognize people, but is problematic when applied at scale.

~~~
mulmen
If I don’t upload a picture of my face and tell Facebook “please let me know
when you’d see my face, it looks like this”. Then any time they see a face
they don’t recognize they should just do _nothing_.

That’s not at all how Facebook _chose_ to implement their face detection and
pretending it’s a hard problem does a disservice to anyone interested in their
privacy.

Parsing the image and seeing faces is one thing. Persisting and correlating
that data is another.

------
codecamper
B or M?

~~~
stephen82
> "Under the Illinois law, Facebook could be forced to pay $1,000 to $5,000
> per violation, meaning the full damages could reach $500 billion if Facebook
> is found responsible."

~~~
akersten
$500B is pretty nuts. Does anyone else here feel that this whole thing is
nuts?

Facebook's market cap is $700B. Making them pay $500B in damages would put
them out of business. So, to be clear with what we're talking about here,
we're considering the corporate death penalty.

The alleged crime? Processing photo data to find objects that look like people
that look similar to other objects that look like people. Yes, by the letter
of the law, that's against BIPA (which is a problematic law motivated by a
historically anti-tech cash-grabby legislature (see: Netflix Tax)), but what
are the _actual damages_ to the injured party? It is a tall order to convince
me that having your name pop up as a recommended tag in your friend's photo
caused you any material harm, let alone $1000+ per incident.

I get that there's a privacy angle, I get that PII is toxic, I get that we
care about data protection and all now. But this? This is a dumb law, and a
dumb lawsuit.

~~~
perl4ever
Hmm, I question whether it really would put them out of business. FB made
about $18B net income last year. Shouldn't that be more than enough to pay the
interest on issuing $500B of long term bonds? It almost seems like a sweet
spot of a massive fine that _wouldn 't_ kill them.

Also, it would just be satisfying to demonstrate they aren't above the law.
Ordinary people don't get to say "but that law is _obviously_ unreasonable"
when, you know, it's very debatable, and get exempted.

------
scott31
Should be $500T instead

~~~
jml7c5
You want Facebook to be fined 5 years of world GDP?

------
sergiotapia
They need to make people responsible, not the corporate entity.

~~~
solarkraft
Why? The company profited from the crime. That would create some interesting
incentives.

~~~
cwhiz
You can’t effectively punish a company, especially not a company the size of
Facebook.

But if individuals go to prison for their actions, people will be more careful
how they act.

~~~
scroogeydop
Corporate death penalty.

~~~
hanniabu
Not sure why this is downvoted as it brings up an interesting position. Why
can't there be violations so severe that they force the corporation to be
dissolved?

~~~
arrosenberg
It happens, just less often than is probably healthy.

[https://www.nytimes.com/2020/08/06/us/ny-nra-lawsuit-
letitia...](https://www.nytimes.com/2020/08/06/us/ny-nra-lawsuit-letitia-
james.html)

[https://en.wikipedia.org/wiki/Arthur_Andersen](https://en.wikipedia.org/wiki/Arthur_Andersen)

------
beisner
There are 100 million Instagram users in Illinois’ jurisdiction?

~~~
reaperducer
_There are 100 million Instagram users in Illinois’ jurisdiction?_

At this moment, no.

During the time that this law was in effect, easily.

Though I no longer live in Illinois, I am probably one of the people covered
by this lawsuit.

50 million tourists visit Chicago each year. They're probably covered.

104 million people travel through ORD and MDW airports each year. They're
probably covered.

Probably another dozen or two million people travel to or through Illinois
each year on business. They're probably covered.

It adds up.

------
higginsc
Instagram doesn't do facial recognition though, so this seems pretty baseless.

~~~
esperent
Instagram does do facial recognition, they are just not doing it for your
benefit, or showing you the results.

~~~
jfk13
> Instagram does do facial recognition

I wouldn't be at all surprised if it's true, but still...do you have a source
for that claim?

~~~
nemothekid
How do you think the "tag so-and-so in this picture" feature works?

~~~
bryan_w
What feature are you talking about? Can you link to any official documentation
or post a screenshot?

------
CyberDildonics
They should be fined trillions for having videos with no volume control.

------
jariel
Arguably, merely storing a photo of someone is 'harvesting biometric data'.

Comparing photos to one another to see if they match is hardly nefarious.

Paradoxically, it's probably irrelevant: it doesn't help them make money in
ads, it probably has no otherwise material effect on the service.

I'm glad someone is suing FB but I'm not sure this is the right angle.

------
jquery
$500 billion? Reminds me of this: Minnesota woman to pay $220,000 fine for 24
illegally downloaded songs -
[https://www.theguardian.com/technology/2012/sep/11/minnesota...](https://www.theguardian.com/technology/2012/sep/11/minnesota-
woman-songs-illegally-downloaded)

