US District Judge Nancy Rosenstengel has trimmed but not dismissed the class action over Photos faceprints, which plaintiffs value at up to $32.5 billion, decertifying one of the lawsuit’s three subclasses. The order in Hazlitt v. Apple, filed on 30 September in the Southern District of Illinois and reported by AppleInsider, leaves two certified classes that could still reach a jury.
The lawsuit, brought in Illinois, alleges that the Photos app creates “faceprints” from faces, synchronises them through iCloud and stores them without consent, violating the Illinois Biometric Information Privacy Act (BIPA). Rosenstengel found enough evidence for a jury to decide that Apple’s neural-network faceprints can qualify as biometric identifiers, citing the earlier Facebook case. The judge granted Apple summary judgment only on “face crops”, holding that the location of a face in a photograph does not reveal facial geometry.
The court rejected Apple’s argument that it does not possess biometric data because iCloud faceprints are encrypted, noting Apple’s control over the data and the possibility that it could change its encryption. Apple has argued that Photos only groups images containing the same faceprint rather than identifying a person outright.
The decertified iCloud Subclass covered Illinois residents whose People albums were associated with iCloud and carried identifying labels. Still certified are the Local Device Subclass, covering People album photos captured since 2016, and the iCloud Faceprint Subclass, covering faceprints uploaded to iCloud under the newer synchronisation system since July 2024, pending revisions to class notices.
BIPA has regulated private companies’ collection and use of biometric information since 2008. Facebook paid $650 million in 2021 to settle a similar case. The ruling does not state the remaining size of the class or Apple’s potential exposure, and it was not clear whether Apple plans to appeal.