Texas AG Paxton Sues Google Over Biometric Data Collection
A lawsuit against Google by Texas Attorney General Ken Paxton (R) over the company’s use of biometric data in photo apps and devices could lead to a massive payout based on recent large settlements in similar cases against Google and Facebook under Illinois’ Biometric Information Privacy Act (BIPA), attorneys told us Thursday. “All across the state, everyday Texans have become unwitting cash cows being milked by Google for profits,” said the complaint, filed Thursday in the state's District Court of Midland County.
Sign up for a free preview to unlock the rest of this article
Export Compliance Daily combines U.S. export control news, foreign border import regulation and policy developments into a single daily information service that reliably informs its trade professional readers about important current issues affecting their operations.
The lawsuit appears similar to Paxton’s February case against Meta, which is still proceeding in District Court of Harris County. Google settled a BIPA case for $100 million in September, and Facebook paid out a $650 million BIPA settlement in February 2021, but the Texas law under which Paxton has sued allows for statutory damages five times that of BIPA. While there have been numerous BIPA cases, the 2009 Texas law underpinning Paxton’s suit -- the Capture or Use of Biometric Identifier Act (CUBI) -- is largely untested, said attorney Jeffrey Rosenthal of Blank Rome. “Texas is the Wild West; we don’t know what’s going to happen,” Rosenthal said.
Paxton has filed a number of cases against Google, including over antitrust violations, the details of “incognito mode” and location tracking. “AG Paxton is once again mischaracterizing our products in another breathless lawsuit,” emailed a Google spokesperson.“We will set the record straight in court.”
The complaint seeks an injunction against further CUBI violations and the statutory damages allowed under the act: $25,000 per violation. Illinois’ BIPA law assesses up to $5,000 per BIPA violation. Last week, the first jury verdict in a BIPA case found BNSF Railway liable for 45,600 violations of the law -- $228 million -- one violation for each driver whose fingerprints BNSF scanned and collected. These statutes are taken “very seriously” by companies facing such lawsuits because of the danger of large payouts, said Rosenthal, who represents BIPA defendants. Those large verdicts and the recent settlements in such cases by Google and Facebook likely encouraged the Texas complaint, said Crowell and Moring attorney Jason Stiehl. Paxton is also running for re-election in November, Stiehl pointed out."These big verdicts and settlements show that people care about privacy," and Paxton's suit "means that enforcers are starting to take notice," said David Mindell at Edelson law firm, which represented the plaintiffs in the Facebook BIPA case. Privacy is a bipartisan issue, he said.
Google has spent years “unlawfully capturing the faces and voices of both non-consenting users and nonusers throughout Texas,” said the lawsuit. The complaint argues the Google Photos App, connected home device Nest Hub Max and Google Assistant capture the faces and voices of nonusers and minors who haven’t consented to data collection, and that Google stores that information for too long. CUBI requires informed consent before the capture of biometric data, and limits the amount of time that information can be held to “a reasonable time” not longer than a year from when the purpose of capturing the data expires. “In certain cases, users must manually delete recordings of their own voices, assuming a user even knows Google has stored such recordings,” the complaint said.
Face recognition features in the Google photos app help users organize pictures and can be easily turned off, the company said. “We do not use photos or videos in Google Photos for advertising purposes. The same is true for Voice Match and Face Match on Nest Hub Max, which are off-by-default features that give users the option to let Google Assistant recognize their voice or face to show their information,” the spokesperson said. The Texas complaint argues that “always on” features of the Nest Hub and other Google devices that scan for faces or voices take place “irrespective of whether such a non-user is aware of -- let alone consents to -- the scanning and recording.”
It’s not clear what tack Google would take to defend the case, but in the BIPA case Rivera v. Google, the tech company argued that photos aren’t biometric data under BIPA and that users had consented, though it eventually settled. Most state biometric privacy laws were written to facilitate the use of biometric data rather than prevent it, and allow expansive data collection with consent, said Rosenthal.
Unlike in Illinois, the Texas law doesn’t allow private action, so it’s unlikely to spawn a host of filings the way BIPA or the TCPA have, attorneys told us. But if Paxton is successful in the CUBI challenges against Meta and Google, it’s likely to encourage further biometric privacy cases in other states, Rosenthal and Stiehl said.