Tech industry wants your face, but not your permission

If companies have data, the government comes to get it.

That's the lesson Jennifer Lynch drew from the disclosures made by former NSA analyst Edward Snowden and her own work as a staff attorney at the Electronic Frontier Foundation.

"If companies start collecting this face recognition data, the same scenario will happen," Lynch told DW. "Law enforcement will try to get access to that data, the FBI will try to get access to that data."

As facial recognition technology advances and the applications diversify, the Obama administration has introduced a Consumer Privacy Bill of Rights. The White House also facilitated talks between consumer advocates and industry to create rules of the road for using facial recognition technology.

But the privacy bill has stalled in Congress. And after 16 months, consumer advocates walked out of stakeholder talks on Tuesday, accusing the industry of not accepting the principle of consumer consent.

Lynch joined the walkout and signed a statement with eight other consumer advocates stating their reasons. The aborted talks had taken place under the auspices of the National Telecommunications and Information Administration (NTIA)

"The position that companies never need to ask permission to use biometric identification is at odds with consumer expectations, current industry practices, as well as existing state law," Lynch and her colleagues wrote in their joint statement.

Licata v. Facebook

Specifically, the law in the states of Illinois, where a man named Carlo Licata has filed a class action lawsuit against Facebook over its Tag Suggestions option.

Introduced in 2010, Tag Suggestions uses facial recognition software. The world's largest social network scans photos, uploaded by its more than one billion active users, for human faces and then compares those faces with templates stored in its database.

Based on the comparison, it recommends people to tag - or publicly identify - in the photos that users post in their albums and timelines.

Unlike most of the United States, Illinois adopted a law in 2008 called the Biometric Information Privacy Act (BIPA), which requires companies to obtain the consent of consumers before collecting their biometric data. Texas is the only other state that has such a law.

The Illinois class action lawsuit accuses Facebook of concealing the use of software to collect biometric information from its users.

It's the first case filed under BIPA. And according to Jay Edelson, a win would have "a profound ripple effect on the industry."

"Generally, these types of suits - that are successful - end up changing practices across the board," Edelson, one of Carlo Licata's attorneys, told DW. "Probably not internationally, but at least in the United States."

Technological advances

It doesn't stop with Tag Suggestions. Facebook is developing more advanced software called DeepFace, which recognizes human faces 97.35 percent of the time. That's almost as accurate as the human eye.

Facebook also introduced a smartphone app called Moments on Monday. It allows friends to create private groups and sync their photos between devices. The app uses facial recognition technology to identify the group members in the photos.

Facebook, of course, is not alone in developing this kind of technology.

With the app NameTag, anyone who carries a smartphone or wears Google Glass can supposedly identify strangers with the snap of a photo. Microsoft is developing in-store signs that recognize a shopper's face and target advertising based on their preferences.

According to Lynch, one of the concerns is that as commercial enterprises hone this technology, the government will became interested in its security applications. The FBI is already building a biometric database called Next Generation Identification (NGI).

"In many cities today, downtown is blanketed by surveillance cameras," she said. "Most of the footage that is collected is grainy and is taken from above. It's hard to identify people, but in the future those problems will be fixed."

"There's a potential that face recognition technology will be tied into those camera systems," she said.

'Skittish about the public'

Right now, consent policies for collecting biometric data and using facial recognition technology vary by company.

Facebook has an opt-out policy, meaning users must actively tell the social network to leave their biometric data alone. In the case of Google and Microsoft, by default users don't participate in biometric data collection. They must opt in.

All three companies were present at the aborted stakeholder talks. The official aim was to forge voluntary, industry-wide privacy standards. But even Microsoft wouldn't openly call for the broader industry to adopt its opt-in standard.

The software company said it would support industry-wide opt-in only if there's a consensus. Facebook and Google didn't respond to requests for comment.

But a consensus is unlikely to emerge. According to Edelson, the problem is that companies like Facebook have made their fortune by collecting and monetizing private information.

"Because of that they are simultaneously incredibly incentivized to try to grab more of that information and monetize it and incredibly skittish about the public finding out about that," he said.