Facebook can probably recognize that its users’ faces are angry.
A federal judge in California ruled Monday that a suit against the Silicon Valley giant over is facial recognition tools could proceed as a class action.
Nimesh Patel started his suit against Facebook back in 2015 for violations of the Illinois Biometric Information Privacy Act, which protected citizens data by requiring informed consent to gather biometric information such as about their faces.
Patel particularly took aim at the “tag suggestion” feature launched in 2011, where Facebook, using data about the faces in a photo, suggests friends or others that should be tagged.
Beyond saying that Facebook gave users no notice, the suit also notes that Facebook did not give those on its platform any information about how long the information would be held, also required by the BIPA.
Federal judge James Donato, based in San Francisco, ruled Monday that a class action lawsuit would be the best way to deal with the issue, though participants are limited to those who lived in Illinois and were the subjects of a Facebook “face template.”
Facebook is believed to have a collection of face data far greater than law enforcement authorities, any some have worried about it potentially being used to identify people in public spaces such as at protests.
The company also filed a patent in 2014 for technology that lets it provide certain types of content to users based off of reading their emotions with a camera in their computer or phone.
The legal move on Monday comes as Facebook has come under scrutiny for how it handles users data, particularly after revelations that consulting firm Cambridge Analytica harvested up to 87 million people’s information, many without consent.
Zuckerberg was questioned on Capitol Hill last week, though has demurred about whether the country needs federal regulations to protect privacy, which would likely include elements of Illinois’s law.
As the scandal unfolded the Electronic Privacy Information Center said that it would challenge Facebook’s use of facial recognition with the Federal Trade Commission.
Broad regulation coming into effect in Europe next month also gives citizens a set of rights over their data, including limitations on what it can be used for and a requirement for clear explanation when it is taken.
Facebook has said it will comply with the General Data Protection Regulation, or GDPR, and apply the spirit of the law outside Europe, but it has also faced criticism about whether it gives a real choice to users.
Cambridge University researcher Jennifer Cobbe pointed out Monday that Facebook users in Europe are confronted with a page asking for consent for facial recognition, but that the first page has no option for “no” and it is only possible to deny access by navigating through a series of settings menus.