Jury Will Have to Decide Whether Apple Photos App Violates BIPA

The computer scientist Alan Kay reportedly said, “Technology is anything that wasn’t around when you were born.”  Well, there’s plenty that wasn’t around when Illinois enacted its Biometric Information Privacy Act in 2008, and in Doe v. Apple, Inc. a jury in the Southern District of Illinois will be asked to decide whether one of those things - the sophisticated system that allows iPhones to automatically identify and sort photographs of people – violates the statute by “biometric identifiers” or “biometric information” without informed consent. 

The Act defines “biometric identifiers” to include “a retina or iris scan, fingerprint, voiceprint, or scan of hand or face geometry” but specifically excludes “photographs” and “physical descriptions.”  “Biometric information” in turn consists of data based on biometric identifiers used to identify an individual. 

Photos taken using an iPhone are saved in Apple’s Photos app, which can use machine learning to organize and sort pictures into a “People” album where individuals can be identified and sorted automatically. Broadly speaking, the app first analyzes photos to detect faces, face landmarks and upper torsos and crops a portion of the image to include only those features.  It then applies a series of iterative analyses to the cropped image and ultimately generates a 128 decimal-point number that encapsulates significant features of the image in a condensed form. This output has been referred to as “faceprints,” though it is undisputed that these numbers do not reflect measurements between points on the face in the analyzed images. The facial recognition program in the app, however, can recognize similarities in images of the same person and can even prompt the user to tag the photographs with names or other identifiers.

On cross motions for summary judgment, the Court found that there was competing evidence regarding whether the data in the Photos app constituted are (1) scans of face geometry (2) capable of identifying a person and these questions therefore must be submitted to a jury. 

Technology has come a long way since 2008 when BIPA was enacted, and it’s safe to assume no members of that Illinois legislature anticipated the sophisticated machine-learning enabled analyses conducted by the devices so many of us now carry in our pockets.   Modern technology does not neatly fit into the definitions adopted nearly two decades ago.