Meta Platforms, the parent company of Facebook, has agreed to pay a record-breaking $1.4 billion to settle a lawsuit brought by the state of Texas over allegations of illegal data collection. The lawsuit, which accused Meta of using facial-recognition technology to capture the biometric data of millions of Texans without their consent, was one of the most significant cases in the realm of digital privacy in recent years.
Lawsuit and Allegations
The lawsuit was filed in February 2022 under Texas’ biometric privacy law, which was enacted in 2009, as well as under the Deceptive Trade Practices Act. The former law, known as the Capture or Use of Biometric Identifier (“CUBI”), mandates that companies obtain explicit consent from users before collecting biometric data, such as facial geometries and retinas.
Texas Attorney General Ken Paxton led the charge against Meta, accusing the company of “secretly capturing, disclosing, unlawfully retaining — and profiting off of — Texans’ most personal and highly sensitive information: records of their facial geometries, which Texas law refers to as biometric identities.”
According to the lawsuit, Meta used this data, which was contained in uploaded photos and videos, to train and enhance its facial-recognition technology that enabled the development of a “powerful artificial technology (‘AI’) apparatus that reaches all corners of the world and ensnares even those who intentionally avoided using Facebook services.”
Paxton also said that the company benefited commercially from selling the personal biometric information of its users to third parties, “who further exploited it.”
Texas argued that Meta’s actions represented a gross violation of privacy rights, with each instance of biometric data collection potentially subject to fines of up to $25,000. The lawsuit stated that Meta’s violations numbered in billions, theoretically exposing the company to hundreds of billions in potential fines.
The violation began as early as December 2010, when the company introduced its “Tag Suggestion” feature, ostensibly designed to make it easier for users to tag friends in photos. As a result, “by June 2011, Facebook had secretly forced millions of Texans into a facial-recognition scheme without their consent,” according to the lawsuit.
Facebook announced in 2021 that its Facial Recognition system was disabled, and more than a billion individual facial-recognition templates were deleted. At the same time, the company said it would continue using facial recognition for specific purposes, such as helping users regain access to locked accounts, verifying their identity for financial products, or unlocking personal devices.
Settlement and Reactions
On Tuesday, Meta and Texas reached a settlement agreement just weeks before the case was scheduled to go to trial.
The $1.4 billion settlement marks the largest payout ever to a single state in a data privacy case, surpassing Meta’s previous $650 million settlement in a similar case in Illinois in 2020. Despite the enormous settlement amount, Meta has continued to deny any wrongdoing.
The settlement was announced by Ken Paxton, who hailed it as a significant victory for Texas, stating,
This historic settlement demonstrates our commitment to standing up to the world’s biggest technology companies and holding them accountable for breaking the law and violating Texans’ privacy rights. Any abuse of Texans’ sensitive data will be met with the full force of the law.
In the press release, Paxton also reminded about his “several historic initiatives, including antitrust lawsuits and aggressive enforcement of privacy laws.” These include Paxton’s lawsuit against Google, which, similarly to Meta, unlawfully captured the biometric data of its users. That case is still pending.
A spokesperson for Meta expressed relief at the resolution of the case, stating to CNBC that the company was “pleased to resolve the matter” and was looking forward to exploring future business opportunities in Texas, including the potential development of data centers.
As a part of the settlement, Meta is required to inform the Texas Attorney General’s office about any current or planned activities that could be subject to the state’s biometric data laws. If Texas raises objections, both parties have a 60-day window to resolve the issue.
Meta is required to make an initial payment of $500 million to the state within the next month. Following this, the company will make annual payments of $225 million each from 2025 through 2028.
Texas, Tech, and Data Privacy
The settlement with Meta occurs as Texas strengthens its oversight of Big Tech, particularly as tech companies, drawn by business-friendly environment and growing tech ecosystem, expand their operations in the Lone Star State.
Companies such as Meta, Google, and Apple have been increasing their presence through new office spaces, data centers, and even corporate campuses. For example, Meta has announced plans to invest in data centers, and Google has been expanding its offices and cloud-computing infrastructure in the state. Additionally, Elon Musk has recently moved headquarters of his tech giants SpaceX and X (formerly Twitter) to Texas, joining Tesla, further highlighting Texas as a burgeoning tech hub.
Last year, Texas enacted its Data Privacy and Security Act, a comprehensive law requiring businesses to obtain user consent for processing sensitive data and providing consumers the right to access, delete, and opt out of data collection.
Additionally, Texas is involved in various legal battles with tech giants, including a lawsuit against Google over illegal data storage practices and ongoing antitrust cases targeting both Google and Apple for monopolistic behavior.
The Texas-Meta settlement is part of a broader trend of resolving high-profile biometric data protection lawsuits, with similar cases involving companies such as Clearview AI, Tesla, BNSF Railway, as well as Amazon and TikTok.
Besides Texas, several other states have biometric data privacy laws, including California, New York, Illinois, and Washington. Currently, there is no comprehensive federal law specifically governing the collection and use of biometric data in the United States.
