The Amazon logo is displayed on a wooden podium with a city skyline in the background.
CHICAGO — Amazon will need to face a class action, with potentially more than $1 billion on the line, on behalf of potentially hundreds of thousands of Amazon Photos users whose faces may have been scanned in photos uploaded to the service, including users who allegedly continued to use the service with facial recognition enabled after they learned of the alleged improper face scans, a federal judge has ruled.
However, the judge refused to allow the class action to move forward on behalf of hundreds of thousands of other "non-users" whose faces may have also been scanned in the uploaded photos, as the judge said it would be nigh impossible to know if the "non-users" seeking a cut of any payout were actually imaged in uploaded photos.
On Nov. 10, U.S. District Judge John J. Tharp granted part of the plaintiffs' request and certified the "users" to move ahead with their class action against the tech and retail giant.
In the ruling, Tharp noted Amazon allowed Illinois users of its Amazon Photos service to decide if they wished to allow the Amazon program to scan and categorize the photos they uploaded based on the faces detected in the images. According to court documents, Amazon included a "toggle switch" and a "Notice to Illinois residents," informing users that by toggling the switch to "on," they were enabling a program under which "image recognition analysis will be performed on the photos stored in your account."
Further, the judge noted the lead plaintiff in the action, identified as Angela Hogan, had, at a minimum, kept the image recognition program in place to help organize her photos even after attorneys had informed her of the program's face scans, or may have even enabled the face-scanning program after being informed.
However, the judge said neither of those aspects of the case could be used by Amazon to prevent Hogan and her attorneys from converting the case into a class action that could potentially put Amazon on the hook for a payout potentially worth from $340 million to $1.7 billion.
Rather, the judge said it should be left to later proceedings and potentially a jury trial to determine if the notices and toggle switch Amazon provided satisfied the notice and consent requirements the plaintiffs said are needed under the Illinois Biometric Information Privacy Act (BIPA).
The ruling comes as the latest step in the long-running court fight.
Attorneys from several prominent class action law firms brought the legal action in 2021. Plaintiffs are represented in the case by lead counsel from the firm of Wexler Boley & Elgersma, of Chicago. They are supported by attorneys from the firms of Stephan Zouras, Keller Rohrback and Gustafson Gluek.
The lawsuit was filed nominally on behalf of Hogan and her minor son, identified only by his initials, B.H.
The lawsuit claims Amazon violated the Illinois BIPA law by allegedly not properly notifying users of its Amazon Photos service and obtaining their consent before allegedly scanning their faces imaged in photos uploaded to Amazon Photos.
The lawsuit sought potentially massive financial payouts on behalf of registered Amazon Photos users, like Hogan, and so-called "non-users" whose images were included in uploaded photos, like Hogan's child and others included in her photos.
The claims of the lawsuit were similar to those leveled in other big money class actions brought under the BIPA law against other social media and tech companies, including Facebook- and Instagram-parent Meta, Google, Apple, Microsoft and others.
Those lawsuits all generally accuse companies of alleged unauthorized scans of people's so-called unique "biometric identifiers," in this case, their faces.
Just as the other lawsuits, the suit against Amazon also seeks a potentially massive payday.
Under the BIPA law, plaintiffs are allowed to demand damages of $1,000-$5,000 per violation. The Illinois Supreme Court had interpreted the BIPA law to define individual violations as each time a company's software scans someone's face, fingerprint or other biometric identifier.
When multiplied across an unknown number of scans conducted on potentially thousands of plaintiffs, potential damages could have quickly soared into the many millions or even billions of dollars.
More recently, Illinois state lawmakers took action to reform the BIPA law to explicitly define an "individual violation" as being the first such allegedly improper scan. Thus, damages could only be multiplied per alleged victim, and not per scan.
And courts have interpreted those reforms to apply to lawsuits filed before the legislation was passed, such as the lawsuit against Amazon over the alleged Photos face scans.
However, even with the changes, the potential payout could be very large, running potentially into the hundreds of millions or even billions of dollars. Plaintiffs have noted the class action could include hundreds of thousands of users, with claims each worth $1,000 or $5,000.
Amazon has contested the lawsuit, but to this point has been unable to delete it. According to court documents, both sides have filed motions asking the judge to rule in their favor on the underlying claims of the lawsuit. However, Tharp has not yet ruled on those motions.
Rather, in his latest ruling, Tharp determined the plaintiffs can move ahead with their collective claims on behalf of potentially hundreds of thousands of Amazon Photos users.
The judge rejected Amazon's assertions that the class members' claims would be too different to allow them to proceed together, as the company said there would be no way to know how many of them had clicked the toggle switch to allow Amazon to scan their photos.
Amazon, for instance, noted that Hogan had done just that.
Further, the company asserted the notice and toggle should have been sufficient to defeat the claims against them.
But Tharp said he believed there were still enough elements common to all of the potential class claims to allow the class action to move forward.
"Amazon insists that 'informed consent' is an individualized issue, but this is not a subjective inquiry," the judge wrote. "The 'informed' piece concerns what notice Amazon provided and whether it comports with BIPA’s requirements. The 'consent' inquiry is whether the users provided a 'written release' through the processes Amazon made available—logging in or toggling a switch.
"Amazon focuses on whether individual users chose to read the Terms of Service and other notices, but BIPA is concerned with what information Amazon provided to allow for users’ informed consent."
The judge, however, refused to allow the class action to proceed on behalf of "non-users."
He said it would be all but impossible to determine which "non-users" had viable claims under BIPA.
While Amazon Photos registered users would know if they had uploaded photos of themselves with their faces clearly visible to the app, "non-users" would need to somehow prove they had been included, without simultaneously violating the privacy rights of other registered users by rifling through their photos collections in search of potentially scannable images, the judge said.
"Finding photographs of a person within a set (however large) of photographs of a single event is nothing like finding one stored in one or more of 900-million-plus photos in the 340,000 Amazon Photos accounts potentially at issue in this case," Tharp wrote.
"... The plaintiffs’ proposed class of non-users is simply too amorphous to be workable," he said.
Amazon is represented in the action by attorneys from the firm of Morgan Lewis & Bockius.
