Vimeo collected detailed facial scans without consent, lawsuit alleges
Vimeo is collecting and storing thousands of people’s facial biometrics without their permission or knowledge, a recently filed lawsuit alleges.
The “highly detailed geometric” facial maps, according to a complaint, are being collected and stored in violation of the Illinois Biometric Information Privacy ACT, or BIPA, according to a complaint filed last week in Illinois state court. The law bars companies from obtaining or possessing an individuals’ biometric identifiers or information unless the company (1) informs the person in writing of its plans to do so, (2) states in writing the purpose and length of term for the collection and storage, (3) receives written permission from the user, and (4) publishes retention schedules and guidelines for destroying the biometric identifiers and information.
The complaint alleges Vimeo is violating the law by collecting, storing, and using the facial biometrics of thousands of unwitting individuals throughout the United States whose faces appear in photos or videos uploaded to the Magisto video-editor application. Vimeo acquired Magisto in April and claimed the editor had more than 100 million users.
“Vimeo has created, collected, and stored, in conjunction with its cloud-based Magisto service, thousands of ‘face templates’ (or ‘face prints’)—highly detailed geometric maps of the face—from thousands of Magisto users,” the complaint alleged.
The complaint adds:
Vimeo creates these templates using sophisticated facial-recognition technology that extracts and analyzes data from the points and contours of faces that appear in photos and videos taken on mobile devices and uploaded to the Magisto app. Each face template that Vimeo extracts is unique to a particular individual, in the same way that a fingerprint or voiceprint uniquely identifies one and only one person.
The complaint referred to this page that says that Magisto uses “artificial intelligence engines” to analyze videos users upload. The analysis includes “face detection.”
The complaint continued:
Unbeknownst to the average consumer, and in direct violation of § 15(b)(1) of the BIPA, plaintiff is informed and believes that Magisto’s facial recognition technology scans each and every video and photo uploaded to Magisto for faces, extracts geometric data relating to the unique points and contours (i.e., biometric identifiers) of each face, and then uses that data to create and store a template of each face—all without ever informing anyone of this practice.
The Magisto service uses these face templates to organize and group together videos based upon the particular individuals appearing in the videos. This technology works by comparing the face templates of individuals who appear in newly-uploaded videos or photos with the facial templates already saved in Magisto’s face database. Specifically, when a Magisto user uploads a new video or photo, Magisto’s sophisticated facial recognition technology creates a template for each face depicted therein, and then compares each template against Magisto’s face template database. If there is a match, then the Magisto service groups the video from which the newly-uploaded face template was derived with the previously uploaded videos depicting that individual.
Besides using face templates to identify individuals, the service also uses the biometrics to determine the individuals’ gender, age, and location.
The complaint was filed on behalf of Illinois resident Bradley Acaley, who subscribed to Magisto for one year, starting in December 2017, at a cost of $120. He regularly uploaded videos of himself and his family, including his minor children. He would then edit the uploaded videos or create videos from uploaded photos or videos.
Vimeo analyzed Acaley’s videos and photos “by automatically locating and scanning plaintiff’s face and by extracting geometric data relating to the contours of his face and the distances between his eyes, nose, and ears—data which Vimeo then used to create a unique template of plaintiff’s face,” the complaint alleged. Vimeo also used the data to recognize Acaley’s gender, age, race, and location.
The complaint said that Acaley never received notice of this collection or storage of his biometrics and that he never provided his consent.
Attempts to reach Vimeo representatives for comment were unsuccessful. The company didn’t own Magisto at the time Acaley used it, but Vimeo possibly assumed all legal liabilities when it acquired the video-editing service. If that question ever gets sorted out, it will be interesting to see how the court treats the issue of cloud services using facial-recognition analysis to analyze images and videos users willingly uploaded.
