Facebook's parent company, Meta Platforms, has agreed to pay a record $1.4 billion to settle a Texas lawsuit alleging illegal data collection. The suit, which alleged that Meta used facial recognition technology to collect biometric data on millions of Texans without their consent, was one of the most significant digital privacy cases in recent history.
Lawsuits and claims
The lawsuit was filed in February 2022 under Texas' Biometric Privacy Act and Unfair Trade Practices Act, both of which were enacted in 2009. The former law, known as the Capture or Use of Biometric Identifiers Act (“CUBI”), requires companies to obtain explicit consent from users before collecting biometric data, such as facial geometry or retinal data.
Texas Attorney General Ken Paxton led the charges against Mehta, accusing the company of “secretly obtaining, disclosing, unlawfully retaining and profiting from the most personal and sensitive information of Texans – records of facial geometry, which Texas law refers to as biometric information.”
According to the complaint, Meta used this data contained in uploaded photos and videos to train and enhance its facial recognition technology, enabling it to develop a “powerful artificial intelligence (“AI”) device that can reach every corner of the world and capture even people who purposefully avoid using Facebook's services.”
Paxton also said the company commercially profited from selling users' personal biometric information to third parties for “further misuse.”
Texas argued that Meta's actions were a serious violation of privacy rights and could result in fines of up to $25,000 for each instance of biometric data collection. The lawsuit said Meta's violations could amount to billions of dollars, theoretically exposing the company to hundreds of billions of dollars in fines.
The violations began in December 2010, when the company introduced a “tag suggestion” feature ostensibly designed to make it easier for users to tag friends in photos. As a result, “by June 2011, Facebook had covertly enrolled millions of people in Texas in its facial recognition system without their consent,” the complaint states.
Facebook announced that it would disable its facial recognition system and delete more than 1 billion facial recognition templates in 2021. At the same time, the company said it would continue to use facial recognition for certain purposes, such as helping users regain access to locked accounts, verifying identity for financial products, and unlocking personal devices.
Reconciliation and response
On Tuesday, Mehta and Texas reached a settlement agreement just weeks before the trial was set to begin.
The $1.4 billion settlement is the largest ever paid to a single state in a data privacy case, surpassing the $650 million settlement Meta paid in a similar case in Illinois in 2020. Despite the huge settlement, Meta continues to deny any wrongdoing.
The settlement was announced by Ken Paxton, who hailed it as a major win for Texas, saying:
“This historic settlement demonstrates our commitment to standing up to the world's largest technology companies and holding them accountable for violating the law and violating the privacy rights of Texans. Any misuse of Texans' sensitive data will be met with the force of the law.
In a press release, Paxton also cited “several historic efforts, including antitrust litigation and aggressive enforcement of privacy laws,” including his lawsuit against Google for illegally collecting users' biometric data, just as he did with Meta. That case is still pending.
A Meta spokesperson expressed relief that the incident was resolved, telling CNBC the company was “pleased to have this matter resolved” and looked forward to exploring future business opportunities in Texas, including the potential development of a data center.
As part of the settlement, Meta is required to report to the Texas Attorney General's Office any current or proposed activities that may be subject to Texas' biometric data law. If Texas objects, the parties will have 60 days to resolve the issue.
Mehta must make an initial payment of $500 million to the state next month, after which the company will make annual payments of $225 million from 2025 to 2028.
Texas, Technology, Data Privacy
The Meta settlement comes as Texas steps up its oversight of Big Tech and as tech companies expand their operations in the state, particularly as they are attracted by the state's business-friendly environment and growing tech ecosystem.
Companies like Meta, Google, and Apple are expanding their presence through new office space, data centers, and even corporate campuses. For example, Meta has announced plans to invest in its data centers, and Google is expanding its offices and cloud computing infrastructure in Texas. Additionally, Elon Musk recently relocated the headquarters of his tech giants, SpaceX and X (formerly Twitter), to Texas, joining Tesla, further positioning Texas as a fast-growing technology hub.
Last year, Texas enacted the Data Privacy and Security Act, a sweeping law that requires companies to get user consent before processing sensitive data and gives consumers the right to access, delete, and opt-out of data collection.
Additionally, Texas is embroiled in various legal battles with major tech companies, including a lawsuit against Google over illegal data storage practices and an ongoing antitrust case targeting both Google and Apple for monopolistic behavior.
The Texas-Meta settlement is part of a broader trend to resolve high-profile biometric data privacy lawsuits involving companies including Clearview AI, Tesla, BNSF Railway, Amazon and TikTok.
In addition to Texas, several other states have enacted biometric data privacy laws, including California, New York, Illinois and Washington. Currently, there is no comprehensive federal law that specifically regulates the collection and use of biometric data in the United States.
