Meta to pay Texas $1.4 billion for using facial recognition technology without users’ permission

Sign up for The Brief, The Texas Tribune’s daily newsletter that keeps readers up to speed on the most essential Texas news.

Facebook’s parent company Meta will pay Texas $1.4 billion to settle a lawsuit that accused the company of using personal biometric data without users’ authorization.

The 2022 lawsuit, filed by Texas Attorney General Ken Paxton in state court, alleged that Meta had been using facial recognition software on photos uploaded to Facebook without Texans’ consent.

Paxton’s office said this is the largest settlement ever obtained by a single state and the largest related to privacy ever secured by a state attorney general. The settlement will be paid over five years. The attorney general’s office did not say whether the money from the settlement would go into the state’s general fund or if it would be distributed in some other way.

“This historic settlement demonstrates our commitment to standing up to the world’s biggest technology companies and holding them accountable for breaking the law and violating Texans’ privacy rights. Any abuse of Texans’ sensitive data will be met with the full force of the law,” Paxton said in a statement.

The settlement, announced Tuesday, does not act as an admission of guilt and Meta maintains no wrongdoing.

This was the first lawsuit Paxton’s office argued under a 2009 state law that protects Texans’ biometric data, like fingerprints and facial scans. The law requires businesses to inform and get consent from individuals before collecting such data. It also limits sharing this data, except in certain cases like helping law enforcement or completing financial transactions. Businesses must protect this data and destroy it within a year after it's no longer needed.

In 2011, Meta introduced a feature known as Tag Suggestions to make it easier for users to tag people in their photos. According to Paxton’s office, the feature was turned on by default and ran facial recognition on users’ photos, automatically capturing data protected by the 2009 law. That system was discontinued in 2021, with Meta saying it deleted over 1 billion people’s individual facial recognition data.

As part of the settlement, Meta must notify the attorney general’s office of anticipated or ongoing activities that may fall under the state’s biometric data laws. If Texas objects, the parties have 60 days to attempt to resolve the issue.

The most important Texas news,
sent weekday mornings.

Meta officials said the settlement will make it easier for the company to discuss the implications and requirements of the state’s biometric data laws with the attorney general’s office, adding that data protection and privacy are core priorities for the firm.

“We are pleased to resolve this matter, and look forward to exploring future opportunities to deepen our business investments in Texas, including potentially developing data centers,” a Meta spokesperson said Tuesday.

Meta has about a month to pay the first installment of $500 million to the state. Subsequent installments of $225 million each will be paid annually from 2025 to 2028.

Consumer Reports, a nonprofit consumer advocacy organization, commended Paxton for the lawsuit but noted it was an outliner. In a statement, the group said that states have brought too few cases against privacy violations.

“As companies compete to build large-scale AI models, the scramble for consumer data threatens to become a race to the bottom, so enforcement agencies must keep a watchful eye for unfair data collection practices,” said Matt Schwartz, a policy analyst at Consumer Reports.

The settlement comes at a time when big tech is growing its presence in Texas — and amid state efforts to regulate the industry.

Last year, state legislators passed the Texas Data Privacy and Security Act, which went into effect at the beginning of this month and requires businesses to get permission from users for processing sensitive personal data. It also grants consumers rights to access and delete their data as well as stop data collection.

The U.S. Supreme Court recently sent a legal challenge to Texas' social media law — which prevents large social media companies from censoring users' content based on political viewpoints — back to a lower court for further analysis.

Paxton sued Google in 2022, alleging that the company illegally stored data on facial geometry and voiceprints without informing users. Similar lawsuits in Illinois and Arizona resulted in substantial settlements.

In 2020, Texas led 15 states in an antitrust lawsuit against Google, which is expected to go to court next year. The state also participated in a separate lawsuit over Android app distribution and payment processing last year, with Google paying $700 million to settle. In addition, Google settled a deceptive advertising claim with Texas in 2023 for $8 million.

Texas has supported Epic Games' antitrust lawsuit against Apple, claiming the company’s app distribution and payment monopolization stifles competition.

Consumer Reports encouraged Paxton to pursue rigorous enforcement of the Texas Data Privacy and Security Act.

Disclosure: Apple, Facebook and Google have been financial supporters of The Texas Tribune, a nonprofit, nonpartisan news organization that is funded in part by donations from members, foundations and corporate sponsors. Financial supporters play no role in the Tribune's journalism. Find a complete list of them here.

The full program is now LIVE for the 2024 Texas Tribune Festival, happening Sept. 5–7 in downtown Austin. Explore the program featuring more than 100 unforgettable conversations on topics covering education, the economy, Texas and national politics, criminal justice, the border, the 2024 elections and so much more. See the full program.