Become a fan of Slashdot on Facebook

 



Forgot your password?
typodupeerror
Check out the new SourceForge HTML5 internet speed test! No Flash necessary and runs on all devices. ×
Facebook Privacy Social Networks

Facebook, Shutterfly Face Lawsuits For Using Facial Recognition To ID Photos (computerworld.com) 58

Lucas123 writes: A federal judge has denied a motion by Shutterfly to dismiss a civil case against it claiming it violated privacy laws by collecting and scanning face geometries from uploaded images without consent. The plaintiff in the case, Brian Norberg, alleges he was never a member of Shutterfly and that other people uploaded photos that included his image. Facebook faces a similar lawsuit for its photo "tag suggestions" feature, but there has as yet been no judgement in the case. In his Shutterfly case ruling, U.S. District Court Judge Charles R. Norgle rejected the website's argument that only in-person scans of people's faces are covered under the Illinois Biometric Privacy Act, which states that no private entity may collect, capture, purchase, receive through trade, or otherwise obtain a person's or a customer's biometric identifier or biometric information with out their consent.
This discussion has been archived. No new comments can be posted.

Facebook, Shutterfly Face Lawsuits For Using Facial Recognition To ID Photos

Comments Filter:
  • by Anonymous Coward

    Face book Facing a lawsuit about faces.

    Oh the irony is so thick I could make a mud hut out of it.

  • by Kelson ( 129150 ) on Friday January 08, 2016 @09:31PM (#51266499) Homepage Journal

    It lets you search your own photos by person using facial recognition to group photos of the same person together, but it's pretty clear up-front that's what it's doing. Of course, that's up-front to the person *taking* the pictures, not to the person *in* the pictures, so it might run into the same issue with the Illinois law.

  • by ooloorie ( 4394035 ) on Friday January 08, 2016 @09:45PM (#51266547)
    Face recognition these days uses a lot of deep learning. Deep learning does not use "biometric identifiers" or "face geometry", it operates on the images directly. Furthermore, other than the photos themselves, no biometric information is "collected, captured, purchased, received through trade, or otherwise obtained". So, either the Illinois law considers all photos containing faces "biometric identifiers" and outlaws their distribution without the consent of the person (questionable in light of the First Amendment), or there is a real problem with the law and its interpretation.
    • by raymorris ( 2726007 ) on Friday January 08, 2016 @09:55PM (#51266575) Journal

      The law under which the suit was filed:
      http://www.ilga.gov/legislatio... [ilga.gov]

      The law lists what is and what is not a "biometric identifier ":

              "Biometric identifier" means a retina or iris scan,
                fingerprint, voiceprint, or scan of hand or face geometry.
                Biometric identifiers do not include writing samples,
                written signatures, photographs,

      • The law under which the suit was filed:
        http://www.ilga.gov/legislatio... [ilga.gov]

        The law lists what is and what is not a "biometric identifier ":

        "Biometric identifier" means a retina or iris scan,
        fingerprint, voiceprint, or scan of hand or face geometry.
        Biometric identifiers do not include writing samples,
        written signatures, photographs,

        And yet, Facebook doesn't just store photographs, if Facebook only stored photographs, then it would have a heck of a time trying to query information every time there was a Facial Recognition query.

        It's just like Shazam, while I am sure that Shazam possesses the music track of every possible song out there. There is a lot processing, analysis, and audio indexing/voice printing that is done on those music tracks so that Shazam is able to recognize a music track in a room full of ambient noise or recognize a

    • by Anonymous Coward

      Face recognition these days uses a lot of deep learning. Deep learning does not use "biometric identifiers" or "face geometry", it operates on the images directly. Furthermore, other than the photos themselves, no biometric information is "collected, captured, purchased, received through trade, or otherwise obtained".

      So, either the Illinois law considers all photos containing faces "biometric identifiers" and outlaws their distribution without the consent of the person (questionable in light of the First Amendment), or there is a real problem with the law and its interpretation.

      The law deals with "biometric identifiers" as well as "biometric information" and perhaps this lawsuit will hinge on the definitions of the words "scan" and "face geometry". The judge is right to not dismiss the case, both sides should be allowed to determine what "scan" and "face geometry" means here. But the first half of the law lays out the intent of the legislature and it's pretty clear that they don't want private entities to be able to identify you based upon your biological attributes without you

      • But the first half of the law lays out the intent of the legislature and it's pretty clear that they don't want private entities to be able to identify you based upon your biological attributes without you consenting to them doing so.

        Well, the fact is that "private entities" can identify people based on facial photographs, so their legislative intent is irrelevant: either they have to forbid the sharing of facial photographs, or they have to accept that "private entities" can identify people based on them

      • The law deals with "biometric identifiers" as well as "biometric information" and perhaps this lawsuit will hinge on the definitions of the words "scan" and "face geometry"

        Rereading the law, its intention is to safeguard biometric identifiers for recognition. If you apply the intent of the law to facial identification, you would have to outlaw publishing any photograph with a name attached to it, because any photograph with a name attached to it serves as a biometric identifier. But the law then contradic

      • The law also says:
        "... Biometric information does not include information derived from items or procedures excluded under the definition of biometric identifiers"

        So, any information derived from photographs (items excluded under the definition of biometric identifiers), is not biometric information.

        Since they derived all this information from photographs, it's explictly NOT biometric information.

    • by WarJolt ( 990309 )

      Face recognition these days uses a lot of deep learning. Deep learning does not use "biometric identifiers" or "face geometry", it operates on the images directly.

      It's funny that Deep learning has turned into this new buzzword. It helps to use it correctly. I doubt that most face recognition uses deep learning since deep convolutional neural networks require a large training set to train them. Additionally, they would have issues handling views that have never been seen before. Deep learning is a type of machine learning, but there are other types as well. Read the OpenCV tutorial on face detection. None of those examples use deep learning.

      Even when using machine lea

    • Sorry kiddo, but you refuted yourself.

      ... other than the photos themselves, no biometric information is "collected, captured, purchased, received through trade, or otherwise obtained".

      Right. The only part that breaks the law is the part that is accused of breaking the law.

      Basically what you're saying is just like saying: "Gosh, there is a big flaw in this case, the only thing I stole was the stuff inside the box. I also left the store with a complimentary bag, so since part of what I took wasn't stolen, everything is OK. Right?"

      Yes, the photos are the part that contain the "face geometry." That is correct. It is a simple identity issue; is yes the s

      • The problem is, the law is worded as "scan of ... face geometry" and then excludes photographs entirely. These services are deriving their own facial geometry from the photographs, they are not having scans of facial geometry submitted to them, so this should be quite easily defeated at trial.

        • I'm not so sure on this.
          A photograph is not biometric information just because it is a photograph, you could have 1000's of photographs. After analysing the photographs you can then have biometric data from the face geometry which could be illegal.

          I can grow poppies at home, it is not illegal to have poppies even though they contain opium.
          However if I process these poppies to extract the opium I would then be in violation of a bunch of drug laws. Opium is a class A drug which would attract severe penalties.

          • If you can analyse what is essentially public knowledge, why should that ever be illegal?

            As I said before, the law that covers this specifically says "scans of...", which to me means biometric data created specifically and directly - deriving the same information from an exempt source, namely a photograph, seems fine to me.

            Its not illegal to take a photo of you. It should not be illegal to put a name to the contents of that photo, not should it be illegal to derive identifying data from that photo - your fe

        • Right, the photograph itself, not having been run through an identity-extractor program, is explicitly not a biometric identifier. But whatever the computer software is internally generating in order to make an identification is. The act of automatically identifying people with the machine implies additional steps where biometric identifiers are extracted. As they say, "the proof is in the pudding." Can it identify people, or not?

          • That doesnt make it illegal under the law tho - processing the photo to generate biometric data does not fall under the auspices of what is controlled by the law in this case

      • Biometry in general is the statistical study ...

        And there is your problem: you don't understand what the law is actually about. Yes, in a generic sense, deep learning creates numbers that identify people biometrically internally. Those numbers are not "biometric identifiers" within the meaning of the law. The law is intended to protect people from identity theft by protecting their "biometric identifiers". There are some well defined "biometric identifiers" for faces, but Facebook or Shutterfly are not us

    • Deep learning does not use "biometric identifiers" or "face geometry", it operates on the images directly.

      That's a tough argument to make, because images of people's faces will correlate with people's faces.

      For instance, a neural network may not have any notion that two eyes (or two pupils) have a proportional distance with another characteristic of the face, but that doesn't mean it can't infer biometric identifiers from images (if given enough sample images and given enough users that are willing to train it by tagging other users and conveniently framing those faces in each sample image given).

      After all, som

      • The law explictly excludes any data derived from photos: "... Biometric information does not include information derived from items or procedures excluded under the definition of biometric identifiers."

        Since they derived all this information from photographs, it's explictly NOT biometric information.
        So, this lawsuit shouldn't have been heard, as they are clearly deriving all their information from "items excluded under the definition of biometric identifiers" (photographs)

      • That's a tough argument to make, because images of people's faces will correlate with people's faces.

        No, I'm making a very simple argument, actually. There are things called "biometric identifiers" and "face geometry", and they are not just "biometric information that can be used to identify you".

        A "biometric identifier" is a well-defined set of numbers used by a "biometric identification system", and within the scope of the law, that amounts to something used for access control and similar purposes ("f

    • That argument is bullshit from someone who doesn't understand machine learning (let alone "deep" learning).

      You can use a machine learning face recognition system to identify "face geometry" features trivially, simply by using the output of the system with a postprocessing layer. The combined system is a system which collects "face geometry". As such, the black box nature of Shutterfly's system doesn't preclude the claimed illegal behaviour. Frankly, the only evidence that Shutterfly and Facebook don't bre

    • by mikael ( 484 )

      Deep learning is based on "neural networks", which is basically saying "Oh, let the software work it out for itself what the important attributes are". How do you know a neural network isn't creating it's own biometric identifiers or "feature vectors"? It has to create some way of measuring the attributes of a face then determining how closely two faces match. There were papers on Eigenfaces in the past which developed sets of monochrome filters to measure different attributes of a face.

      • How do you know a neural network isn't creating it's own biometric identifiers or "feature vectors"?

        A "biometric identifier" isn't just "biometric data that identifies you", it's an explicit piece of data you can use to let a biometric system verify your identity. The law is intended to address a particular (supposed) weakness of "biometric identifiers" in biometric identification systems, namely that they can't be reissued if compromised. That simply doesn't apply to Facebook's use of face recognition, o

    • I am sure we would all be happy to publicly inspect Google's face recognition algorithm to be sure that it only uses authorized techniques.
    • Your argument runs smack into a principle of jurisprudence that says that the court should not read a law in such a way as to make it nonsensical if there's any other plausible reading of it. All biometric ID systems work off of photos (usually digital) taken by the imaging sensor. All scans of face geometry work off of a digital photo from the imaging sensor. The image of the face needs turned into digital data so it can be processed to produce the biometric ID or face geometry data, which means turning th

      • So by your reading no biometric identifiers and no uses of them could be outlawed.

        Any and all biometric identifiers that can't be derived from regular media can be outlawed.

        And there is another plausible reading: that photographs and things derived from them are not covered by the law as long as they aren't processed into biometric identifiers.

        You could pass such a law, but it doesn't serve the stated purpose of the law, namely to protect people from theft of their biometric identifiers.

        Your reading of

    • by DedTV ( 1652495 )

      So, either the Illinois law considers all photos containing faces "biometric identifiers"

      It doesn't. The Illinois law they're using to sue considers face geometry scans a "biometric identifier", but it specifically excludes photographs as biometric identifiers.
      The plaintiffs are claiming that the defendants digitally "scanned" the facial geometry from the photos, which exposes an ambiguity in the law and a Federal judge basically said he wasn't going to resolve ambiguities within the state's statute and left the issue in the hands of the state courts.

      In the end, the suit is likely to fai

      • The Illinois law they're using to sue considers face geometry scans a "biometric identifier"

        The Illinois law has a stated purpose, namely that of preventing theft of biometric identifiers. As far as face-based biometrics is concerned, that purpose could be served by outlawing attaching names to photographs without consent (with obvious First Amendment issues); it is not served by preventing Facebook from recognizing people in photographs by any means they like.

        It doesn't.

        It excludes face photographs, bu

  • Hows the dick recognition software coming?
  • Facebook, Shutterfly Face Lawsuits For Using Facial Recognition To ID Photos.

    I read that as "Facebook, Fluttershy face lawsuits..."

    I'm glad she's not being sued. <whisper>Yay!</whisper>

Happiness is a hard disk.

Working...