Insights & Analyses

Google takes aim at controversial, stringent Illinois biometric privacy law

Amid heightened scrutiny over data collection practices, lobbyists working for Alphabet, the parent company of search giant Google, are pushing to reduce the reach of the strongest consumer privacy law in America.

The 10-year-old Illinois Biometric Information Privacy Act regulates the use of technology that reads a user’s fingerprint, iris or face. Alphabet seeks to exempt photos from the law, according to Bloomberg, after it triggered more than 140 lawsuits in the last four years.

For their part, politicians who have met with Google lobbyists say they want to find a middle ground where user privacy is prioritized, but people aren’t restricted from accessing new apps and services.

They noted that the popular Google Arts & Culture app, which uses facial recognition algorithms to find a piece of classic art similar to the user’s face, was not released in Illinois because of the BIPA law.

In addition, Nest — which is also owned by Alphabet — does not offer facial recognition capabilities in its doorbell camera in Illinois due to the local law, despite the fact that residents in other states can access that capability.

Unsurprisingly the efforts have drawn concern from privacy advocates, who cite the fact that BIPA gives workers more control over how their biometrics are used. For example, Adam Schwartz, a lawyer with the Electronic Frontier Foundation, noted to the Chicago Tribune that employers in the state can use employee fingerprints for clocking in, but BIPA ensures workers must first provide consent before they can do so.

The proposed changes would only require consent if biometric data is kept for more than 24 hours, and it would only protect the data if it is linked to “confidential and sensitive information,” like a Social Security number.

OWI Take: This case will be one to watch as legislators at both the state and federal levels consider measures to curb data collection from the likes of Google and Facebook. A law that bars a simple, fun facial recognition app obviously goes too far, but it’s also clear that technology companies alone cannot be trusted without greater levels of transparency regarding data collection. The outcome of this debate in Illinois could be an indication for any legal changes — or lack thereof — to come in the U.S.