Texas AG: Don’t Mess with Texans’ Biometric Info

Key Takeaway: In light of recent large BIPA settlements, companies should be cognizant of—and in compliance with—CUBI and other seemingly dormant state biometric privacy statutes, which could give rise to enforcement actions by state AGs.

On February 14, 2022, Texas Attorney General Ken Paxton lassoed Meta Platforms Inc., Facebook’s parent company, with a lawsuit under Texas’ Capture or Use of Biometric Identifier Act (“CUBI”). Enacted in 2009, CUBI regulates the collection and use of biometric information in the Lone Star State. Specifically, CUBI prohibits the capture of an individual’s “biometric identifier” for a “commercial purpose” absent the individual’s informed consent.^[1] The statute defines “biometric identifier” as “a retina or iris scan, fingerprint, voiceprint, or record of hand or face geometry.”^[2] Proving that everything is bigger in Texas, the penalties under CUBI are potentially enormous: violators are subject to up to $25,000 fine for each violation.^[3] However, only the Texas AG may enforce CUBI.^[4] And until now, there has been little to no enforcement of the statute’s provisions.

At issue in the Texas AG’s lawsuit is Facebook’s facial-recognition technology. The Texas AG’s Complaint alleges that this technology captures and stores the facial geometry of individuals—both Facebook users and non-users—from user-uploaded photos and videos. The Complaint alleges further that once a record of an individual’s facial geometry exists in Facebook’s database, the facial-recognition technology can identify that individual in later uploaded photos and videos. According to the Complaint, this enables Facebook to suggest to its users—with a high degree of accuracy—who to “tag” in their photos and videos. Although Facebook discontinued the facial-recognition technology in November 2021, the Complaint alleges that the technology captured the facial geometries of up to 20.5 million Texans before that point.^[5]

When it comes to state biometrics privacy laws, the Texas AG’s lawsuit is not Facebook’s first rodeo. The lawsuit arrives on the heels of Facebook’s $650 million settlement of a class action under Illinois’s Biometric Information Privacy Act (“BIPA”), which also involved Facebook’s facial-recognition technology.^[6] Like CUBI, BIPA prohibits a private entity from obtaining an individual’s “biometric identifier” (which it defines the same way as CUBI does) without their informed consent.^[7]

Despite their similarities, there are some significant differences between CUBI and BIPA. CUBI prohibits only the capture of biometric information for a “commercial purpose,” while BIPA contains no such limitation.^[8] BIPA requires an entity seeking to collect biometric information to obtain an individual’s “written release,” whereas CUBI requires only the individual’s “consent.”^[9] And most significantly, unlike CUBI, BIPA contains a private right of action, which enables individuals who experience the unlawful collection of their biometric information to sue for statutory damages.^[10] This provides a powerful incentive for the plaintiffs’ bar to enforce BIPA’s provisions.

Since CUBI does not deputize the plaintiffs’ bar to act as private attorneys general, lawsuits under the Texas statute will likely continue to be relatively rare. However, the Texas AG’s lawsuit could signal the start of a trend whereby state attorneys general, spurred on by the success of private plaintiffs, institute civil enforcement actions under their states’ respective biometric privacy laws in the wake of large BIPA settlements. Accordingly, companies should be aware of—and in compliance with—all potentially applicable biometric privacy laws, regardless of how frequently they are enforced.

---

_{[1] Tex. Bus. & Com. Code § 503.001(b).}

_{[2] Id. § 503.001(a).}

_{[3] Id. § 503.001(d).}

_{[4] Id.}

_{[5] See generally Pl.’s Pet. at 2, Texas v. Meta Platforms, Inc, f/k/a Facebook, Inc., Cause No. 22-0121 (Tex. Dist. Feb. 14, 2022).}

_{[6] Lauren Berg, $650M Facebook Privacy Deal OK’d, $110M Atty Fees Trimmed, Law 360 (Feb. 26, 2021, 9:08 PM), https://www.law360.com/articles/1359569.}

_{[7] 740 ILCS 14/15(b).}

_{[8] Compare Tex. Bus. & Com. Code § 503.001(b), with 740 Ill. Comp. Stat. 14/15.}

_{[9] Compare Tex. Bus. & Com. Code § 503.001(b)(2), with 740 Ill. Comp. Stat. 14/15(b)(3).}

_{[10] Compare Tex. Bus. & Com. Code § 503.001(d), with 740 Ill. Comp. Stat. 14/20.}