Hot on the heels of a $85 million settlement in Arizona, and amidst suits in several other states over its location tracking practices, Google faces more state-level legal trouble as the Texas attorney general’s office is taking it to court for violating a state biometric privacy law that has been active for over a decade.
The suit represents millions of Texas residents that have used Google services since 2015. The state requires that consent be collected from biometric data subjects to use their faces or voices, something that Google allegedly did to feed the machine-learning algorithms of a variety of its commercial products.
Texas biometric data suit involves use of Google Photos, voice Assistants
The Texas AG suit names Google Photos, Assistant and Nest Hub as services that allegedly scooped up biometric data without informing the end user. Google’s central counter-argument to the suit is that the services allow users to turn off biometric data collection, though it does not appear that the named services always have it off by default.
State laws that specifically protect biometric data this way are relatively rare; Illinois is the lone state that allowed one to be wielded against big tech companies, with a series of big settlements in recent years hitting companies like TikTok, Facebook and Snap for tens of millions of dollars each. Google itself settled a biometric data suit in Illinois in April of this year for $100 million (involving the use of material uploaded to Google Photos to inform its automatic photo-grouping feature).
Texas has had a law on the books since 2009 that has some similarities to the protections offered in Illinois: the Capture or Use of Biometric Identifier (CUBI) Act. The key difference is that individuals cannot initiate class action suits in Texas using this law as a basis. The attorney general must bring the case, and it has not opted to do so before now. The Texas suit reiterates some of the claims that Google settled over in Illinois, but adds the company’s similar use of biometric data in its voice-activated products, primarily the Nest family of smart home devices.
The Texas AG argues that Google captures not just the biometric data of the device or app users, but also people in their periphery that cannot reasonably give consent: for example, friends and family in the background in pictures uploaded to Photos, or the voice prints of those that stop by and visit a house that has Nest gadgets active. If the company captures photos or voice prints of anyone, CUBI requires that they be informed and have their consent provided before these materials can be stored.
In a state with a population of over 29 million, Google could be facing fines of up to $25,000 per violation. Violations under CUBI include not just the actual act of taking the biometric data without consent, but also storing data that has been legitimately collected for more than one year (or longer than a “reasonable time” for the purpose of the data collection). The suit is also seeking an injunction preventing Google from collecting any more biometric data in Texas. Google has already publicly committed to fighting the suit in court.
In absence of federal rules, Google faces multiple suits from proactive states
States are increasingly stepping up to fill the privacy void created by a continuing lack of federal legislation on the issue. Google is currently fending off legal trouble from multiple states regarding its location tracking through various apps, settling a suit in Arizona for $85 million in early October over the fact that certain apps continue to track user locations even when they believe they have opted out via Android’s global settings. Similar cases are ongoing in Indiana, the state of Washington and the District of Columbia, and Texas also has a separate case open regarding this particular issue.
Texas AG Warren Paxton is also coordinating a group of state attorneys in an antitrust case involving Google and Facebook, which remains ongoing. The case involves the two tech behemoths allegedly colluding to fix the prices of online targeted advertising, a market that they collectively owned about 52% of in the US in 2021.
Prospects for a federal data privacy bill in the near future remain questionable. New guidelines proposed by the Federal Trade Commission could serve as a cornerstone of the process, but a bipartisan bill is also currently moving through Congress. This is far from the first time a promising bill with bipartisan support has started out strong but ultimately fizzled out, however, and the current effort was derailed by representatives from California who worried that it would supplant the state’s existing privacy law with weaker national terms. All of those efforts are very likely on hold until the end of the 2022 midterm elections and the following holiday season.