This suggests to me that the number of people affected is much more than the 100 million Instagram users, and the potential fine much higher.
Somewhat similar to what you describe, the "Access Contacts" permission usually present in mobile operating systems essentially leaks the contact information of everyone stored in ones contact, if permitted.
The names and associated phone number can be used to build advertising/tracking profiles by apps.
The problem is that even if someone does not use those apps and instead chooses privacy-respecting alternatives, it only takes another person who does use these apps to have their information saved in their contacts.
I would imagine it to be quite similar with these photos and also with the facebook case.
It seems unethical to put other people who might not be on facebook and have not read the terms of service or privacy policy through these algorithms.
I think the contacts example illustrates how hard of a problem this is, I definitely don't have a viable solution. Even if you ask someone for permission, they might change their mind or not fully understand.
According to documentation, Google mentiones that face groups are deleted when you turn the feature off: https://support.google.com/photos/answer/6128838?hl=en
(And if they're not, winning a lawsuit against Google should be trivial.)
As I was walking around I realized that so many other people were taking photos where I was in the background that it felt like Facebook or Google knew I was there even though no one else did.
Why is this wrong? You're just scanning a bunch of pixels, and the data was given to you, so any liability or violation of use of someone's likeness is on the person who gave you the data.
Autonomous cars scan the poses and faces of people even if they didn't agree to any ToS, to try to determine what those people are about to do based on their physical expression. Autonomous cars track the movements of strangers over a short time as well by re-identifying a person that moved behind an obstacle and emerged on the other side. It would be silly and unsafe to say they are not allowed to do that, because human drivers do exactly that.
> so any liability or violation of use of someone's likeness is on the person who gave you the data.
That's what I feel too. Presumably, by uploading a picture to FB you are giving your consent for it to be processed however their terms outline. And representing that you have the consent of others in the photo too. Otherwise, what are you doing uploading the photo, if you do not agree with the terms by which it will be used?
The liability for irresponsibly handling someone else's biometric data (per BIPA) to me makes more sense to pin on the person who actually uploaded the data to a known data processing application, rather than blaming the tool.
I gather that that's not a popular opinion here though, and the Illinois law is written in a way that it targets the corporation that winds up with the data.
To be clear, this does not absolve the supplier of the data for their responsibility, but the supplier’s culpability does not absolve the recipient.
Platforms have ToS that are non-negotiable and almost nobody reads them. The plaform knows this and that users upload photos without proper permissions and instead of warning users, they make it very convenient to agree (or even preselect it), otherwise it couldn't use the data in an almost-cover-your-ass way.
Note: I don't use these services, please correct me if I'm wrong.
As for the question of what the platforms can do, it is simple: treat third parties as if they have refused permission. There’s nothing difficult about it once you filter out the self-serving attitude of the platforms. This has nothing to do with what’s “sexy” and everything to do with what’s right.
Let me stop you right there, because that's the difference.
An autonomous car, one would presume, or its builder would find themselves here too, is not permanently scanning every object it finds, tagging it, coalescing it into a giant database, and cross referencing that with an enormous amount of individually identifying information.
The autonomous car doesn't know you're "Jonaldo Stevensmith of Braunschweiger, Texas, 28 years old, working for Brogrammer Inc" nor what you've been doing for the last ten years. Its capability goes only as far as knowing you're one of ten living (human) things it must not run over.
Instgram/Facebook do know who you are. Fb/I have shown time and time again that they aren't capable of securely managing user data. Nor do they make it explicit what they will do with your data long-term, because they themselves do not know.
Let me illustrate the problem further, if I understand things correctly Instgram works primarily on phones. Mobile phones for the last five years by and large have amazing cameras, with sensors ranging from 8 megapixels all the way up to "100 megapixels" in some current flagship models. Instagram, if I understand things correctly, allows you to upload any resolution of photo and stores the original in perpetuity BUT it will only show you very low resolution versions (even of your own photos).
Meaning, Instagram will not show users their original upload and only offers scaled down versions; all the while, performing biometric analysis on the originals. I don't think most people would upload photos if they knew, that their faces were being scanned at in extremely high resolutions and permanently attached to an already unfathomably deep profile. Even if they were okay with a few I don't think most folks would be okay once they realize the scale and true size. It's very likely every photo anyone has taken of you (and uploaded), whether you've been tagged or not (or as someone just in the background) Fb/I will know you're in it. I'm sure that wasn't clearly stated by their terms of service.
Truly, what's happening here could only end even worse for everyone, with an even larger lawsuit(s) than this... I'd wager a even a near company shattering fine of $150bn now would be a deal. Why?
An unfettered quest for growth would leave them blind to what they're creating. By Identifying people using biometric and superficial data and then attempting to predict human behavior combining them-- they will end up creating a fucking racist machine. The machine won't be based on science as a result of its dataset; it's going to be based on "AI" trained from incomplete bullshit data. It will be asked to predict things it is unable to, but the researchers will not be able to discern fact from fiction because there's too much noise. "It fits the curve, it must be right."
The more opaque the machine stays, the longer it will remain hidden, and the more racist it will be become feeding off of itself.
The lawsuit to stop that devil would be end-game for Facebook. I suspect, there would be no recovery, because the dual passage of antitrust and discrimination laws preventing, dismembering, and disemboweling such a wretch would leave only an unrecognizable corpse.
Do I think it's Facebook's intention to create a giant racist fucking machine? Fuck no. I do think it's entirely possible to repeat history, stupidly, and accidentally. The road to hell is paved with good intentions.