> so any liability or violation of use of someone's likeness is on the person who gave you the data.
That's what I feel too. Presumably, by uploading a picture to FB you are giving your consent for it to be processed however their terms outline. And representing that you have the consent of others in the photo too. Otherwise, what are you doing uploading the photo, if you do not agree with the terms by which it will be used?
The liability for irresponsibly handling someone else's biometric data (per BIPA) to me makes more sense to pin on the person who actually uploaded the data to a known data processing application, rather than blaming the tool.
I gather that that's not a popular opinion here though, and the Illinois law is written in a way that it targets the corporation that winds up with the data.