Texas’ $1.4B settlement with Meta highlights the need for data privacy protections, experts say
Texas Attorney General Ken Paxton Drew Angerer via Getty Images
Attorney General Ken Paxton secured an eye-watering sum for Facebook’s alleged misuse of facial recognition tech. But observers argue that states need to go further and put more teeth in privacy laws.
Texas Attorney General Ken Paxton made a big splash last week as he unveiled a $1.4 billion settlement with Facebook parent company Meta, the largest payment received from an enforcement action brought by a single state.
The deal ended a lawsuit against the company for allegedly using the biometric data of users without their permission. Paxton, a Republican, sued Meta in 2022 for violating a state law that prohibits capturing or selling a resident’s biometric data, such as their face or fingerprint, without their consent.
“This historic settlement demonstrates our commitment to standing up to the world’s biggest technology companies and holding them accountable for breaking the law and violating Texans’ privacy rights,” Paxton said in a statement. “Any abuse of Texans’ sensitive data will be met with the full force of the law.”
It’s the first lawsuit brought under the state’s Capture or Use of Biometric Identifier Act, which was enacted in 2009. Paxton alleged in the suit that a Facebook feature that uses facial recognition technology to suggest to users who to tag in certain photographs ran afoul of the law. The attorney general said Facebook turned on the feature for all Texans without explaining how it worked, and without telling them. The company shut down the facial recognition feature at issue in the lawsuit in 2021, acknowledging the “growing concerns” around the technology’s use.
The $1.4 billion will be paid out over five years, with the first installment of $500 million due within 30 days. In a statement, a Meta spokesperson said the company was glad the matter was resolved, adding that it looked “forward to exploring future opportunities to deepen our business investments in Texas, including potentially developing data centers.”
Outside groups have applauded the settlement, but argue more must be done to protect consumers’ data privacy.
In a blog post shortly after the settlement in Texas was announced, F. Mario Trujillo, a staff attorney on the civil liberties team at the nonprofit Electronic Frontier Foundation, said Texans could have received justice quicker if they had a private right of action against the technology companies. Currently, only the Texas Attorney General’s Office can decide whether to enforce laws such as these.
“State regulators do not always have the resources or the will to aggressively enforce consumer privacy laws,” Trujillo wrote. “And without strong enforcement, companies will not make compliance a priority.” An EFF spokesperson declined to comment further.
A number of states have passed comprehensive data privacy legislation in the face of national inaction, but Trujillo noted that most also lack a mechanism for citizens to sue if technology companies violate the law.
“That is why consumers should be empowered to bring lawsuits on their own behalf,” Trujillo wrote. “That should be the priority in any new law passed. Hopefully, states like Texas will continue to enforce their privacy laws. Still, there is no substitute for consumer enforcement.”
Others said the Meta settlement should have businesses worried. Attorneys for law firm Vinson & Elkins LLP wrote in a column after the deal that the case’s resolution “is a significant development in the field of biometric data privacy and security.” The group said it shows the potential liabilities for companies that capture and use biometric data without consent, which could be risky when training artificial intelligence applications.
They urged companies involved in biometric collection to take various actions, including performing a data inventory to understand what data they collect and store; be “vigilant” about its use in training AI; and obtain “explicit and informed consent” before capturing or using people’s data.
The Texas case is not the first taken and won against big technology companies for the misuse of data, but it represents the biggest payout, according to the attorney general's office. In 2022, Oregon and Nebraska led a group of 40 states in a lawsuit that resulted in a $391.5 million payout from Google for its use of location tracking. The suit alleged that Google misled users into thinking they had turned off location tracking, when the company was in fact continuing to collect information about their location.
NEXT STORY: Cyberattacks still ravage schools, defying White House efforts launched last year