United States of America: Announced lawsuit against Google for Unlawful Collection of Texans Users' Biometric Data

On 20 October 2022, the Texas Attorney General (AG) filed a lawsuit against Google for collecting biometric identifiers among Texan users without consent, violating the Texas Capture or Use of Biometric Identifier Act (CUBI). Biometric identifiers include hand or face geometry records, voiceprints, fingerprints, and iris scans. The company is accused of collecting, mainly through the Google Photo app (2015) and its face-grouping function, which allows recognising and storing the faces of anyone who appears in a photo taken with Android or uploaded to the app, and Google Nest, biometric data through facial and voice recognition technology, not only of consenting users but also of users who cannot give their consent or are unaware that they are providing their data. The AG alleges that users were divided into owner-users, non-owner-users and non-users. The non-users are, for instance, passers-by who appear on the back of photographs, but also children, the elderly and individuals who have no way of giving their consent to have their biometric data recorded. Google is accused of violating Texas law firstly by creating a feature that allows Google Photo to automatically take facial geometry. Secondly, by failing to obtain consent from users and non-users, and thirdly, by allowing users to disable facial recognition only after they have uploaded at least one photo to the Google Photo app. Furthermore, the State of Texas also accuses the company of using biometric data to increase its profits and market competitiveness and implement its AI system and machine learning method. Lastly, Google is accused of maintaining data storage for an unreasonable length of time. The data is destroyed after the first anniversary of the date on which the purpose of data collection expires. The state of Texas is thus requesting that a trial be opened and that there be first a temporary injunction, then a permanent injunction preventing the company and all related parties from further violating the CUBI. The state also requests that Google first be ordered to pay civil penalties in favour of the state in an amount of no less than USD 25'000 for each violation and post-judgement interest on all monetary damages, as required by law.