Instagram collected unique facial geometry from millions of users’ photos and videos without written consent between 2015 and 2021, violating the Illinois Biometric Information Privacy Act (BIPA) and resulting in a $68.5 million settlement in 2024. This settlement compensates approximately 4 million Illinois residents who used Instagram during the data collection period of August 10, 2015 to August 16, 2023, with an average payment of around $32.56 per eligible claimant. The case represents a significant moment in consumer privacy rights, establishing that social media platforms cannot scan faces in user-uploaded photos and videos to create facial recognition profiles without explicit consent, even when users believe they have disabled such features.
The biometric data collection occurred through Instagram’s facial tagging suggestions and facial recognition filters that automatically analyzed photos and videos. Unlike targeted advertising or account settings that individual users might activate, Meta scanned faces in photos uploaded by other users—meaning your face could be analyzed even if you never used facial recognition features yourself. This unavoidable collection of biometric data without written consent triggered violations of Illinois’s landmark biometric privacy law, which is among the strictest in the nation.
Table of Contents
- What Is Biometric Data and How Did Instagram’s Facial Recognition Work?
- The Illinois BIPA Settlement—Details, Timeline, and Average Payments
- Other Major Biometric Privacy Settlements Against Meta and Facebook
- How to File a Claim and Determine Your Eligibility
- Your Rights Under Illinois BIPA and Why Consent Matters
- Why Meta Disabled Facial Recognition and What Changed in 2021
- Protecting Your Biometric Data on Instagram and Other Platforms Today
What Is Biometric Data and How Did Instagram’s Facial Recognition Work?
Biometric data refers to biological measurements unique to an individual, including fingerprints, iris scans, and facial geometry. In instagram‘s case, the company collected facial geometry—a detailed mathematical representation of facial features, structure, and spacing—through its facial recognition system. This facial geometry could be used to identify, track, and match individuals across photos and videos, making it far more invasive than basic metadata collection or IP logging. Instagram’s facial tagging system operated by automatically detecting faces in photos and videos users uploaded and creating unique facial geometry profiles from those images. When users uploaded a photo containing friends or other people, Instagram’s system would scan all visible faces, including those of people who had never agreed to the scanning. The system then offered tagging suggestions based on previous facial profiles it had created. Additionally, Instagram offered facial recognition filters and effects that required the same underlying facial analysis technology to function.
Unlike cookies or tracking pixels that users see advertised, most users were entirely unaware their faces were being scanned and stored, let alone that this data was being used to build searchable facial recognition profiles. The data collection was unavoidable even for privacy-conscious users. If a friend uploaded a photo that included your face, Instagram scanned and profiled your facial geometry without your knowledge or consent. You could not opt out of being scanned in other people’s photos. You could not prevent Meta from analyzing your facial features. You could not control whether your facial geometry was stored. This lack of user control over collection from third-party uploads made the practice especially problematic under BIPA, which requires written consent before collecting and storing biometric data.
The Illinois BIPA Settlement—Details, Timeline, and Average Payments
The $68.5 million settlement agreement, reached in 2024, resolved claims that Meta violated Illinois’s Biometric Information Privacy Act (BIPA), one of the strictest state-level privacy laws in the United States. The settlement is limited to approximately 4 million Illinois residents who used Instagram at any point between August 10, 2015 and August 16, 2023. The class period runs from 2015 (when facial tagging began) through mid-August 2023, even though Meta disabled its face recognition system in November 2021. Claimants eligible for payments were those who had Instagram accounts during this window and whose faces were subject to the company’s facial recognition technology. Payments to class members began distribution in June 2024, with eligible claimants receiving an average of approximately $32.56 per person. This average payout reflects the total settlement amount divided among all eligible class members. In practice, actual payments varied based on claim submission rates and claim verification processes.
Illinois residents who had Instagram accounts and filed valid claims received their compensation within months of the settlement’s approval. This represents one of the largest privacy settlements specific to a single state, though it is smaller than the $650 million Facebook facial tagging settlement from 2020, which applied nationally to all facebook users regardless of state of residence. A critical limitation of the Illinois settlement is its geographic scope. Only residents of Illinois qualify for compensation under this settlement. Residents of other states did not qualify for payments from this particular case, even if they used Instagram during the same time period and their faces were scanned using identical technology. However, residents of Texas may have separate rights under other settlements, such as Meta’s $1.4 billion settlement with Texas announced in July 2024. This fragmented landscape of state-by-state settlements means that the amount of compensation available depends partly on which state the claimant lived in during the collection period.
Other Major Biometric Privacy Settlements Against Meta and Facebook
Before the 2024 Illinois settlement, Meta faced a landmark $650 million settlement in 2020 related to Facebook’s photo-tagging technology and facial recognition practices. That case also involved claims that Facebook collected and stored facial recognition data without user consent, specifically through a feature that suggested which friends to tag in photos. The 2020 settlement resolved claims on a national basis, meaning eligible Facebook users from any state could potentially receive compensation. While that settlement was larger in total amount, the per-claimant payments were smaller because the class was substantially larger, including all Facebook users who had photos uploaded to the platform. In July 2024, Meta reached a $1.4 billion settlement with Texas, the largest privacy settlement ever obtained by a single state. This settlement addressed broader biometric data collection violations across multiple platforms and features, not limited to facial tagging or facial recognition filters.
The Texas settlement demonstrates that biometric privacy violations extend beyond Instagram’s specific facial recognition system and reflect industry-wide practices of collecting facial data without adequate consent. However, the Texas settlement has different eligibility requirements and timelines than the Illinois Instagram settlement, requiring affected individuals to determine which settlement, if any, applies to their situation. The existence of multiple overlapping settlements creates complexity for consumers. Users who lived in Illinois and used both Facebook and Instagram during the relevant periods might be eligible for compensation from both the 2020 Facebook settlement and the 2024 Instagram settlement. Users who lived in Texas might be eligible for the Texas settlement. Users who lived in other states may not have access to any state-specific facial recognition privacy settlement, though future litigation is ongoing. These fragmented settlements illustrate why biometric privacy remains contested at the state level, with individual states pursuing enforcement actions rather than federal legislation.
How to File a Claim and Determine Your Eligibility
To qualify for compensation from the Instagram BIPA settlement, you must meet three basic requirements: you must have been a resident of Illinois, you must have had an Instagram account at any time between August 10, 2015 and August 16, 2023, and your account must have included a functioning profile or activity during that period. You do not need to prove that you explicitly used facial recognition features or filters. You do not need to prove that your face was tagged by the system. The settlement defines the class broadly to include all Illinois residents with Instagram accounts, regardless of whether they actively engaged with facial recognition features. The settlement claim process typically requires submitting a claim form through an official settlement claims administrator. The form asks for your name, Instagram username or associated email address, state of residence (Illinois), and the years during which you maintained an Instagram account. Some settlements also ask for account creation date or phone number associated with the account.
In the case of the Instagram BIPA settlement, claims were submitted online through the official settlement website established by the claims administrator. Most settlements have a deadline for claim submission, typically ranging from 6 months to 1 year after the settlement is approved, so timing is crucial for preserving your right to compensation. A limitation of claim-based settlements is that they require affirmative action by consumers. If you do not file a claim by the deadline, you typically forfeit your compensation, even though you remain part of the class and are bound by the settlement agreement. Settlement administrators do not seek you out or mail automatic payments. Additionally, the claims process requires you to verify your connection to the platform and the settlement period. If your old Instagram email address is no longer accessible or if you cannot remember your username, gathering proof of account ownership may be more difficult. Some settlements require submitting screenshots, account recovery information, or historical email confirmations to verify you had an account during the relevant dates.
Your Rights Under Illinois BIPA and Why Consent Matters
Illinois BIPA requires that any company collecting biometric data—including facial geometry, fingerprints, iris scans, and voiceprints—must first obtain written informed consent from the individual. This consent must be specific and detailed; it cannot be buried in a general terms-of-service document. The individual must understand what biometric data is being collected, how it will be used, and how long it will be retained. Companies must also provide a schedule for destroying biometric data and establish a clear written retention policy that the individual can review before consenting. What made Instagram’s facial recognition collection illegal under BIPA was not merely that the company collected facial data, but that it collected facial geometry from users’ photos and videos without obtaining written informed consent. Users did not receive a specific prompt asking them to consent to facial geometry collection. Users did not receive a detailed explanation of what facial geometry is, how Instagram would analyze their faces, or how long the facial data would be stored.
Instead, facial recognition was embedded in feature descriptions, terms of service, and default settings that most users never read. For users whose faces appeared in other people’s photos, consent was never sought at all—they were not even notified that their faces were being scanned. A critical aspect of BIPA rights is that they protect against both the company’s own data collection and collection by third parties. If a friend uploads a photo of you to Instagram, that third-party upload triggers Instagram’s facial scanning process, and your biometric data becomes collected under BIPA’s definition. You have privacy rights in your face even when you are not the person uploading the image. This principle extends to other contexts: if a retail store collects facial data through surveillance cameras without consent, customers have BIPA rights even though they did not visit the store intending to participate in a facial recognition study. However, BIPA applies only in Illinois and only to individuals whose biometric data was collected. Residents of other states have different legal protections under their own state laws or have no state-level biometric protection.
Why Meta Disabled Facial Recognition and What Changed in 2021
In November 2021, Meta made a public announcement that it was shutting down its face recognition system and would delete faceprints for over 1 billion people. The announcement came amid mounting pressure from privacy advocates, regulatory investigations, and pending litigation over facial recognition practices. Meta stated that it would remove the ability of its systems to automatically identify individuals in photos and videos and would delete the facial geometry profiles it had created. This decision was a significant reversal from earlier years when Meta had been expanding facial recognition applications across Instagram, Facebook, and other platforms.
Despite discontinuing the automatic facial recognition system, Meta retained the right to collect biometric data under its current terms of service. Meta’s terms still permit the company to collect and use facial data from photos and advertising features, though not in the same automated tagging system that previously existed. This distinction matters: while Meta is no longer building and maintaining searchable facial geometry databases for identification purposes, the company still processes facial data as part of its photo recognition and content moderation operations. Additionally, users who previously had facial recognition features enabled may not have had their facial data completely deleted, and facial geometry created before the 2021 shutdown is not automatically removed from user profiles or Meta’s systems.
Protecting Your Biometric Data on Instagram and Other Platforms Today
Going forward, controlling your biometric data on Instagram requires understanding both the technical settings and the practical limitations of privacy controls. In your Instagram account settings, you can disable facial recognition features and turn off features that use facial geometry, such as certain camera filters or photo effects. However, these settings only control the use of facial data for features you personally interact with; they do not prevent Instagram from analyzing faces in photos other users upload that include you. You cannot prevent your face from appearing in your friend’s photo, and once that photo is uploaded to Instagram, Meta’s systems will process it regardless of your personal settings.
The most effective privacy practice is to be deliberate about what photos you allow others to tag you in and what photos other users upload that include your image. Ask friends to exclude you from group photos before they post them to social media, or request that they untag you if you appear in photos you did not consent to upload. Be cautious about what images you voluntarily upload to any platform that employs facial recognition technology. Review your privacy settings periodically, not just on Instagram but on Facebook and other Meta platforms, since facial data may be shared across the company’s services. Store your biometric data protection rights in mind when making decisions about any platform that requests camera access, face authentication, or permission to process photos.