The Texas Attorney General sued Google for allegedly violating state laws by collecting biometric data on face and voice features without seeking the full consent of users as required under the Texas Capture or Use of Biometric Identifier Act (“CUBI”). The complaint is another example of the role of individual states in protecting users’ information on the internet.
The Texas Attorney General (“AG”) alleges that:
-
- Products: Since at least 2015, Google collected data from Texans and “used their faces and voices to serve Google’s commercial ends” including features such as Google Photo’s “Face Grouping,” which uses facial-recognition software to group similar faces together to form a folder of photos for a particular person. The AG also cites to the Nest Hub Max’s “Face Match” and Next products’ “voice-controlled personal assistant” as programs by which Google is able to collect biometric data from Texans.
- No consent or opt out: These features violate the CUBI because they do not request consent before use or give users the option to opt out of the software.
- Storing data: The AG asserts that Google is using and storing Texans’ information for further development and use.
The CUBI:
-
- Inform and consent: The CUBI prohibits companies from collecting voice or face data for commercial purposes without first informing users. The CUBI prohibits an entity from capturing a biometric identifier for commercial purposes unless the entity: (1) informs the individual before capturing the biometric identifier and (2) receives the individual’s consent to capture the biometric identifier.
- Definition: The CUBI defines “biometric identifier” as including: retina or iris scan, fingerprint, a record of hand or face geometry, or voiceprint (the CUBI does not apply to voiceprint data retained by financial institutions per 15 U.S.C. § 6809).
- Penalty: The CUBI permits the AG to bring an action. Each violation is subject to a $25,000 penalty.
The AG’s action against Google is similar to the one brought against Facebook parent Meta earlier this year, also under the CUBI. Further, Google previously agreed to pay $100 million to settle a class-action lawsuit in Illinois alleging the company’s face-grouping tool which allegedly violated Illinois privacy laws.