{"id":901,"date":"2022-10-24T09:13:29","date_gmt":"2022-10-24T13:13:29","guid":{"rendered":"https:\/\/blogs.duanemorris.com\/techlaw\/?p=901"},"modified":"2022-10-24T09:13:29","modified_gmt":"2022-10-24T13:13:29","slug":"biometric-data-texas-ag-sues-google","status":"publish","type":"post","link":"https:\/\/blogs.duanemorris.com\/techlaw\/2022\/10\/24\/biometric-data-texas-ag-sues-google\/","title":{"rendered":"Biometric Data: Texas AG Sues Google"},"content":{"rendered":"<p>The Texas Attorney General sued Google for allegedly violating state laws by collecting biometric data on face and voice features without seeking the full consent of users as required under the Texas Capture or Use of Biometric Identifier Act (\u201cCUBI\u201d). \u00a0The complaint is another example of the role of individual states in protecting users\u2019 information on the internet.<\/p>\n<p>The Texas Attorney General (\u201cAG\u201d) alleges that:<\/p>\n<ul>\n<li style=\"list-style-type: none\">\n<ul>\n<li><u>Products<\/u>: \u00a0Since at least 2015, Google collected data from Texans and \u201cused their faces and voices to serve Google\u2019s commercial ends\u201d including features such as Google Photo\u2019s \u201cFace Grouping,\u201d which uses facial-recognition software to group similar faces together to form a folder of photos for a particular person.\u00a0 The AG also cites to the Nest Hub Max\u2019s \u201cFace Match\u201d and Next products\u2019 \u201cvoice-controlled personal assistant\u201d as programs by which Google is able to collect biometric data from Texans.<\/li>\n<li><u>No consent or opt out<\/u>:\u00a0 These features violate the CUBI because they do not request consent before use or give users the option to opt out of the software.<\/li>\n<li><u>Storing data<\/u>:\u00a0 The AG asserts that Google is using and storing Texans\u2019 information for further development and use.<\/li>\n<\/ul>\n<\/li>\n<\/ul>\n<p>The CUBI:<\/p>\n<ul>\n<li style=\"list-style-type: none\">\n<ul>\n<li><u>Inform and consent<\/u>: The CUBI prohibits companies from collecting voice or face data for commercial purposes without first informing users.\u00a0 The CUBI prohibits an entity from capturing a biometric identifier for commercial purposes unless the entity: (1) informs the individual before capturing the biometric identifier and (2) receives the individual\u2019s consent to capture the biometric identifier.<\/li>\n<li><u>Definition<\/u>: \u00a0The CUBI defines \u201cbiometric identifier\u201d as including: retina or iris scan, fingerprint, a record of hand or face geometry, or voiceprint (the CUBI does not apply to voiceprint data retained by financial institutions per 15 U.S.C. \u00a7 6809).<\/li>\n<li><u>Penalty<\/u>:\u00a0 The CUBI permits the AG to bring an action.\u00a0 Each violation is subject to a $25,000 penalty.<\/li>\n<\/ul>\n<\/li>\n<\/ul>\n<p>The AG\u2019s action against Google is similar to the one brought against Facebook parent Meta earlier this year, also under the CUBI.\u00a0 Further, Google previously agreed to pay $100 million to settle a class-action lawsuit in Illinois alleging the company\u2019s face-grouping tool which allegedly violated Illinois privacy laws.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>The Texas Attorney General sued Google for allegedly violating state laws by collecting biometric data on face and voice features without seeking the full consent of users as required under the Texas Capture or Use of Biometric Identifier Act (\u201cCUBI\u201d). \u00a0The complaint is another example of the role of individual states in protecting users\u2019 information &hellip; <\/p>\n<p class=\"link-more\"><a href=\"https:\/\/blogs.duanemorris.com\/techlaw\/2022\/10\/24\/biometric-data-texas-ag-sues-google\/\" class=\"more-link\">Continue reading<span class=\"screen-reader-text\"> &#8220;Biometric Data: Texas AG Sues Google&#8221;<\/span><\/a><\/p>\n","protected":false},"author":265,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[5],"tags":[],"ppma_author":[976],"class_list":["post-901","post","type-post","status-publish","format-standard","hentry","category-infotechtelecom"],"authors":[{"term_id":976,"user_id":265,"is_guest":0,"slug":"srwiggins","display_name":"Sheila Raftery Wiggins","avatar_url":"https:\/\/blogs.duanemorris.com\/techlaw\/wp-content\/uploads\/sites\/17\/2021\/12\/wigginssheila-100x100.jpg","author_category":"","last_name":"Wiggins","first_name":"Sheila Raftery","job_title":"","user_url":"http:\/\/www.duanemorris.com\/attorneys\/sheilarafterywiggins.html","description":"<a href=\"http:\/\/www.duanemorris.com\/attorneys\/sheilarafterywiggins.html\">Read Sheila's bio.<\/a>"}],"_links":{"self":[{"href":"https:\/\/blogs.duanemorris.com\/techlaw\/wp-json\/wp\/v2\/posts\/901","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/blogs.duanemorris.com\/techlaw\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/blogs.duanemorris.com\/techlaw\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/blogs.duanemorris.com\/techlaw\/wp-json\/wp\/v2\/users\/265"}],"replies":[{"embeddable":true,"href":"https:\/\/blogs.duanemorris.com\/techlaw\/wp-json\/wp\/v2\/comments?post=901"}],"version-history":[{"count":0,"href":"https:\/\/blogs.duanemorris.com\/techlaw\/wp-json\/wp\/v2\/posts\/901\/revisions"}],"wp:attachment":[{"href":"https:\/\/blogs.duanemorris.com\/techlaw\/wp-json\/wp\/v2\/media?parent=901"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/blogs.duanemorris.com\/techlaw\/wp-json\/wp\/v2\/categories?post=901"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/blogs.duanemorris.com\/techlaw\/wp-json\/wp\/v2\/tags?post=901"},{"taxonomy":"author","embeddable":true,"href":"https:\/\/blogs.duanemorris.com\/techlaw\/wp-json\/wp\/v2\/ppma_author?post=901"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}