Texas Attorney General Ken Paxton announced the state is suing Google for allegedly collecting biometric data from millions of Texans without consent, his office said in a press release Thursday. The case is part of a recent flood of lawsuits against tech companies over biometrics, which measure physical characteristics like faces and fingerprints. But this new lawsuit makes an unusual and potentially gamechanging argument: Paxton alleges Google violated the privacy of people who aren’t even Google users.
“Google’s indiscriminate collection of the personal information of Texans, including very sensitive information like biometric identifiers, will not be tolerated,” Paxton said in the press release. “I will continue to fight Big Tech to ensure the privacy and security of all Texans.”
It’s Paxton’s sixth case against Google. The company did not immediately respond to a request for comment.
Paxton — an election denier, hater of the LGBTQ community, and alleged fraudster under indictment for seven years — has indeed been committed to fighting big tech, to varying degrees of absurdity and seriousness. But as the saying goes, a stopped clock is right twice a day, and the biometrics lawsuit is part of a recent series of reasonable privacy critiques that are gaining momentum. He also accuses Google of collecting voice data via its Assistant and Nest thermostat products.
Earlier this year, Paxton filed a separate lawsuit against Google, alleging among other changes that Chrome’s Incognito Mode deceives people by suggesting that private tabs protect your data (they definitely don’t). Paxton filed another biometrics lawsuit against Meta (aka Facebook) this year, and with the new case against Google, he may have another good argument against the search giant.
The lawsuit says that Google’s services collect biometric data without user consent, which is a well-trod legal issue, but the privacy rights of people who aren’t actually users of the service is a topic that hasn’t garnered much attention in the courts. The Capture or Use of Biometric Identifier Act, passed in Texas in 2009, prohibits collecting or sharing biometric data without informed user consent.
The lawsuit points out that products like Google Photos include features like Face Grouping, which uses facial recognition to sort together photos of the same people. Even if you gave Google permission to collect your own facial recognition data, the people you’ve taken pictures of probably didn’t.
“To Google, it does not matter that the three-year-olds, the bystanders, and grandma never consented to Google capturing and recording their biometric data,” the lawsuit says.
The most effective way to protect people’s privacy through legislation is often to ban certain practices outright, but so far, privacy regulation across the globe focuses on consent, which is sometimes referred to as a “notice and choice” model. That’s an impossible standard to meet for services that collect data about people who aren’t even users.
“This is a gap in a lot of privacy laws right now,” said Tiffany Li, assistant professor at the University of New Hampshire School of Law. “It also shows that we need to move past the notice and choice regime. We need privacy laws that not only give individuals the right to advocate for their own rights, but we also need privacy regulation that regulates entire industries.”
There’s precedent to suggest that the case has merit. Collectively, Google, Meta (aka Facebook), Snap, an a variety of other tech companies have agreed to pay out hundreds of millions of dollars over lawsuits alleging they broke state biometrics laws. The strongest state biometrics law is Illinois’ Biometrics Information Privacy Act, which stands apart from other data regulations because it lets anyone, not just regulators, sue companies for violating their rights.
In the absence of strong federal privacy standards, “biometric data, including our fingerprints, face, and other personal identifiers, will continue to be surveilled and collected without informed user consent,” said Nicol Turner Lee, director of the Centre for Technology Innovation at the Brookings Institution. “What the recent lawsuit suggests is that we have not come to national consensus on the norms and standards for the most appropriate use cases in the collection of biometric data.”
Paxton’s efforts may be part of a cynical effort to curry favour with Republican’s who’ve grown increasingly disillusioned with the tech industry. But with this Google case, Paxton is pushing the boundaries of privacy law, and depending on how that plays out it could set a new precedent for holding tech companies accountable.