Facebook's facial recognition features could cost it billions of dollars

If you thought Facebook was already having a bad couple weeks, a federal judge just reminded us that things could get a whole lot worse for the company.

A judge in San Francisco ruled Monday that Facebook users in Illinois can proceed with a class action suit against the company over its use of facial recognition software. The suit has the potential to cost the social network billions of dollars in fines.

The lawsuit stems from Illinois' strict laws around biometric privacy. The state's Biometric Information Privacy Act allows residents of the state to sue tech companies that don't adhere to the law, which requires tech companies to obtain prior consent before they collect biometric data. (This is likely why Google's viral selfie matching feature in its Arts & Culture app didn't work in the state).

According to the lawsuit, Facebook violated these rules with it's Tag Suggestions feature, which uses facial recognition to suggest tags for photos users upload to the site.

In a statement, a Facebook spokesperson said the company is "reviewing the ruling. We continue to believe the case has no merit and will defend ourselves vigorously.”

The company has a lot at stake in the case. It could theoretically face billions of dollars in fines, as the Illinois law says each violation can result in fines between $1,000 and $5,000 and millions of residents could be covered by the lawsuit.

"Facebook seems to believe that a class action is not superior because statutory damages could amount to billions of dollars. Substantial damages are not a reason to decline class certification," the judge wrote.

Even so, it's unlikely that Facebook would actually end up having to pay billions of dollars in fines. Monday's ruling was just one step in what will likely continue to be a long legal battle (the suit was originally filed in 2015).

But it's not a good look for the company, which is facing more scrutiny than ever over how it handles users' private data. The ruling comes less than a week after CEO Mark Zuckerberg spent hours testifying before Congress about the company's ongoing Cambridge Analytica fiasco and other privacy issues.