The complaint was filed this week in state court in Redwood City, in California’s Bay Area.

The complaint claims that Instagram uses a face-tagging tool, which uses facial recognition to create ‘face templates’ linked with individual users, which are then stored in Facebook’s databases. Crucially, the lawsuit says that Instagram does this automatically and without obtaining user consent. Even individuals without their own Instagram accounts are said to have had their faces mapped by the tool.

“Once Facebook captures its Instagram users’ protected biometrics, it uses them to bolster its facial-recognition abilities across all of its products, including the Facebook application, and shares this information among various entities,” the complaint claims.

It claims that Facebook only started to inform Instagram users that it was collecting these data at the beginning of 2020.

The case has been brought by Kelly Whalen, an Illinois resident and regular Instagram user since 2011. According to the Bloomberg report, the practice violates an Illinois privacy law (the Biometric Information Privacy Act), which guards against the collection and storage of biometric information. Since Illinois implemented the law, other states have introduced similar rules.

Under the Biometric Information Privacy Act, Facebook could be forced to pay damages of $1,000 per negligent violation or $5,000 if it acted with intention or recklessness (with possible but highly unlikely total damages of $500bn).

Instagram’s data policy says that if facial-recognition technology is introduced, users will first be informed and given the option to opt out.

In a statement to media, a Facebook spokesperson called the lawsuit “baseless” and said that Instagram does not use facial-recognition technology.

Facebook has been facing mounting criticism from users, regulators, and lawmakers over its aggressive data-harvesting practices, which allegedly include identifying potential competitors such that they can be neutralised or acquired. Last month, Facebook was forced to pay $650m to settle a 2015 class action lawsuit which alleged biometric data-harvesting on the Facebook app in violation of the same Illinois law.

The sum was increased by $100m from $550m after a federal judge expressed scepticism about whether the proposed settlement would be sufficient for compensating millions of users in Illinois who could be covered by the lawsuit.