The benefits of internet privacy laws can sometimes be hard to grasp: With the right regulations, users can sometimes have a vague reassurance that advertisers or the government can’t snoop as easily on their personal information.
But this week, residents of Illinois have been getting a more tangible benefit: $397.
The money has been arriving by check and direct deposit from a settlement fund set up last year after Facebook agreed to settle a class-action lawsuit alleging that the social media company had violated the rights of Illinois residents by collecting and storing digital scans of their faces without permission.
The money is headed only to Illinois because of the state’s pioneering Biometric Information Privacy Act, an unusual law passed in 2008 that allows consumers in the state to sue companies for privacy violations involving fingerprints, retina scans, facial geometry and similar data. The state has generally been regarded as among the most aggressive places in the world in terms of regulations on tech.
For some people in Illinois, it’s the clearest example they’ve seen of a privacy law working.
“It says something interesting about the law that we have here in Illinois, that it actually has some teeth in it, and that they were able to really get Facebook to own up to having done something wrong,” said Eric Allix Rogers, 36, who lives in Chicago’s South Shore neighborhood and runs events and communications for a nonprofit organization.
Facebook agreed to pay $650 million to end the litigation, with the money to be split among Illinois Facebook users who filed claims by a certain deadline, minus costs and $97.5 million in attorneys’ fees. About 1.6 million people signed on for the settlement by December 2020, and the checks have been in the works since.
It’s the largest settlement ever under the Illinois law, and the size of Facebook’s payment has other states, including California, eyeing similar laws for their residents.
The ACLU used the Illinois law to force a settlement last week with surveillance company Clearview AI, which collected faceprints from online profiles and sold them to customers including police departments.
A handful of states, including Texas and Washington, already have biometric privacy laws, but none allow consumers to file lawsuits — what’s known as a private right of action. That leaves enforcement up to government lawyers, as when the Texas attorney general sued Facebook this year over facial recognition software.
The $397 checks are a sharp contrast with how most Americans experience privacy laws: through pop-up windows on their web browsers asking permission to collect data via website cookies and other trackers. Some people say the current framework leaves them feeling helpless or annoyed.
The checks are so unusual that some people said on social media that they thought the money could be a scam.
But privacy advocates and lawyers said the case could be a new model for privacy laws, though it’s not clear tech companies are willing to embrace such a model.
“We’re past the point when privacy violations are punished with slaps on the wrist. When you misuse millions of peoples’ most intimate information, there’s a cost,” Albert Fox Cahn, executive director of the Surveillance Technology Oversight Project, a privacy advocacy organization, said in an email.
Meta, the newly renamed parent company of Facebook, did not immediately respond to a request for comment on the checks going out. In November, months after a federal judge approved the class action settlement, the company said it would drastically scale back its facial recognition system and delete more than 1 billion users’ facial templates.
Rogers said the Illinois settlement gives him some reassurance that privacy laws can sometimes provide visible benefits.
“I think we are really kind of at a crisis point when it comes to data privacy here,” he said. “It’s really just the Wild West in the U.S. for the most part.”
The U.S. does not have a comprehensive federal law about data privacy, leaving a patchwork of state laws. And it’s rare for people to get payouts from tech companies, though politicians such as California Gov. Gavin Newsom and former presidential candidate Andrew Yang have proposed requiring tech companies to pay a “dividend” of sorts to users.
Rogers, the nonprofit worker, said he would use most of the money to pay down debt, though he said he did enjoy a beer and a burger at lunch on Tuesday — a day off from work — without worrying about what he was spending.
And in that sense, the $397 checks may act as a small financial stimulus for Illinois residents, echoing federal payments that arrived during earlier stages of the pandemic.
Joe Cacchione, 31, from the Chicago suburb of Lockport, said he planned to use the money to help pay for his wedding in a couple of months.
“This is immediately going to pay off the wedding bands,” he said.
Though he submitted a claim for his share of the settlement in 2020, he said the check was still a shock. “There’s always a little bit of hesitancy when somebody says they’re going to send you a check for a settlement claim from two years ago,” he said.
Not all of Illinois’ 12.7 million residents are getting a check. The potential class size of Facebook users was 6.9 million, and about 22 percent of them filed claims, the federal judge overseeing the case wrote last year. There’s ongoing litigation over whether people in Illinois who weren’t Facebook users can seek compensation.
Cacchione, who works for a software company, said the money helps to make up for Facebook’s conduct.
“It’s probably just like a drop in the bucket,” he said. “We still have to do something to stop large tech companies from acquiring and selling our data moving forward.”