Apple faces a potential $32.5 billion class-action lawsuit after a federal appeals court declined to block claims that its Photos app collects facial geometry without consent. The decade-old dispute centers on the on-device People
feature and highlights growing legal friction over AI-powered image tools.
A multibillion-dollar legal battle over consumer privacy is moving forward after the federal judiciary cleared a major hurdle for plaintiffs. The litigation accuses the tech giant of collecting biometric information through its ubiquitous Photos application without providing proper notice or obtaining written consent from users.
At the center of the dispute is the application’s People
feature, which uses automated algorithms to group similar images together.
How the $32.5 Billion Figure Is Calculated
The staggering financial stakes of the litigation stem directly from statutory damages permitted under state law. Plaintiffs estimate that the certified classes encompass approximately 6.5 million Illinois residents whose personal photos were processed by the disputed software feature.
Under the statutory framework of the Illinois Biometric Information Privacy Act, prevailing plaintiffs may recover $1,000 for each negligent violation. For intentional or reckless violations, that statutory penalty increases to $5,000 per violation. Multiplying the maximum $5,000 penalty across the estimated 6.5 million affected class members yields the theoretical maximum exposure of $32.5 billion.
Legal counsel representing the consumer class expressed satisfaction with the recent appellate decision denying review of the class certification. Andrew Schlichter, counsel for the plaintiffs, issued a statement detailing the team’s position on the ongoing proceedings.
“After working for more than six years to protect the rights of Illinois citizens to control the creation and use of their unique biometric data, we are pleased that a class has been certified and that Apple’s request to review the court’s order has been denied. We look forward to the opportunity to prove the case at trial.”
Andrew Schlichter, counsel for the plaintiffs
Despite the immense financial exposure, the litigation remains unresolved after six years of active proceedings. The corporation has not been found liable, and no financial damages have been ordered by the court. Plaintiffs must still establish liability before any monetary recovery can occur.
Contrasting Approaches to Facial Recognition Technology
Industry analysts point out a fundamental distinction between how different major technology firms implement facial recognition software. Meta faced significant legal scrutiny over its handling of face recognition data on social media platforms, ultimately agreeing to a $650 million settlement regarding Facebook’s tag-suggestion features.
That earlier litigation involved processing uploaded images directly on remote corporate servers where the company could actively identify specific individuals. In contrast, technical documentation indicates that the recognition algorithm runs entirely on device using machine learning systems designed to curate and organize personal media libraries privately.
Legal filings and technical research papers emphasize that the local software merely determines that multiple distinct images depict the same visual appearance. The device itself holds no intrinsic knowledge of a person’s real identity, requiring the human user to manually assign names to individual photo clusters.
The Defense Position and Local Processing Architecture
Apple has consistently disputed the core allegations brought by the class representatives. The company maintains that the data utilized to organize photo albums does not qualify as biometric information under the statutory definitions because the numerical vectors generated by the software cannot recreate a physical face and remain disconnected from a person’s legal identity.
The lawsuit encompasses claims targeting both local device processing and iCloud-related photo storage infrastructure. Plaintiffs contend that specific cloud storage configurations caused facial data to be transmitted to external servers, introducing additional privacy compliance risks.
The ongoing legal battle serves as a primary testing ground for how judicial systems interpret privacy regulations designed for an earlier era of computing. Enacted in 2008, the state statute predates many modern artificial intelligence tools that automatically process personal images on consumer hardware.
Precedents and Future Implications for Artificial Intelligence Privacy
The outcome of this multi-year legal conflict could permanently alter how developers design privacy-focused AI capabilities. If courts accept the distinction between server-side identification and local device processing, companies may gain clearer pathways for deploying automated media features.
Conversely, rejecting that distinction could force developers to implement rigid consent requirements even when sensitive data processing occurs exclusively on personal hardware. Previous legal actions, such as Instagram’s separate biometric privacy settlements, demonstrate that regulatory scrutiny over automated image analysis spans multiple popular social platforms.
As district court proceedings resume, legal observers will monitor whether technical nuances regarding on-device data handling successfully protect automated curation tools from traditional statutory liability.
Related reading
