Microsoft and Amazon Get Early Win in Lawsuits Over Flickr Photo Uploads

Microsoft and Amazon have won a summary judgment in lawsuits that claim the companies illegally used two U.S. residents’ Flickr photos to develop facial recognition software.

A Washington federal judge dismissed plaintiffs Steven Vance’s and Tim Janecyk’s putative class action lawsuits alleging that Microsoft and Amazon violated the Illinois Biometric Information Privacy Act (BIPA) when the companies made use of a biometric-information data set produced by IBM, from pictures uploaded by the users to the photo-sharing website, Flickr.

BIPA prohibits companies from profiting from their users’ biometric information, in this case, facial scans from photographs.

The Case

Vance and Janecyk sued Amazon and Microsoft in 2020 after their photos were included in datasets used by both companies to train facial recognition products. The pair’s attorneys claimed that thousands of public images of private citizens are often harvested from the web, bundled, and used by major tech companies for artificial intelligence (AI) development.

According to the order, starting in 2008, the plaintiffs had both uploaded photographs including ones of themselves to Flickr. In 2014, Yahoo, Flickr’s then-parent company, publicly released a 100 million photo dataset including photos of the plaintiffs.

Those images, including Vance’s and Janeyck’s, were then gathered by IBM five years later. Researchers at IBM used one million of those photos to create a photo dataset for testing facial recognition software for racial and gender bias in a package called “Diversity in Faces.”

Puget Sound Journal reports that the plaintiffs claimed that IBM then made the “Diversity in Faces” dataset broadly available to the world’s leading tech companies, including Microsoft and Amazon, which deployed the data in their training models.

Vance and Janeyck alleged that Amazon used their images to develop its Rekognition AI offering and Microsoft used the same images to develop its Cognitive Services Face Application Program Interface.

All of this, according to the complaint, violates Illinois law BIPA, which forbids the use of facial images and other biometric identifiers for profit without the subject’s consent.

Microsoft and Amazon joined forces to battle Vance’s and Janeyck’s lawsuits.

Lawsuits Dismissed

On Monday, Judge James L. Robart of the US District Court for the Western District of Washington granted summary judgment to Microsoft and Amazon. The granted motions mean both companies will avoid trials, and the lawsuits are likely to be dismissed.

Robart ruled that Vance and Janecyk had failed to show that Microsoft’s and Amazon’s allegedly illegal conduct occurred “primarily and substantially” in Illinois, a necessary element for liability under the BIPA.

On the issue of whether Microsoft’s conduct occurred in or was connected to the state of Illinois, Robart said the most the plaintiffs could point to was the possibility that the company had stored encrypted copies of the “Diversity in Faces” Dataset on a cloud server in the state.

But the BIPA targeted the acquisition of biometric data, not the encrypted storage of data after it has been acquired. Microsoft had no part in the acquisition of the photographs or the generation of the biometric data at issue in the lawsuit and its storage of the data in Illinois would not violate the statute, said Robart.

According to the judge, the plaintiffs also failed to provide evidence that the companies profited from access to their biometric information.

Two researchers within Microsoft obtained IBM’s dataset for separate projects. However, according to the company, neither researcher at Microsoft ended up using the biometric information or even the dataset as a whole.

Amazon claimed that the company never used the data set to develop or improve any of its products or services meaning that it could not have profited from it.

Image credits: Header photo licensed via Depositphotos.