The U.S. State of Texas says it has secured a $1.4 billion settlement with Meta over the unauthorised capture of the biometric data of its citizens by the parent company of Facebook, WhatsApp and Instagram.
The U.S. settlement with Meta, announced by Ken Paxton, Texas Attorney General, and said to be “the largest ever obtained from an action brought by a single State” follows last week’s announcement of a record $220 million penalty against the Facebook parent company by Nigerian regulators over allegations of breaches of local data privacy and consumer protection laws.
In the the legal victory yesterday, the Texas Attorney General says that the $1.4 billion settlement with Meta over the unauthorised capture of Texans’ biometric data marks the largest ever obtained from a single state in the U.S.
Meta and the Texas settlements
The settlement, the U.S. State says, is the largest ever obtained from an action brought by a single State. “Further, this is the largest privacy settlement an Attorney General has ever obtained, dwarfing the $390 million settlement a group of 40 states obtained in late 2022 from Google. This is the first lawsuit brought and first settlement obtained under Texas’s “Capture or Use of Biometric Identifier” Act and serves as a warning to any companies engaged in practices that violate Texans’ privacy rights.”
According to the Attorney General, “after vigorously pursuing justice for our citizens whose privacy rights were violated by Meta’s use of facial recognition software, I’m proud to announce that we have reached the largest settlement ever obtained from an action brought by a single State.”
Paxton added that, “this historic settlement demonstrates our commitment to standing up to the world’s biggest technology companies and holding them accountable for breaking the law and violating Texans’ privacy rights. Any abuse of Texans’ sensitive data will be met with the full force of the law.”
In February 2022, the statement states, Attorney General Paxton sued Meta for unlawfully capturing the biometric data of millions of Texans without obtaining their informed consent as required by Texas law. Specifically, Meta’s data collection violated Texas’s “Capture or Use of Biometric Identifier” Act (“CUBI”) and the Deceptive Trade Practices Act. Attorney General Paxton has prioritised holding major technology companies accountable, launching several historic initiatives including antitrust lawsuits and aggressive enforcement of privacy laws.
“In 2011, Meta rolled out a new feature, initially called Tag Suggestions, that it claimed would improve the user experience by making it easier for users to “tag” photographs with the names of people in the photo. Meta automatically turned this feature on for all Texans without explaining how the feature worked. Unbeknownst to most Texans, for more than a decade Meta ran facial recognition software on virtually every face contained in the photographs uploaded to Facebook, capturing records of the facial geometry of the people depicted,” according to the Paxton.
“Meta did this despite knowing that CUBI forbids companies from capturing biometric identifiers of Texans, including records of face geometry, unless the business first informs the person and receives their consent to capture the biometric identifier. After only approximately two years since filing the petition, Texas reached a settlement agreement with Meta. The company will pay the state of Texas $1.4 billion over five years,” the Attorney General says.
According to court documents seen by Technology Times, the settlement agreement mandates that Meta cease its practice of capturing and using Texans’ biometric data without proper authorisation. The company will pay the state of Texas $1.4 billion over five years. Meta will also make an initial payment of $500 million within 30 days of the judgment. This will be followed by four annual installments of $225 million each, starting in 2025 and concluding in 2028.
The settlement funds will be distributed as follows:
- $225 million for attorneys’ fees and expenses.
- $275 million to the State’s general revenue fund.
- Subsequent installments will similarly be divided between general revenue and legal expenses.
“This historic settlement demonstrates our commitment to standing up to the world’s biggest technology companies and holding them accountable for breaking the law and violating Texans’ privacy rights. Any abuse of Texans’ sensitive data will be met with the full force of the law.”
The settlement reached between Texas and Meta sets a significant precedent for data privacy enforcement and is likely to influence the Nigerian case, according to analysts.
Meta and the $220m Nigerian fine
Just weeks before the Texas settlement, Nigeria’s Federal Competition and Consumer Protection Commission (FCCPC) and the Nigerian Data Protection Commission (NDPC) levied a $220 million fine on Meta and the cost of the investigation in the sum of $35,000.00 for violating the country’s consumer protection laws.
The fine stemmed from Meta’s updated privacy policy which became operational in May 15, 2021. The FCCPC investigation found that Meta failed to meet legal standards set by Nigeria’s data protection regulations. Specific issues included inadequate user consent collection and unauthorized data sharing between WhatsApp and other Meta platforms.
Following the findings of the Nigerian regulators, the FCCPC subsequently issued the following orders
9. “Meta Parties shall pay a penalty of Two Hundred and Twenty Million U.S Dollars only ($220,000,000.00) (at prevailing exchange rate where applicable). This shall be paid no later than 60 days from the date of this order.”
Federal Competition and Consumer Protection Commission (FCCPC).
1. Meta Parties shall immediately reinstate the rights of Nigerian users to self-determine and control the use, processing, sharing or transfer of their data, as well as their right to informed choice, and fair dealings by providing Nigerian Users an opportunity to restrict and withdraw their consent without losing functionality or deleting the application;
2. Meta Parties shall immediately ensure that their Privacy Policy complies with the applicable data protection laws in Nigeria with respect to its obligation to ensure data subjects consent freely to any Privacy Policies, by updating the Privacy Policy in an intelligible format, that allows Nigerian Users the opportunity to fully express their legitimate rights with respect to each data point collected, processed, transferred or shared;
3. Meta Parties shall immediately and forthwith stop the process of sharing WhatsApp user’s information with other Facebook companies and third parties, until such a time when users have actively and voluntarily consented to each and every component of the liberties Meta parties intend to exercise with respect to the information of the data subjects. Such proposed policy must be approved by the Nigeria Data Protection Commission (NDPC) in accordance with the Nigeria Data Protection Act (NDPA) and any other aspects of NDPC’s oversight, and by the Commission in accordance with the Federal Competition and Consumer Protection Act (FCCPA) for aspects of the FCCPC’s oversight. The Commission shall not approve any policy with respect to the overall appropriateness of same prior to, and unless the NDPC has demonstrated its satisfaction by Meta Parties presenting NDPC’s approval in writing;
4. Meta Parties shall immediately revert to the data sharing practices adopted in 2016. Additionally, they are required to establish an opt-in screen that allows users to consent to or withhold consent for the sharing of additional personal data with third parties affiliated with WhatsApp, same to be approved in advance by the Commission and the NDPC;
5. Meta Parties shall immediately and forthwith, cease the tying and transfer of data from its WhatsApp market to its Facebook market, and other third parties’ services without express consent sought and freely obtained from data subjects;
6. Meta Parties shall be required to provide satisfactory Written Assurances to the Commission to the effect that they shall refrain from any and all continuation of the violations of the FCCPA, pursuant to Section 153 of the FCCPA;
7. Meta Parties are hereby directed to enforce its Proposed Remedy package shared with the Commission no later than 15 days from the date of this Order. Information about this package must be included on the WhatsApp website and must be shared with Nigerian users in an accessible format;
8. Meta Parties shall reimburse the Commission the cost of the investigation in the sum of Thirty Five Thousand U.S. Dollars only ($35,000.00) (at prevailing exchange rate where applicable) under Section 23(2) (f) of the FCCPA. This shall be paid no later than 60 days from the date of this order;
and
9. Meta Parties shall pay a penalty of Two Hundred and Twenty Million U.S Dollars only ($220,000,000.00) (at prevailing exchange rate where applicable). This shall be paid no later than 60 days from the date of this order.
Home
