On January 11, 2021, the Federal Trade Commission (FTC or the “Commission”) announced it reached a proposed settlement with Everalbum, Inc. (“Everalbum”), a developer of a photo app, to resolve allegations that the company deceived consumers about its use of facial recognition technology.

The settlement highlights the FTC’s focus on biometric data and increased scrutiny regarding facial recognition technology. Specifically, in announcing the settlement, the FTC stated that facial recognition technology can turn photos into “sensitive biometric data” and emphasized that ensuring companies keep their promises regarding the use of biometric data will be a “high priority for the FTC.” Additionally, while the proposed settlement was approved by all five FTC Commissioners, Commissioner Rohit Chopra issued a separate statement criticizing facial recognition technology and expressing support for a moratorium or restrictions on the use of such technology.

Everalbum provides a photo storage and organization app called “Ever,” which allows users to upload photos and videos to be stored and organized using the company’s cloud-based storage service. Starting in 2017, Ever launched its “Friends” feature, which uses facial recognition technology to group users’ photos by the faces of people appearing in the photos. Initially, the feature was automatically enabled for all users and could not be turned off, although the company later allowed users located in Illinois, Texas, Washington, and the EU to choose whether to turn on the feature. However, according to the FTC’s complaint, Everalbum’s website represented that Everalbum was not using facial recognition technology unless a user affirmatively enabled or turned on the technology. As the technology was instead enabled by default for users located outside of Texas, Illinois, Washington, and the EU, the FTC alleged that this representation was deceptive, in violation of Section 5(a) of the FTC Act.

In addition, the FTC’s complaint alleged that Everalbum made deceptive representations regarding the deletion of Ever users’ photos upon account deactivation. For example, according to the complaint, Everalbum represented that deactivating an Ever account would “permanently delete all photos and videos stored on your account[.]” However, the FTC alleged that Everalbum continued to indefinitely retain photos and videos after a user deactivated his or her account until at least October 2019. The FTC therefore found that the representations regarding deletion were deceptive.

The proposed stipulated settlement requires Everalbum to obtain affirmative express consent from users prior to using biometric information—defined in the proposed settlement to include depictions of an individual’s facial features—for certain purposes. Specifically, Everalbum must obtain consent to create data derived in whole or in part from an image of an individual’s face (“Face Embedding”) or to train, develop, or alter facial recognition models or algorithms. In addition, Everalbum must delete (1) the photos and videos associated with deactivated accounts; (2) Face Embeddings derived from photos of Ever users who have not provided affirmative express consent as required by the proposed settlement; and (3) facial recognition technologies enhanced by any improperly obtained photos. However, no financial penalty is imposed in the proposed settlement.

The obligation to delete facial recognition technologies, including algorithms and models, enhanced by improperly obtained photos was noted as an “important course correction” in Commissioner Chopra’s statement, as he highlighted that Commissioners have previously allowed “data protection law violators” to retain technologies that derive value from “ill-gotten data.” In addition to addressing specific aspects of the proposed settlement, Commissioner Chopra used his statement as an opportunity to discuss broader concerns regarding facial recognition technology and to emphasize the importance of maintaining “states’ authority to protect personal data.” The statement concluded by stating that it will be critical for the Commission, states, and other regulators to pursue further enforcement actions to ensure that providers of facial recognition technology are held accountable for false claims and unfair conduct.

Although the Everalbum settlement marks only the first action brought by the FTC that addresses claims regarding facial recognition technology, the settlement represents continued focus by the FTC on facial recognition technology and biometric data. The FTC has held workshops focused on potential privacy concerns posed by facial recognition technologies since at least 2011 and continues to issue guidance (see also here) to companies regarding the use of such technologies.