In Texas’ first public enforcement of its biometric privacy law, Meta agreed to pay $1.4 billion to settle claims that its now-defunct face recognition system violated state law. The law was first passed in 2001.

As part of the Texas settlement, Meta (formerly Facebook) can seek pre-approval from the state for any future biometric projects. The settlement does not require Meta to destroy any models or algorithms trained on Texas biometric data, as the state urged in its original lawsuit. And the settlement appears designed to avoid that remedy in the future.

Facebook Previously Discontinued Its Face Recognition System

Meta announced in November 2021 that it would shut down its tool that scanned the face of every person in photos posted on the platform. The tool identified and tagged users who had purportedly opted in to the feature. At the time, Meta also announced that it would delete more than a billion face templates.

The company shut down this tool months after agreeing to a $650 million class action settlement brought by Illinois consumers under the state's strong biometric privacy law.

Texas’ Law Has Steep Penalties But Little Enforcement

The Texas settlement nearly three years later is welcome, but it also highlights the need to give consumers their own private right of action to enforce consumer data privacy laws.

The Texas Attorney General has sole authority to enforce the Texas Capture or Use of Biometric Identifier (CUBI) law, which prevents companies from capturing biometric identifiers for a commercial purpose, unless notice and consent is first given. The law has existed for decades, but this is the first time it has been enforced.

State regulators do not always have the resources or the will to aggressively enforce consumer privacy laws. And without strong enforcement, companies will not make compliance a priority. Most of the comprehensive consumer data privacy laws passed at the state level in the past few years lack a private right of action, and there have been few public enforcement actions.

That is why consumers should be empowered to bring lawsuits on their own behalf. That should be the priority in any new law passed. Hopefully, states like Texas will continue to enforce their privacy laws. Still, there is no substitute for consumer enforcement.