When you upload family photos to an online storage service, you probably expect it to safely store your pictures. You may also use facial recognition features that let you find and organize photos of specific people.
But what happens when that technology analyzes the faces of people who never signed up for the service or agreed to have their biometric information collected?
A recent Amazon Photos biometric privacy lawsuit highlights growing questions about facial recognition, consent, and control over personal information.
On November 10, 2026, a federal judge in Illinois allowed a class action against Amazon to move forward but excluded people whose faces appeared in photos uploaded by someone else.
That doesn't mean non-users have no legal rights. They may still have individual legal claims if they can establish a violation of applicable privacy laws.
The ruling exposes a troubling problem: Your facial data could be collected by technology you've never used or agreed to, yet proving it happened may be difficult.
What Is the Amazon Photos Biometric Privacy Lawsuit About?
The lawsuit, Hogan v. Amazon.com, Inc., was filed in 2021. It alleges Amazon Photos violated Illinois' Biometric Information Privacy Act (BIPA) by collecting facial information without legally required notice or consent.
Amazon Photos uses image recognition to group pictures of people with similar facial characteristics. The technology analyzes faces and creates numerical representations of facial features, called face embeddings, to recognize similarities across photos.
The plaintiffs argue this process involves collecting protected biometric information.
According to the November 10 court ruling, Amazon's terms referred to image recognition but didn't explicitly identify the information as biometric data. Users could also enable image recognition without seeing certain privacy notices.
Amazon disputes the allegations. The judge's decision to certify the class doesn't establish that the company violated the law.
Why the Class Action Only Includes Amazon Photos Users
Imagine attending a family gathering. Someone takes your picture and uploads it to Amazon Photos. If image recognition is enabled, the service could analyze your face to organize their pictures.
You may never know your photograph was uploaded or that facial analysis occurred.
The plaintiffs sought to represent two groups: Amazon Photos users whose own faces were processed and non-users appearing in other people's photos.
The judge certified the first group but rejected the second. The court concluded that identifying everyone in the second group would be extraordinarily difficult.
Nearly 340,000 Illinois-linked Amazon Photos accounts contained approximately 978 million photographs. Many people pictured might not know where the images were stored or that image recognition was enabled.
Without a reliable way to identify affected non-users, the court determined that they couldn't proceed as a class. This wasn't a ruling that their underlying privacy claims were invalid.
It exposes an unusual problem: People with the least control over how their facial data is collected may also have the greatest difficulty discovering it happened. And with no federal legislation, states are rushing to fill the void with biometric data privacy laws.
Who Controls Your Facial Data When Someone Else Uploads Your Photo?
Uploading a photograph doesn't necessarily give someone authority to consent to every use of another person's biometric information.
Amazon's notice to Illinois residents stated that users enabling image recognition were required to confirm they had obtained consent from people appearing in their photos.
However, the court noted that Amazon didn't require users to submit written releases or otherwise prove those individuals received notice.
Someone might willingly pose for a group photo without agreeing to have their face converted into data used by facial recognition software.
The lawsuit doesn't establish that Amazon's approach was unlawful, but it illustrates why consent becomes complicated when software processes information about people who aren't customers.
Similar concerns arise with other technologies, including facial recognition in doorbell cameras. People can encounter biometric technology simply by visiting someone's home.
Why Is Biometric Data Different From Ordinary Personal Information?
Biometric data includes physical or behavioral characteristics technology can use to recognize someone, such as facial measurements, fingerprints, or voice patterns.
Unlike an email address or password, these characteristics are closely connected to your identity.
If your password is compromised, you can change it. You can't replace your face.
Facial recognition systems may generate mathematical representations of facial characteristics rather than simply storing photographs. Depending on the technology, that information can be used to recognize or compare faces, creating long-term privacy risks if misused.
Illinois enacted BIPA to regulate certain collection, storage, and use of biometric information. The law generally requires covered businesses to provide written notice, explain why and how long information will be collected or stored, and obtain a written release before collecting protected biometric data.
These protections vary significantly across states.
The issue also extends beyond photo storage. As recent TikTok litigation involving children's privacy illustrates, technology intended to improve safety or convenience can raise additional questions about collecting and retaining sensitive information.
Who Could Be Included in the Amazon Photos Class Action?
The certified class covers Illinois residents whose faces appeared in photographs uploaded to their own Amazon Photos accounts in Illinois between October 18, 2016, and January 31, 2023, while image recognition was enabled and Amazon's technology generated facial embeddings.
Amazon identified 339,847 Illinois-linked accounts with image recognition enabled during that period, although not every account holder necessarily qualifies.
The court directed the parties to discuss how eligible class members will receive notice. There is currently no settlement or established claims process resulting from this ruling.
People who believe they qualify should follow official court notices rather than assume they're entitled to compensation.
How Can You Protect Your Facial Privacy?
Most people have limited control over photographs others upload. However, you can review image recognition settings on photo storage services, disable features you don't want, and check privacy policies to understand how facial information is collected and retained.
You can also ask friends and relatives before uploading their photographs, particularly when children are involved.
These precautions can't guarantee your image won't be analyzed elsewhere.
The Amazon Photos lawsuit illustrates a broader challenge: As facial recognition becomes embedded in everyday technology, protecting biometric privacy increasingly depends on decisions made by other people.
For individuals who never agreed to use that technology, discovering what happened to their facial information may be the hardest part.
