Facebook's 'Tag Suggestions' Allegedly Stored Biometric Data without User Consent

Laws that address this harm

Policy angle: Classified under Privacy & Security (Compromise of privacy by obtaining, leaking or correctly inferring sensitive information) in the MIT AI Risk Repository taxonomy; 3 recorded instruments address this use case in the United States.

• Colorado AI Act Colorado (United States) · Repealed · binding
• Texas Responsible AI Governance Act (TRAIGA) Texas (United States) · In force · binding
• Utah Artificial Intelligence Policy Act (SB 149) Utah (United States) · In force · binding

Matched from the record's risk domain and country to the instruments recorded here. A reviewer can correct the match in the repository (data/external/incident_overrides.yaml).

News reports (1)

Titles link to the original publisher; report text is not reproduced here.

1. 29 Jan 2020
   Facebook to pay $550 million to settle privacy lawsuit over facial recognition tech

   theverge.com · Jay Peters

Who was involved

Alleged deployer

Facebook

Alleged developer

Facebook

Alleged harmed party

Social media users Privacy Facebook users Biometric data subjects

AI systems implicated

Social media platformsFacial recognition systemsFaceprint generation systemsFacebook Tag SuggestionsFacebookBiometric data processing systems

Classification (MIT AI Risk Repository taxonomy)

Risk domain

Privacy & Security

Risk subdomain

2.1 Compromise of privacy by obtaining, leaking or correctly inferring sensitive information

Causal entity

Human

Intent

Unintentional

Timing

Post-deployment

Harm level

AI tangible harm event

Sectors

arts, entertainment and recreation, information and communication

Countries

US

Risk entries describing this failure mode

Entries from the MIT AI Risk Repository coded to subdomain 2.1.

• Risks to privacy

  "General- purpose AI models or systems can ‘leak’ information about individuals whose data was used in training. For future models trained on sensitive personal data like health or financial data, this may lead to partic...

  International Scientific Report on the Safety of Advanced AI (Bengio2024)

• Risks to privacy

  "General- purpose AI systems can cause or contribute to violations of user privacy. Violations can occur inadvertently during the training or usage of AI systems, for example through unauthorised processing of personal d...

  International AI Safety Report 2025 (Bengio2025)

• Private Training Data

  "As recent LLMs continue to incorporate licensed, created, and publicly available data sources in their corpora, the potential to mix private data in the training corpora is significantly increased. The misused private d...

  Risk Taxonomy, Mitigation, and Assessment Benchmarks of Large Language Model Systems (Cui2024)

• Association in LLMs

  "Association in LLMs refers to the capability to associate various pieces of information related to a person. According to [68], [86], given a pair of PII entities (xi , xj ), which is associated by a model F. Using a pr...

  Risk Taxonomy, Mitigation, and Assessment Benchmarks of Large Language Model Systems (Cui2024)

• Privacy Leakage

  "Privacy Leakage means the generated content includes sensitive personal information"

  Risk Taxonomy, Mitigation, and Assessment Benchmarks of Large Language Model Systems (Cui2024)

• Memorization in LLMs

  "Memorization in LLMs refers to the capability to recover the training data with contextual prefixes. According to [88]–[90], given a PII entity x, which is memorized by a model F. Using a prompt p could force the model...

  Risk Taxonomy, Mitigation, and Assessment Benchmarks of Large Language Model Systems (Cui2024)

• Privacy Leakage

  "The model is trained with personal data in the corpus and unintentionally exposing them during the conversation."

  Risk Taxonomy, Mitigation, and Assessment Benchmarks of Large Language Model Systems (Cui2024)

• Privacy and regulation violations

  "Some of the broken systems discussed above are also very invasive of people’s privacy, controlling, for instance, the length of someone’s last romantic relationship [51]. More recently, ChatGPT was banned in Italy over...

  Navigating the Landscape of AI Ethics and Responsibility (Cunha2023)

Related incidents

Linked by editors or by text similarity in the source dataset.

• 1 Apr 2019Ever AI Reportedly Deceived Customers about FRT Use in App
• 23 Mar 2020University of Illinois' Proctorio Remote-Proctoring Deployment Reportedly Raised Student Rights Concerns
• 21 Nov 2021Facebook’s Hate Speech Detection Algorithms Allegedly Disproportionately Failed to Remove Racist Content towards Minority Groups

Incidents in the same risk subdomain

• 19 Feb 2026Grok Reportedly Disclosed Adult Performer Siri Dahl's Legal Name and Birthdate, Allegedly Contributing to Doxxing and Harassment
• 23 Jan 2026NPR Host David Greene Alleged Google's NotebookLM Replicated His Voice Without Consent, Prompting Lawsuit
• 10 Jan 2026Border Patrol Agent Allegedly Claimed Facial Recognition Identified Minneapolis ICE Observer and Global Entry Was Reportedly Revoked Three Days Later
• 4 Dec 2025Perplexity AI Reportedly Accused in Federal Lawsuit of Purported Copyright Infringement and False Attribution of Chicago Tribune Content
• 19 Nov 2025Secret Desires AI Platform Reportedly Exposed Nearly Two Million Sensitive Images in Cloud Storage Leak
• 11 Nov 2025ChatGPT Reportedly Found to Reproduce Protected German Lyrics in Copyright Case

Other incidents involving Facebook

• 1 Dec 2022Facebook's Automated Moderation Allowed Ads Threatening Election Workers to be Posted
• 8 Dec 2021Facebook AI-Supported Moderation for Ads Failed to Detect Violating Content
• 21 Nov 2021Facebook’s Hate Speech Detection Algorithms Allegedly Disproportionately Failed to Remove Racist Content towards Minority Groups
• 1 Oct 2021Facebook Internally Reported Failure of Ranking Algorithm, Exposing Harmful Content to Viewers over Months
• 20 Jul 2021Facebook's Automated Moderation Flagged Gardening Group's Language Use by Mistake
• 1 Mar 2021Facebook's Automated Tools Failed to Adequately Remove Hate Speech, Violence, and Incitement