Welcome back for another week of What's Next, where we report on the intersection of law and technology. This week, we dig into the details of Facebook's new settings on facial recognition and the FTC's role in the policy shift. And a federal judge advances litigation against Cambridge Analytica, throwing out Gibson Dunn's argument that invasion of privacy causes no "concrete harm." Plus, the home of Silicon Valley stays silent on antitrust actions targeting the tech industry. Let's chat: Email me at [email protected] and follow me on Twitter at @a_lancaster3.

FTC Forces Facebook's Hand on Facial Recognition?

Although some hailed the Federal Trade Commissions' $5 billion settlement with Facebook as a comedic punchline, some in the privacy community see the company's new facial recognition settings as being a direct result of the agency's actions against the social media giant.

Facebook issued a somewhat vague announcement last week about changes to how a portion of its users' facial recognition settings will work. "Starting today, people who newly join Facebook or who previously had the tag suggestions setting will have the face recognition setting and will receive information about how it works," the company said in its announcement. "The tag suggestions setting, which only controls whether we can suggest that your friends tag you in photos or videos using face recognition will no longer be available."

Adam Schwartz, a senior staff attorney for the Electronic Frontier Foundation, said the policy shift appears to be fueled by the FTC's enforcement actions against the company. In 2017, the platform began migrating users from its original facial recognition tool called tag suggestions to its new face recognition feature. In the FTC's July complaint issued the same day as the settlement, the commission called out Facebook for misleading users and violating federal law. When the company transitioned to face recognition two years ago, some 60 million users were left with tag suggestions and not the updated tool, according to the agency's complaint. Facebook's communications with this group of users said that if they wanted the tool to apply to them, they could opt in, when in fact the FTC alleged that the tool was turned on by default and they had to opt out.

"It appears to us that the agreement that Facebook made with the FTC in July and the announced new notices and consent requests from last week are very, very similar, both in terms of the kind of information in the notice and who is getting the notice," Schwartz said. "We can't read Facebook's mind, but it does appear to us that last week's announced notice and consent procedure is the result of Facebook's agreement two months ago with the FTC."

However, a vast majority of Facebook's users might not enjoy the change, Schwartz said. With the new settings purportedly applying to new users and the users left under tag suggestions, that could potentially exclude much of Facebook's 2.2 billion users. "One would surmise that it is a small faction of Facebook's total users that are in tag suggestions still who are going to enjoy the benefits of being out of Facebook surveillance unless they opt in," he said.

Facebook did not respond to a request for comment.

The new settings won't apply to lawsuits such as Patel v. Facebook, where a class action of users are seeking damages for Facebook's past violations under the Illinois Biometric Information Privacy Act over its tag suggestions, Schwartz said. However, the forward-looking policy is a step toward compliance with BIPA.

The change could also signal to the rest of Silicon Valley a new status quo for facial recognition privacy policies. "Facebook is a big company and a company that is at the front end of a lot of technological development, so I do think it's possible that a lot of other companies look to Facebook for good or ill," he said. "So when Facebook is doing the wrong thing, as they are mostly doing with face surveillance without consent, that might be a green light to other companies. And the flip side, as Facebook is doing in part, as of last week that they are not collecting face templates without opt-in consent. That might inspire some companies to do the right thing."

Schwartz gives one cheer for Facebook and for the FTC that a small subset of Facebook's users are not going to be subjected to the face surveillance absent their opt-in consent. "But we still have a long way to go, because the vast majority of Facebook's users will be subjected to biometric surveillance even though they haven't opted in. That is still a major problem from our perspective," he said.

Invasion of Privacy Does Harm, Judge Rules

Despite what some digital privacy advocates consider marginal progress on the facial recognition front, U.S. District Judge Vince Chhabria had some choice words for how Facebook has handled user data as he allowed consumer litigation following the company's Cambridge Analytica scandal to proceed.

The Recorder's Ross Todd reports that the judge told Facebook's Gibson, Dunn & Crutcher attorneys that they "could not be more wrong" about their arguments that users do not have a "legitimate privacy interest" when it comes to information shared with friends.

"When you share sensitive information with a limited audience (especially when you've made clear that you intend your audience to be limited), you retain privacy rights and can sue someone for violating them," Chhabria wrote, largely tossing Facebook's efforts to dismiss the litigation.

The judge also rebutted Facebook's arguments that plaintiffs' privacy claims would not give them standing to bring their suits in federal court because of lack of concrete harm.

"To say that a 'mere' privacy invasion is not capable of inflicting an 'actual injury' serious enough to warrant the attention of the federal courts is to disregard the importance of privacy in our society, not to mention the historic role of the federal judiciary in protecting it," Chhabria wrote. "The alleged injury is 'concrete' largely for the reasons already discussed—if you use a company's social media platform to share sensitive information with only your friends, then you suffer a concrete injury when the company disseminates that information widely."

However, if plaintiffs want to proceed with the case, they'll have some tidying up to do. Chhabria took issue with the 414-page, 1,442-paragraph complaint. The judge said the lawyer's seemingly clouded their argument by nitpicking everything Facebook has ever done wrong.

"This strategy interferes significantly with the clarity and effectiveness of the plaintiffs' presentation," the judge wrote.

Crickets from Calif. on Tech Antitrust Probes

When the U.S. Department of Justice announced Friday that it will investigate California's emissions agreement reached with four automakers, the state's lawmakers spit out fighting words, with Gov. Gavin Newsom tweeting that he'd see President Donald Trump "in court." However, California's attorney general has offered a muted response to the antitrust storm brewing on his turf.

As two fresh antitrust actions coalesce around Google and Facebook, California has been noticeably missing in action. Attorneys general from 48 states, Puerto Rico and Washington, D.C., announced Monday they would be looking into the company's "potential monopolistic behavior." California and Alabama are the only states that didn't join the investigation.

And after New York's attorney general announced an investigation into Facebook over allegations of competition suppression Friday, my colleague Cheryl Miller reported that California Attorney General Xavier Becerra's office would not say if he planned to join either of the legal actions.

"California remains deeply concerned and committed to fighting anticompetitive behavior," Becerra said in a statement released by his office. "Regarding this investigation or any other, to protect the integrity of potential and ongoing investigations, we cannot provide comment."

On the Radar

The Data Miner's Injunction A federal appellate court Monday allowed a data miner that scrapes LinkedIn data to live another day. The U.S. Court of Appeals for the Ninth Circuit upheld an injunction stopping LinkedIn from blocking the data miner, hiQ, from accessing publicly available user information on its platform. Ninth Circuit Judge Marsha Berzon wrote that the interest of hiQ, which uses bots to develop talent-mapping products based on publicly available LinkedIn data, outweighed LinkedIn's stated interest in shielding customer privacy. Read more from Ross Todd here.

BlackBerry Gets Squeezed on Patent Suits A Los Angeles federal judge is set to invalidate several patent claims BlackBerry has waged against Facebook and Snapchat's parent company. U.S. District Judge George Wu issued a tentative summary judgement Thursday ruling that two of Blackberry's mobile messaging patents are simply "dressing up the abstract concept of collecting and compiling information." As for a Blackberry patent on push notification, Wu decided the company did not explain how the information was intelligently channelled, as asserted in the patent. "Presumably, humans have been 'intelligently organizing' and selecting data for just as long as they have been unintelligently organizing and selecting it," he wrote. Read more from Scott Graham here.

States Pump Out Privacy Amendments California is not the only state to legislate the privacy issues popping up in today's increasingly plugged in society. At least nine other states have recently spruced up their privacy laws regarding data protection, service providers and breaches. Some legislators are writing hefty penalties into their bills. In New York, if a company fails to properly alert affected users of a data breach it can rack up fines of $5,000 per failed notification. Read more from Bess Hinson here.

Thanks for reading. We will be back next week with more What's Next.