Preview
FILED: NEW YORK COUNTY CLERK 01/05/2024 08:19 PM INDEX NO. 161618/2023
NYSCEF DOC. NO. 107 RECEIVED NYSCEF: 01/05/2024
Exhibit 16
FILED: NEW YORK COUNTY CLERK 01/05/2024 08:19 PM INDEX NO. 161618/2023
NYSCEF DOC. NO. 107 RECEIVED NYSCEF: 01/05/2024
CAUSE NO. 22-0121
THE STATE OF TEXAS § IN THE DISTRICT COURT
§
§
§
§
Plaintiff, §
§
v. §
§ 71ST JUDICIAL DISTRICT
Meta Platforms, Inc., §
f/k/a Facebook, Inc. §
§
§
§
Defendant. § HARRISON COUNTY, TEXAS
PLAINTIFF’S FIRST AMENDED PETITION
TO THE HONORABLE JUDGE OF SAID COURT:
Plaintiff, STATE OF TEXAS, acting by and through the Attorney General of Texas, KEN
PAXTON (the “State”), on behalf of the public interest, complains of Defendant META
PLATFORMS, INC., also known as “FACEBOOK.” In this action, the State alleges that
Facebook unlawfully captured the biometric identifiers of Texans for a commercial purpose
without their informed consent, disclosed those identifiers to others, and failed to destroy collected
identifiers within a reasonable time, all in violation of the Texas Capture or Use of Biometric
Identifier Act, Tex. Bus. & Com. Code § 503.001 (“CUBI”); and that Facebook engaged in false,
misleading, and deceptive acts and practices in violation of the Texas Deceptive Trade Practices-
Consumer Protection Act (“DTPA”), Tex. Bus. & Com. Code §§ 17.41 et seq. Facebook has, for
over a decade, built an Artificial Intelligence empire on the backs of Texans, and millions of
Americans, by deceiving them while capturing their most intimate data, thereby putting their well-
1
FILED: NEW YORK COUNTY CLERK 01/05/2024 08:19 PM INDEX NO. 161618/2023
NYSCEF DOC. NO. 107 RECEIVED NYSCEF: 01/05/2024
being, safety, and security at risk. Under Texas law, the Attorney General has the exclusive
authority to vindicate rights under CUBI, and he, therefore, brings this Petition before the Court.
In support hereof, General Paxton, acting for the State, will respectfully show the Court the following.
INTRODUCTION
Defendant Meta Platforms, Inc., better known as “Facebook,” was founded in 2004. The
ostensible premise behind Facebook’s eponymous social-media platform (the “Facebook
Platform”) was as simple as it was appealing: With only a few keystrokes, users could connect
with friends and family, and share photographs, milestones, and other life updates in their
community of “Facebook friends.”
The Facebook Platform was an instant hit, and within months, “Facebook” became
synonymous with social media. Since 2008, the Facebook Platform has been the largest interactive
social-media platform in the world, growing to include photo sharing, video sharing, shopping,
playing games, creating fandoms, instant messaging, video conferencing, and event organizing, all
on a single website.
In 2011, approximately 12 million Texans had a Facebook account; by 2021, that number
had ballooned to an estimated 20.5 million Texans. The popularity of its brand has made Facebook
one of the most valuable companies in the world, with one of the top ten market capitalizations in
the world, and revenue of over $85 billion last year.
But Facebook’s omnipresent empire was built on deception, lies, and brazen abuses of
Texans’ privacy rights—all for Facebook’s own commercial gain. Of relevance here, for over a
decade, while holding itself out as a trusted meeting place for Texans to connect and share special
moments with family and friends, Facebook was secretly capturing, disclosing, unlawfully
retaining—and profiting off of—Texans’ most personal and highly sensitive information: records
of their facial geometries, which Texas law refers to as biometric identifiers.
2
FILED: NEW YORK COUNTY CLERK 01/05/2024 08:19 PM INDEX NO. 161618/2023
NYSCEF DOC. NO. 107 RECEIVED NYSCEF: 01/05/2024
Facebook deceived the public by concealing the nature of its practices. Facebook knew
that the term “biometric data” “tends to scare people off.” See Pls.’ Opp’n to Facebook, Inc.’s Mot.
for Summ J. at 6, In re Facebook Biometric Information Privacy Litigation, No. 3:15-cv-03747-
JD (N.D. Cal. 2018), ECF No. 341. And so it neither used the term “biometric data” nor otherwise
informed users of its practices.
Texans who used Facebook’s social-media services were oblivious to the fact that
Facebook—without their permission—was capturing biometric information from photos and
videos that users had uploaded for the sole purpose of sharing with family and friends.
Also unbeknownst to users, Facebook was disclosing users’ personal information to other
entities who further exploited it.
Moreover, Facebook failed to destroy the collected biometric identifiers within a
reasonable time, exposing Texans to ever-increasing risks to their well-being, safety, and security.
When information is wrongfully obtained to begin with, holding it for any amount of time is
unreasonably long.
Facebook’s illegal and deceptive conduct did not end with its users. For Texans who did
not use Facebook’s social-media services, Facebook was still capturing hundreds of millions of
biometric identifiers from photos and videos innocently uploaded by friends and family who did
use Facebook’s services. There was no way for such non-users to know of or contest this
exploitation.
Facebook knowingly captured biometric information for its own commercial benefit, to
train and improve its facial-recognition technology, and thereby create a powerful artificial
intelligence (“AI”) apparatus that reaches all corners of the world and ensnares even those who
have intentionally avoided using Facebook services.
3
FILED: NEW YORK COUNTY CLERK 01/05/2024 08:19 PM INDEX NO. 161618/2023
NYSCEF DOC. NO. 107 RECEIVED NYSCEF: 01/05/2024
The scope of Facebook’s misconduct is staggering. Facebook repeatedly captured Texans’
biometric identifiers without consent not hundreds, or thousands, or millions of times—but billions
of times, all in violation of CUBI and the DTPA.
After paying $650 million for engaging in this same conduct in Illinois, being called out
by whistleblowers who exposed Facebook’s indifference to the societal harms it caused, and
paying billions of dollars in fines to the Federal Trade Commission, Facebook finally claimed to
have ceased its invasive and unlawful facial-recognition practices in late 2021. By that point,
however, it had spent more than a decade secretly exploiting Texans and their personal information
to perfect its AI apparatus.
There can be no free pass for Facebook’s unlawfully invading the privacy rights of tens of
millions of Texas residents by misappropriating their data and putting one of their most personal
and valuable possessions—records of their facial geometry—at risk from hackers and bad actors,
all to build an AI-powered virtual-reality empire. The State brings this suit to hold Facebook
accountable for covertly flouting Texas law for more than a decade, and to stop Facebook from
ever again violating the rights of Texans for its commercial gain.
DISCOVERY CONTROL PLAN
1. The discovery in this case is intended to be conducted under Level 3 pursuant to
Texas Rule of Civil Procedure 190.4. This case is not subject to the restrictions of expedited
discovery under Texas Rule of Civil Procedure 169 because the State’s claims include a claim for
non-monetary injunctive relief and claims for monetary relief, including penalties and attorneys’
fees and costs, in excess of $250,000, and the claims are within the jurisdictional limits of the
Court.
4
FILED: NEW YORK COUNTY CLERK 01/05/2024 08:19 PM INDEX NO. 161618/2023
NYSCEF DOC. NO. 107 RECEIVED NYSCEF: 01/05/2024
THE DEFENDANT
2. Meta Platforms, Inc. (“Facebook”) is a Delaware corporation with its
headquarters and principal place of business at 1601 Willow Road, Menlo Park, California.
Facebook is registered to do business in Texas and enters into contracts in Texas to provide
access to its social-media platforms. The number of Facebook’s Texas users is likely in the tens
of millions.
3. Since 2011, Facebook has maintained a continuous presence in Texas, where it
currently employs approximately 2,000 employees. 1 As of 2020, Facebook had several hundred
employees in Texas whom it described as “management-level.” As of April 2022, Facebook was
actively recruiting for over 230 open employment positions in Texas.
4. Facebook has specifically and purposefully advertised its services in Texas.
5. Facebook maintains a general business office in Texas, leasing over 1 million
square feet of office space in Austin, including all of the office space—33 floors—in the tallest
tower in the State’s capital. 2 And it is reportedly looking to expand its presence. 3
6. In 2018, Facebook described Austin as its “second home,” and noted its intent to
“commit to the Austin community for the long haul.” 4
1
See Bridget Spencer, Facebook parent company Meta to expand in Austin, leading high rise, Fox
News 7 Austin (Jan. 11, 2022) https://www.fox7austin.com/news/facebook-parent-company-
meta-to-expand-in-austin-leasing-high-rise.
2
Meta goes mega on Texas office space, The Real Deal, (Jan. 10, 2022)
https://therealdeal.com/2022/01/10/meta-goes-mega-on-texas-office-space/.
3
Kathryn Hardison, Sources: Facebook wants 1M more square feet downtown, Austin Business
Journal (Dec. 4, 2020), https://www.bizjournals.com/austin/news/2020/12/04/facebook-could-be-
expanding-again-in-austin.html.
4
Facebook Brings New Digital Marketing Certificate Program to Austin Community College,
Meta Newsroom (Sept. 24, 2018), https://about.fb.com/news/2018/09/facebook-brings-new-
digital-marketing-certificate-program-to-austin-community-college/.
5
FILED: NEW YORK COUNTY CLERK 01/05/2024 08:19 PM INDEX NO. 161618/2023
NYSCEF DOC. NO. 107 RECEIVED NYSCEF: 01/05/2024
7. On information and belief, Facebook pays substantial amounts of taxes to Texas
taxing authorities.
8. On information and belief, Facebook’s Texas offices are the central location for all
activities relating to Facebook’s employee relations nationwide.
9. On information and belief, Facebook maintains accounts at its Texas offices, where
it has account managers. Facebook also has agents for service of process in the State.
10. Since 2015, Facebook has operated a large data center in Fort Worth, one of only
four “cold storage” facilities that Facebook operates worldwide. 5 Facebook’s Fort Worth server
farm covers more than 2.5 million square feet of space, over multiple buildings, on a 170-acre
site. 6
11. When Facebook opened its Fort Worth data center, Facebook executive Matt
VanderZanden explained that “these buildings — and the hardware inside them—support our
mission to give people the power to build community and bring the world closer together. . . . They
also help us accommodate the growing number of photos and videos being shared and scale as
we create more immersive experiences through live video, 360 photos, and videos, and virtual and
augmented reality.” 7
5
Graeme Burton, Facebook starts work on final phase of $1.5bn Fort Worth data center campus,
DCD (Dec. 10, 2020), https://www.datacenterdynamics.com/en/news/facebook-starts-work-final-
phase-15bn-fort-worth-data-center-campus/.
6
Facebook Fort Worth Data Center, DPR Construction, https://www.dpr.com/projects/facebook-
fort-worth-data-center (last visited May 13, 2022).
7
David Kirkpatrick, Efficiency, Sustainability Drive Massive Facebook Fort Worth Data Center,
Dallas Innovates (Oct. 19, 2018), https://dallasinnovates.com/efficiency-sustainability-drive-
massive-facebook-fort-worth-data-center/ (emphasis added).
6
FILED: NEW YORK COUNTY CLERK 01/05/2024 08:19 PM INDEX NO. 161618/2023
NYSCEF DOC. NO. 107 RECEIVED NYSCEF: 01/05/2024
12. Facebook has described the Fort Worth data center as “one of the cornerstones of
the global infrastructure that brings Facebook apps and services to you every day.” 8
13. In 2022, Facebook will break ground on a second Texas-based data center in
Temple (north of Austin), enjoying a 75-percent property-tax break for the first ten years, offered
by Temple to induce Facebook to bring its business to town. 9
14. Facebook’s activities in Texas have been wildly profitable, and the company has
earned billions of dollars from the use of its platforms in Texas.
JURISDICTION AND VENUE
15. This enforcement action is brought by Attorney General of Texas Ken Paxton,
through his Consumer Protection Division (CPD), in the name of the State and in the public
interest, under the authority granted to him by section 503.001(d) of CUBI, on the ground that
Facebook has (1) captured the biometric identifiers of individuals without their informed consent,
as defined in, and declared unlawful by, section 503.001(b) of CUBI; (2) disclosed the biometric
identifiers to other entities, as declared unlawful by section 503.001(c)(1) of CUBI; and (3) failed
to destroy within a reasonable time the biometric identifiers it has collected, as declared unlawful
by section 503.001(c)(3) of CUBI. General Paxton also brings this enforcement action pursuant
to the authority granted to him by section 17.47 of the DTPA, on the ground that Facebook has
engaged in false, deceptive, and misleading acts and practices in the course of trade and commerce,
as defined in, and declared unlawful by, sections 17.46 (a) and (b) of the DTPA. In enforcement
8
The Newest Addition to the Facebook Data Center Fleet: Fort Worth, Meta Newsroom (July 7,
2015), https://about.fb.com/news/2015/07/the-newest-addition-to-the-facebook-data-center-fleet-
fort-worth/.
9
$800 million data center for Facebook parent company Meta to open in Temple, KCEN TV,
https://www.kcentv.com/article/news/local/facebook-parent-company-meta-to-open-data-center-
in-temple/500-7943fc64-b735-4b0b-8a91-5b7abffbbf30
7
FILED: NEW YORK COUNTY CLERK 01/05/2024 08:19 PM INDEX NO. 161618/2023
NYSCEF DOC. NO. 107 RECEIVED NYSCEF: 01/05/2024
suits filed pursuant to section 503.001(d) of CUBI and section 17.47 of the DTPA, the Attorney
General is authorized to seek civil penalties, redress for consumers, and equitable relief.
16. Venue of this suit is proper in Harrison County under section 17.47(b) of the DTPA
because Facebook has done business in Harrison County, including but not limited to contracting
with businesses and individuals in Harrison County, and under section 15.002(a)(1) of the Texas
Civil Practices and Remedies Code because a substantial part of the events and omissions giving
rise to the claims in this Petition occurred in Harrison County, including but not limited to
individuals’ uploading media to Facebook platforms in Harrison County.
PUBLIC INTEREST
17. The State of Texas has reason to believe that Facebook has engaged in, and will
continue to engage in, the unlawful practices set forth below; that Facebook has, by means of these
unlawful acts and practices, caused damage to and acquired money or property (including
biometric identifiers) from persons; and that Facebook adversely affected the lawful conduct of
trade and commerce, thereby directly and indirectly affecting the people of the State of Texas.
Therefore, the Consumer Protection Division of the Office of the Attorney General of the State of
Texas believes and is of the opinion that these proceedings are in the public interest.
TRADE AND COMMERCE
18. Facebook has, at all times described below, engaged in conduct that constitutes
“trade” and “commerce,” as those terms are defined in section 17.45(6) of the DTPA.
CONDITIONS PRECEDENT
19. All conditions precedent to the State’s claim for relief have been performed or have
occurred. The Consumer Protection Division informed Defendant, in general, of the alleged
8
FILED: NEW YORK COUNTY CLERK 01/05/2024 08:19 PM INDEX NO. 161618/2023
NYSCEF DOC. NO. 107 RECEIVED NYSCEF: 01/05/2024
unlawful conduct described below at least seven days before filing suit, as may be required by
subsection 17.47(a) of the DTPA.
ACTS OF AGENTS
20. Whenever in this Petition it is alleged that Facebook did any act, it is meant that
Facebook performed or participated in the act, or that its officers, agents, or employees performed
or participated in the act on behalf of and under the authority of Facebook.
BACKGROUND
Biometrics are used for everything from the benign unlocking of phones to criminal targeting
and religious persecution.
21. “Biometrics” refer to physical characteristics that are unique to each individual.
The most well-known example is the fingerprint.
22. Over the past two decades, the use of other biometrics has become increasingly
common. Such biometric identifiers include retina or iris scans, records of face geometry,
voiceprints, and the lay of blood vessels beneath an individual’s skin. These biometric identifiers
were once difficult to capture without a live person, but Silicon Valley has been hard at work to
enable machines to create biometric profiles without a live subject and without a human operator.
23. Today, one of the most prevalent uses of biometric identifiers by Big Tech is facial-
recognition technology. This technology captures biometric identifiers by transforming a facial
image—portrayed in photographs or videos—into an electronic map of the face.
24. When facial-recognition technology examines an image of a face, it extracts data
from facial features and generates a face map through the use of facial-recognition algorithms. It
can then compare the captured face map to other face maps it has stored in databases to see if there
is a match.
9
FILED: NEW YORK COUNTY CLERK 01/05/2024 08:19 PM INDEX NO. 161618/2023
NYSCEF DOC. NO. 107 RECEIVED NYSCEF: 01/05/2024
25. Like a fingerprint, every record of facial geometry is unique, allowing face maps to
serve a variety of security, financial, and law-enforcement functions. The more advanced the
facial-recognition technology, the better it is at matching two facial images of the same individual.
26. Figure 1, below, shows an example of the data points that are captured by facial-
recognition technology in mapping the image of a human face.
Figure 1
27. Advancements in computer processing and machine learning have vastly improved
facial-recognition technology, generating many commercial applications for it, while rapidly
raising alarming privacy concerns about its scale, scope, and secrecy—and about the improper
uses it could serve when in the wrong hands.
28. Facial recognition is now used for a variety of day-to-day functions that formerly
required passwords, secondary verification, or in-person confirmation of identity.
29. For instance, many cell phones and tablets now offer biometric functionality that
allows users to unlock their devices by scanning their facial geometry; face geometry is used by
banks to secure access to account information and authorize transactions; and businesses are using
facial-recognition systems to control access to secure facilities.
10
FILED: NEW YORK COUNTY CLERK 01/05/2024 08:19 PM INDEX NO. 161618/2023
NYSCEF DOC. NO. 107 RECEIVED NYSCEF: 01/05/2024
30. But the use of biometrics and facial-recognition technology goes far beyond these
innocuous examples.
31. Facial-recognition technology is a favorite of stalkers and criminals because, by
simply having a photo of their target, they are able to locate that target’s name, social-media
account, and other personal information. 10 This technology is also used by retailers to identify
potential thieves, but because the technology is not perfect, innocent individuals have been treated
as criminals—which is particularly pernicious given that the technology is at its worst when
purporting to identify minorities. 11 And governments have used this technology to suppress their
constituents; the Communist Party of China, for example, has used its facial-recognition dragnet
to surveil and persecute the ethnic Uyghur minority, 12 and to target Christians by deploying its
technology in churches. 13
32. The creation and maintenance of sprawling databases containing millions of
people’s biometrics generates an enormous risk that cyber criminals and other dangerous actors
will access these unique identifiers and encroach into virtually every aspect of their owners’ lives.
The risk is particularly treacherous when those people have no knowledge of—or authority over—
the capture and use of their biometrics.
10
Drew Harwell, This facial recognition website can turn anyone into a cop – or a stalker, The
Wash. Post, (May 14, 2021), https://www.washingtonpost.com/technology/2021/05/14/pimeyes-
facial-recognition-search-secrecy/.
11
Kashmir Hill, Another Arrest, and Jail Time, Due to a Bad Facial Recognition Match, N.Y.
Times, (Dec 19, 2020), https://www.nytimes.com/2020/12/29/technology/facial-recognition-
misidentify-jail.html.
12
Chris Buckley and Paul Mozer, How China Uses High-Tech Surveillance to Subdue Minorities,
N.Y. Times, (May 22, 2019), https://www.nytimes.com/2019/05/22/world/asia/china-
surveillance-xinjiang.html.
13
Chris Meserole, Technological surveillance of religion in China, Brookings, (July 22, 2020),
https://www.brookings.edu/testimonies/technological-surveillance-of-religion-in-china/.
11
FILED: NEW YORK COUNTY CLERK 01/05/2024 08:19 PM INDEX NO. 161618/2023
NYSCEF DOC. NO. 107 RECEIVED NYSCEF: 01/05/2024
33. Unlike other identifiers, such as Social Security numbers, which can be changed
when stolen or misappropriated, biometric identifiers are permanent. Once a biometric identifier
is captured, a bad actor can access and exploit the identifier for the rest of the victim’s life. These
unique and permanent biometric identifiers, once exposed, leave victims with no means to prevent
identity theft, unauthorized tracking and targeting, or other threats to privacy, safety, and security.
Texas implements CUBI to protect Texans from danger.
34. Foreseeing the dangers that the capture of biometrics posed for Texans—dangers
that have become only more severe as facial-technology has improved dramatically—the Texas
Legislature enacted a law in 2001 to regulate the commercial capture of biometric identifiers. That
law was recodified in 2009 as CUBI. To protect Texans from abuse, the Legislature chose to
impose a requirement that is commonplace in the law: obtain informed consent.
35. Specifically, under CUBI, “A person may not capture a biometric identifier of an
individual for a commercial purpose unless the person first:
(i) informs the individual before capturing the biometric identifier; and
(ii) receives the individual’s consent to capture the biometric identifier.” 14
36. Moreover, an entity in possession of a biometric identifier may not disclose it to
anybody else for any purpose (with the exception of limited, enumerated purposes, such as law
enforcement). 15
37. If an entity comes into possession of a biometric identifier, the entity must destroy
it within a reasonable time, but no later than one year after the purpose for collecting the identifier
expires. 16
14
Tex. Bus. & Comm. Code § 503.001(b).
15
Tex. Bus. & Comm. Code § 503.001(c)(1).
16
Subject to limited exceptions. See Tex. Bus. & Comm. Code § 503.001(c)(3).
12
FILED: NEW YORK COUNTY CLERK 01/05/2024 08:19 PM INDEX NO. 161618/2023
NYSCEF DOC. NO. 107 RECEIVED NYSCEF: 01/05/2024
38. And the entity possessing a biometric identifier must store it, transmit it, and protect
it from disclosure using reasonable care, in a way that is at least as protective as the way it stores,
transmits, and protects other confidential information.
39. These prohibitions and protections are not only reasonable, but necessary in light
of the risks inherent in allowing a Big Tech firm to access Texans’ most sensitive and immutable
personal information.
40. CUBI defines a biometric identifier as “a retina or iris scan, fingerprint, voiceprint,
or record of hand or face geometry.” 17
Facebook routinely violates its users’ privacy rights.
41. Silicon Valley firms like Facebook are not safe guardians of this highly sensitive
information. On the contrary, such firms have been caught acting recklessly with others’ private
information on myriad occasions. For example, in 2011, Facebook entered into a settlement
agreement with the FTC after the FTC caught the company engaging in widespread violations of
users’ privacy. The FTC allegations included: (a) that, in December 2009, Facebook changed its
website so that certain information users had specifically designated as private was made public—
with no warning to users and no opportunity for them to withhold consent; (b) that Facebook gave
third-party apps access to nearly all of users’ personal data, despite representing to users that the
apps would have access only to the information they needed to operate; (c) that Facebook shared
users’ personal information with advertisers—after promising users it would not do so; and (d) that
Facebook continued to allow access to the photos of users who had deleted their accounts, despite
telling users that their photos would become inaccessible.
17
Tex. Bus. & Comm. Code § 503.001(a)
13
FILED: NEW YORK COUNTY CLERK 01/05/2024 08:19 PM INDEX NO. 161618/2023
NYSCEF DOC. NO. 107 RECEIVED NYSCEF: 01/05/2024
42. Further, in Europe, Facebook was involved in litigation from 2015 to 2021 over its
practice of gathering the personal information of users and non-users for advertising purposes
without first obtaining their consent.
43. And in 2019, Facebook was fined $5 billion by the FTC for an array of privacy
violations.
44. These examples illustrate Facebook’s pattern of betraying users—promising
privacy while secretly disclosing personal information to third parties for its commercial gain, and
failing to remove users’ personal information even after they have left Facebook.
45. We now know that, consistent with its track record, Facebook has done it again,
this time secretly and recklessly disregarding the privacy of its users—and of any children, family
members, or friends pictured in the users’ uploaded images and videos—to capture maps of their
faces. It has thereby created one of the world’s largest databases of human face maps. Facebook
has committed this abuse and placed these individuals in danger all in order to train its AI apparatus
in facial recognition—and all in violation of CUBI and the DTPA.
46. For over a decade, Facebook has brazenly violated CUBI and the DTPA. Facebook
did not inform Texans that it was capturing their private biometric identifiers as part of its
widespread facial-recognition program, let alone obtain their consent; it then disclosed those
biometric identifiers to other entities; and it failed to delete its collected biometric identifiers within
a reasonable time, compounding the risk of harm for tens of millions of Texans.
SPECIFIC FACTUAL ALLEGATIONS
47. The Facebook Platform allows users to upload and share photographs and videos
with friends and relatives. Once a user uploads a photograph or video on the Facebook Platform,
the user can “tag” (i.e., identify by name) other Facebook Platform users and non-users who appear
in the photograph or video.
14
FILED: NEW YORK COUNTY CLERK 01/05/2024 08:19 PM INDEX NO. 161618/2023
NYSCEF DOC. NO. 107 RECEIVED NYSCEF: 01/05/2024
48. Tagging has been pivotal to the explosive expansion of the Facebook empire. As
articulated by Ezra Callahan, an early Facebook employee, “[t]he single greatest growth
mechanism ever [for Facebook] was photo tagging. It shaped all of the rest of the product decisions
that got made.” 18
49. Facebook’s founder and CEO Mark Zuckerberg has similarly commented that, “the
coolest thing about [Facebook Platform] photos is that you can tag them . . . in the way that makes
them linked to people’s profiles.” 19 He has also stated that photo tagging is “more important than
every other [Facebook Platform] feature put together,” and that “very quickly” Facebook’s “photo
product became the most used photos product on the web.” 20 Other Facebook executives have
similarly described photo-tagging as a “core piece of functionality” that made the Facebook
Platform the “biggest photo product on the web.” 21 And its Vice President of Product Design
stated:
One of the stories we used to tell in the early days of Facebook was
how a small, two-engineer project came to dominate the entire photo
sharing landscape in the late 2000s. . . . There were no bells and
whistles, save one... The one feature Facebook Photos *did* have,
even in its earliest incarnation, was this: photo tagging. . . . What a
simple feature. And yet. It made all the difference. Facebook
Photos skyrocketed in popularity. Within a few years, it was the
most popular photo sharing service on the Internet. 22
18
Adam Fisher, Valley of Genius: The Uncensored History of Silicon Valley (As Told by the
Hackers, Founders, and Freaks Who Made It Boom) 365 (2018).
19
Guest Lecture by Mark Zuckerberg, Harvard University at 25:44-57, YouTube (Dec. 7, 2005),
available at https://www.youtube.com/watch?v=_YpaWA_-XRw.
20
A Conversation with Mark Zuckerberg, Web 2.0 Summit 2010 at 19:15-22, YouTube, (Nov. 19,
2010), available at https://www.youtube.com/watch?v=CRUOl03nZIc.
21
Kim-Mai Cutler, Q&A: Facebook’s Bret Taylor on privacy, the transition from FriendFeed,
VentureBeat (May 28, 2010), available at https://venturebeat.com/2010/05/28/bret-taylor-
facebook.
22
See Julie Zhou, Twitter (Apr. 8, 2021), available at
https://twitter.com/joulee/status/1380183017025511430.
15
FILED: NEW YORK COUNTY CLERK 01/05/2024 08:19 PM INDEX NO. 161618/2023
NYSCEF DOC. NO. 107 RECEIVED NYSCEF: 01/05/2024
Facebook launches Tag Suggestions.
50. To boost use of the tagging feature, Facebook announced a program in 2010 called
“Tag Suggestions.” 23
51. Tag Suggestions worked by using Facebook’s proprietary facial-recognition
process to capture and analyze the records of facial geometry—of both users and non-users—
obtained from user-uploaded photos and videos. One part of the facial-recognition process is
shown in Figure 2, below:
Figure 2
52. Tag Suggestions would then use the captured records of face geometry to compare
the faces in the photo or video to the faces of individuals in its database.
53. If Tag Suggestions recognized and identified one of the faces appearing in the
photograph, Facebook would suggest to the user the individual’s name, so that the user could tag
the individual.
23
This feature was later upgraded to be called simply “Face Recognition.”
16
FILED: NEW YORK COUNTY CLERK 01/05/2024 08:19 PM INDEX NO. 161618/2023
NYSCEF DOC. NO. 107 RECEIVED NYSCEF: 01/05/2024
54. Figure 3, below, shows an example of what Tag Suggestions looked like to a
Facebook Platform user:
Figure 3
55. As shown, users could accept a tag suggestion from Facebook or enter in a name
for each pictured individual. By entering the name of the person in a photograph once, users were
unwittingly giving Facebook’s facial-recognition algorithm a baseline against which to compare
every other photo ever uploaded on the Facebook Platform, for Facebook to see if there was a
facial-map match.
56. While touting Tag Suggestions as a means to improve user experience, Facebook
never disclosed that Tag Suggestions was capturing facial geometry from photographs and
continuously training its AI. Little did users know that when they answered the simple question
17
FILED: NEW YORK COUNTY CLERK 01/05/2024 08:19 PM INDEX NO. 161618/2023
NYSCEF DOC. NO. 107 RECEIVED NYSCEF: 01/05/2024
of who was in a photograph, they were helping to teach Facebook’s facial-recognition technology
to better map and recognize human faces for the benefit of Facebook’s commercial endeavors—
and to the detriment of users’ and non-users’ personal safety and security. Each time a user
confirmed or changed a suggested tag, Facebook’s algorithms learned to “see” a little bit better
and a little bit more.
57. Facebook began rolling out Tag Suggestions across the United States beginning in
December 2010.
58. Facebook, however, was aware at the time that Texas had laws surrounding the
capture and use of biometric data.
59. Initially, therefore, Facebook excluded Texas from its rollout, flagging that Texas
had some extra laws surrounding biometric data.
60. Facebook’s respect for Texas law, however, was short-lived. By June 2011,
Facebook had decided that the benefits of widespread use of its facial-recognition system
outweighed the risk of liability under CUBI, and it secretly forced millions of Texans into its facial-
recognition scheme without their informed consent.
61. Then, in 2015, Facebook opened its Texas data center, where it began capturing,
processing, transmitting, and storing the biometrics of millions of Americans from all across the
country—obtained through its Tag Suggestions feature—all without their informed consent.
62. Facebook thereby targeted Texans, Texas, and data processed in Texas—in
particular—with its Tag Suggestions feature, despite having the ability to avoid breaching Texas
law.
18
FILED: NEW YORK COUNTY CLERK 01/05/2024 08:19 PM INDEX NO. 161618/2023
NYSCEF DOC. NO. 107 RECEIVED NYSCEF: 01/05/2024
63. As a result, for the next ten years, tens of millions of users who appeared in media
uploaded to Facebook unsuspectingly had records of their facial geometry captured by Facebook
in Texas.
64. While Tag Suggestions initially captured records of face geometry only from
photographs, its capabilities evolved, and it eventually captured such records from videos, as well.
65. Facebook never required users to acknowledge its capture of their records of facial
geometry, much less obtained their informed consent before capturing those records. In fact,
Facebook intentionally avoided using the term “biometric” to describe Tag Suggestions, because
it knew that doing so would “scare people off” from using the service. Facebook’s deception was
calculated and complete.
66. Because of Facebook’s purposeful obfuscation, when users uploaded media onto
the Facebook Platform, they could not—and did not—know the full extent of Facebook’s facial-
recognition scheme or the scope of the uses to which records of face geometry captured from their
uploaded media would be put.
67. And Facebook has never to this day obtained informed consent from non-users to
capture their biometric identifiers, which happened each time a photo or video of their faces was
uploaded to the Facebook Platform.
68. Facebook has acknowledged as much, stating that it believes “it would be
impossible to provide anyone (user or non-user) with prior notice, or obtain his consent, before”
subjecting the person to its facial-recognition process. 24
24
In re Facebook Biometric Info. Privacy Litig., Case No. 3:15-cv-03747-JD, ECF No. 299 at
30:2–4 (N.D. Cal. Mar. 16, 2018).
19
FILED: NEW YORK COUNTY CLERK 01/05/2024 08:19 PM INDEX NO. 161618/2023
NYSCEF DOC. NO. 107 RECEIVED NYSCEF: 01/05/2024
69. On information and belief, Facebook also disclosed to third parties the biometric
identifiers it captured.
70. And Facebook failed to destroy the biometric identifiers it captured within a
reasonable time. When information is wrongfully obtained in the first instance, holding it for any
amount of time is unreasonably long.
71. After facing public backlash over its facial-recognition program, and after facing a
massive lawsuit for these same biometric-capture practices in Illinois (a suit that Facebook
ultimately had to settle for $650,000,000), Facebook announced, in November 2021, that it would
cease use of the face-recognition feature on the Facebook Platform, lamenting that “the
experiences it made possible have been disabled.” 25
72. Facebook has made no such commitment with respect to any of the other platforms
or operations under its corporate umbrella, such as Instagram, WhatsApp, Facebook Reality Labs,
or its upcoming virtual-reality metaverse.
Facebook illegally captures biometrics through Instagram.
73. In 2012, Facebook acquired the photo-sharing site Instagram.
74. Instagram allows users to each create a personal page where they can upload
photographs and videos, participate in live video broadcasts, and communicate and interact with
other Instagram users.
75. Facebook has never informed its Instagram users—or non-users—that it has been
capturing their biometric identifiers. On the contrary, Facebook has maintained that Instagram
does not run its face-recognition technology on Instagram media. The Instagram Data Policy
states, “If we introduce face-recognition technology to your Instagram experience, we will let you
25
Facebook, https://www.facebook.com/help/mobile-touch/187272841323203 (last visited May
13, 2022).
20
FILED: NEW YORK COUNTY CLERK 01/05/2024 08:19 PM INDEX NO. 161618/2023
NYSCEF DOC. NO. 107 RECEIVED NYSCEF: 01/05/2024
know first, and you will have control over whether we use this technology for you.” None of it is
true.
76. Since July 2014, Facebook has been secretly subjecting photos uploaded to
Instagram—which amounted to millions of images per day in 2015—to its facial-recognition
technology, with no way for Instagram users (or non-users) to know about it, let alone prevent
Facebook from harvesting maps of their facial geometry.
77. Facebook has been doing this for its commercial gain, to continue to train and
improve its AI apparatus and to improve Facebook’s Tag Suggestions.
78. Facebook has therefore, in Texas, captured the biometric identifiers of millions of
users, without their informed consent, for a commercial purpose, and failed to destroy them in a
reasonable time—all in violation of CUBI.
In Sum: Facebook exploits Texans’ most sensitive data to create DeepFace.
79. Facebook’s campaign of unlawful biometric capture has led to Facebook’s creating
the largest facial dataset in the world. That dataset is powered by DeepFace, Facebook’s deep-
26
learning facial-recognition system. DeepFace closely approaches human-level accuracy in
identifying faces. And it exists only because—for over a decade—Facebook illegally and
surreptitiously captured the biometric identifiers of tens of millions of Facebook and Instagram
users and non-users.
80. In creating and maintaining this facial dataset, Facebook has also failed to destroy
within a reasonable time the illicitly captured records of facial geometry belonging to users and
non-users.
26
Yaniv Taigman, Ming Yang, Marc’Aurello Ranzato, & Lior Wolf, DeepFace: Closing the Gap
to Human-Level Performance in Face Verification, (Jun. 24, 2014) (Meta Research, Tel
Preview
FILED: NEW YORK COUNTY CLERK 01/05/2024 08:19 PM INDEX NO. 161618/2023 NYSCEF DOC. NO. 107 RECEIVED NYSCEF: 01/05/2024 Exhibit 16 FILED: NEW YORK COUNTY CLERK 01/05/2024 08:19 PM INDEX NO. 161618/2023 NYSCEF DOC. NO. 107 RECEIVED NYSCEF: 01/05/2024 CAUSE NO. 22-0121 THE STATE OF TEXAS § IN THE DISTRICT COURT § § § § Plaintiff, § § v. § § 71ST JUDICIAL DISTRICT Meta Platforms, Inc., § f/k/a Facebook, Inc. § § § § Defendant. § HARRISON COUNTY, TEXAS PLAINTIFF’S FIRST AMENDED PETITION TO THE HONORABLE JUDGE OF SAID COURT: Plaintiff, STATE OF TEXAS, acting by and through the Attorney General of Texas, KEN PAXTON (the “State”), on behalf of the public interest, complains of Defendant META PLATFORMS, INC., also known as “FACEBOOK.” In this action, the State alleges that Facebook unlawfully captured the biometric identifiers of Texans for a commercial purpose without their informed consent, disclosed those identifiers to others, and failed to destroy collected identifiers within a reasonable time, all in violation of the Texas Capture or Use of Biometric Identifier Act, Tex. Bus. & Com. Code § 503.001 (“CUBI”); and that Facebook engaged in false, misleading, and deceptive acts and practices in violation of the Texas Deceptive Trade Practices- Consumer Protection Act (“DTPA”), Tex. Bus. & Com. Code §§ 17.41 et seq. Facebook has, for over a decade, built an Artificial Intelligence empire on the backs of Texans, and millions of Americans, by deceiving them while capturing their most intimate data, thereby putting their well- 1 FILED: NEW YORK COUNTY CLERK 01/05/2024 08:19 PM INDEX NO. 161618/2023 NYSCEF DOC. NO. 107 RECEIVED NYSCEF: 01/05/2024 being, safety, and security at risk. Under Texas law, the Attorney General has the exclusive authority to vindicate rights under CUBI, and he, therefore, brings this Petition before the Court. In support hereof, General Paxton, acting for the State, will respectfully show the Court the following. INTRODUCTION Defendant Meta Platforms, Inc., better known as “Facebook,” was founded in 2004. The ostensible premise behind Facebook’s eponymous social-media platform (the “Facebook Platform”) was as simple as it was appealing: With only a few keystrokes, users could connect with friends and family, and share photographs, milestones, and other life updates in their community of “Facebook friends.” The Facebook Platform was an instant hit, and within months, “Facebook” became synonymous with social media. Since 2008, the Facebook Platform has been the largest interactive social-media platform in the world, growing to include photo sharing, video sharing, shopping, playing games, creating fandoms, instant messaging, video conferencing, and event organizing, all on a single website. In 2011, approximately 12 million Texans had a Facebook account; by 2021, that number had ballooned to an estimated 20.5 million Texans. The popularity of its brand has made Facebook one of the most valuable companies in the world, with one of the top ten market capitalizations in the world, and revenue of over $85 billion last year. But Facebook’s omnipresent empire was built on deception, lies, and brazen abuses of Texans’ privacy rights—all for Facebook’s own commercial gain. Of relevance here, for over a decade, while holding itself out as a trusted meeting place for Texans to connect and share special moments with family and friends, Facebook was secretly capturing, disclosing, unlawfully retaining—and profiting off of—Texans’ most personal and highly sensitive information: records of their facial geometries, which Texas law refers to as biometric identifiers. 2 FILED: NEW YORK COUNTY CLERK 01/05/2024 08:19 PM INDEX NO. 161618/2023 NYSCEF DOC. NO. 107 RECEIVED NYSCEF: 01/05/2024 Facebook deceived the public by concealing the nature of its practices. Facebook knew that the term “biometric data” “tends to scare people off.” See Pls.’ Opp’n to Facebook, Inc.’s Mot. for Summ J. at 6, In re Facebook Biometric Information Privacy Litigation, No. 3:15-cv-03747- JD (N.D. Cal. 2018), ECF No. 341. And so it neither used the term “biometric data” nor otherwise informed users of its practices. Texans who used Facebook’s social-media services were oblivious to the fact that Facebook—without their permission—was capturing biometric information from photos and videos that users had uploaded for the sole purpose of sharing with family and friends. Also unbeknownst to users, Facebook was disclosing users’ personal information to other entities who further exploited it. Moreover, Facebook failed to destroy the collected biometric identifiers within a reasonable time, exposing Texans to ever-increasing risks to their well-being, safety, and security. When information is wrongfully obtained to begin with, holding it for any amount of time is unreasonably long. Facebook’s illegal and deceptive conduct did not end with its users. For Texans who did not use Facebook’s social-media services, Facebook was still capturing hundreds of millions of biometric identifiers from photos and videos innocently uploaded by friends and family who did use Facebook’s services. There was no way for such non-users to know of or contest this exploitation. Facebook knowingly captured biometric information for its own commercial benefit, to train and improve its facial-recognition technology, and thereby create a powerful artificial intelligence (“AI”) apparatus that reaches all corners of the world and ensnares even those who have intentionally avoided using Facebook services. 3 FILED: NEW YORK COUNTY CLERK 01/05/2024 08:19 PM INDEX NO. 161618/2023 NYSCEF DOC. NO. 107 RECEIVED NYSCEF: 01/05/2024 The scope of Facebook’s misconduct is staggering. Facebook repeatedly captured Texans’ biometric identifiers without consent not hundreds, or thousands, or millions of times—but billions of times, all in violation of CUBI and the DTPA. After paying $650 million for engaging in this same conduct in Illinois, being called out by whistleblowers who exposed Facebook’s indifference to the societal harms it caused, and paying billions of dollars in fines to the Federal Trade Commission, Facebook finally claimed to have ceased its invasive and unlawful facial-recognition practices in late 2021. By that point, however, it had spent more than a decade secretly exploiting Texans and their personal information to perfect its AI apparatus. There can be no free pass for Facebook’s unlawfully invading the privacy rights of tens of millions of Texas residents by misappropriating their data and putting one of their most personal and valuable possessions—records of their facial geometry—at risk from hackers and bad actors, all to build an AI-powered virtual-reality empire. The State brings this suit to hold Facebook accountable for covertly flouting Texas law for more than a decade, and to stop Facebook from ever again violating the rights of Texans for its commercial gain. DISCOVERY CONTROL PLAN 1. The discovery in this case is intended to be conducted under Level 3 pursuant to Texas Rule of Civil Procedure 190.4. This case is not subject to the restrictions of expedited discovery under Texas Rule of Civil Procedure 169 because the State’s claims include a claim for non-monetary injunctive relief and claims for monetary relief, including penalties and attorneys’ fees and costs, in excess of $250,000, and the claims are within the jurisdictional limits of the Court. 4 FILED: NEW YORK COUNTY CLERK 01/05/2024 08:19 PM INDEX NO. 161618/2023 NYSCEF DOC. NO. 107 RECEIVED NYSCEF: 01/05/2024 THE DEFENDANT 2. Meta Platforms, Inc. (“Facebook”) is a Delaware corporation with its headquarters and principal place of business at 1601 Willow Road, Menlo Park, California. Facebook is registered to do business in Texas and enters into contracts in Texas to provide access to its social-media platforms. The number of Facebook’s Texas users is likely in the tens of millions. 3. Since 2011, Facebook has maintained a continuous presence in Texas, where it currently employs approximately 2,000 employees. 1 As of 2020, Facebook had several hundred employees in Texas whom it described as “management-level.” As of April 2022, Facebook was actively recruiting for over 230 open employment positions in Texas. 4. Facebook has specifically and purposefully advertised its services in Texas. 5. Facebook maintains a general business office in Texas, leasing over 1 million square feet of office space in Austin, including all of the office space—33 floors—in the tallest tower in the State’s capital. 2 And it is reportedly looking to expand its presence. 3 6. In 2018, Facebook described Austin as its “second home,” and noted its intent to “commit to the Austin community for the long haul.” 4 1 See Bridget Spencer, Facebook parent company Meta to expand in Austin, leading high rise, Fox News 7 Austin (Jan. 11, 2022) https://www.fox7austin.com/news/facebook-parent-company- meta-to-expand-in-austin-leasing-high-rise. 2 Meta goes mega on Texas office space, The Real Deal, (Jan. 10, 2022) https://therealdeal.com/2022/01/10/meta-goes-mega-on-texas-office-space/. 3 Kathryn Hardison, Sources: Facebook wants 1M more square feet downtown, Austin Business Journal (Dec. 4, 2020), https://www.bizjournals.com/austin/news/2020/12/04/facebook-could-be- expanding-again-in-austin.html. 4 Facebook Brings New Digital Marketing Certificate Program to Austin Community College, Meta Newsroom (Sept. 24, 2018), https://about.fb.com/news/2018/09/facebook-brings-new- digital-marketing-certificate-program-to-austin-community-college/. 5 FILED: NEW YORK COUNTY CLERK 01/05/2024 08:19 PM INDEX NO. 161618/2023 NYSCEF DOC. NO. 107 RECEIVED NYSCEF: 01/05/2024 7. On information and belief, Facebook pays substantial amounts of taxes to Texas taxing authorities. 8. On information and belief, Facebook’s Texas offices are the central location for all activities relating to Facebook’s employee relations nationwide. 9. On information and belief, Facebook maintains accounts at its Texas offices, where it has account managers. Facebook also has agents for service of process in the State. 10. Since 2015, Facebook has operated a large data center in Fort Worth, one of only four “cold storage” facilities that Facebook operates worldwide. 5 Facebook’s Fort Worth server farm covers more than 2.5 million square feet of space, over multiple buildings, on a 170-acre site. 6 11. When Facebook opened its Fort Worth data center, Facebook executive Matt VanderZanden explained that “these buildings — and the hardware inside them—support our mission to give people the power to build community and bring the world closer together. . . . They also help us accommodate the growing number of photos and videos being shared and scale as we create more immersive experiences through live video, 360 photos, and videos, and virtual and augmented reality.” 7 5 Graeme Burton, Facebook starts work on final phase of $1.5bn Fort Worth data center campus, DCD (Dec. 10, 2020), https://www.datacenterdynamics.com/en/news/facebook-starts-work-final- phase-15bn-fort-worth-data-center-campus/. 6 Facebook Fort Worth Data Center, DPR Construction, https://www.dpr.com/projects/facebook- fort-worth-data-center (last visited May 13, 2022). 7 David Kirkpatrick, Efficiency, Sustainability Drive Massive Facebook Fort Worth Data Center, Dallas Innovates (Oct. 19, 2018), https://dallasinnovates.com/efficiency-sustainability-drive- massive-facebook-fort-worth-data-center/ (emphasis added). 6 FILED: NEW YORK COUNTY CLERK 01/05/2024 08:19 PM INDEX NO. 161618/2023 NYSCEF DOC. NO. 107 RECEIVED NYSCEF: 01/05/2024 12. Facebook has described the Fort Worth data center as “one of the cornerstones of the global infrastructure that brings Facebook apps and services to you every day.” 8 13. In 2022, Facebook will break ground on a second Texas-based data center in Temple (north of Austin), enjoying a 75-percent property-tax break for the first ten years, offered by Temple to induce Facebook to bring its business to town. 9 14. Facebook’s activities in Texas have been wildly profitable, and the company has earned billions of dollars from the use of its platforms in Texas. JURISDICTION AND VENUE 15. This enforcement action is brought by Attorney General of Texas Ken Paxton, through his Consumer Protection Division (CPD), in the name of the State and in the public interest, under the authority granted to him by section 503.001(d) of CUBI, on the ground that Facebook has (1) captured the biometric identifiers of individuals without their informed consent, as defined in, and declared unlawful by, section 503.001(b) of CUBI; (2) disclosed the biometric identifiers to other entities, as declared unlawful by section 503.001(c)(1) of CUBI; and (3) failed to destroy within a reasonable time the biometric identifiers it has collected, as declared unlawful by section 503.001(c)(3) of CUBI. General Paxton also brings this enforcement action pursuant to the authority granted to him by section 17.47 of the DTPA, on the ground that Facebook has engaged in false, deceptive, and misleading acts and practices in the course of trade and commerce, as defined in, and declared unlawful by, sections 17.46 (a) and (b) of the DTPA. In enforcement 8 The Newest Addition to the Facebook Data Center Fleet: Fort Worth, Meta Newsroom (July 7, 2015), https://about.fb.com/news/2015/07/the-newest-addition-to-the-facebook-data-center-fleet- fort-worth/. 9 $800 million data center for Facebook parent company Meta to open in Temple, KCEN TV, https://www.kcentv.com/article/news/local/facebook-parent-company-meta-to-open-data-center- in-temple/500-7943fc64-b735-4b0b-8a91-5b7abffbbf30 7 FILED: NEW YORK COUNTY CLERK 01/05/2024 08:19 PM INDEX NO. 161618/2023 NYSCEF DOC. NO. 107 RECEIVED NYSCEF: 01/05/2024 suits filed pursuant to section 503.001(d) of CUBI and section 17.47 of the DTPA, the Attorney General is authorized to seek civil penalties, redress for consumers, and equitable relief. 16. Venue of this suit is proper in Harrison County under section 17.47(b) of the DTPA because Facebook has done business in Harrison County, including but not limited to contracting with businesses and individuals in Harrison County, and under section 15.002(a)(1) of the Texas Civil Practices and Remedies Code because a substantial part of the events and omissions giving rise to the claims in this Petition occurred in Harrison County, including but not limited to individuals’ uploading media to Facebook platforms in Harrison County. PUBLIC INTEREST 17. The State of Texas has reason to believe that Facebook has engaged in, and will continue to engage in, the unlawful practices set forth below; that Facebook has, by means of these unlawful acts and practices, caused damage to and acquired money or property (including biometric identifiers) from persons; and that Facebook adversely affected the lawful conduct of trade and commerce, thereby directly and indirectly affecting the people of the State of Texas. Therefore, the Consumer Protection Division of the Office of the Attorney General of the State of Texas believes and is of the opinion that these proceedings are in the public interest. TRADE AND COMMERCE 18. Facebook has, at all times described below, engaged in conduct that constitutes “trade” and “commerce,” as those terms are defined in section 17.45(6) of the DTPA. CONDITIONS PRECEDENT 19. All conditions precedent to the State’s claim for relief have been performed or have occurred. The Consumer Protection Division informed Defendant, in general, of the alleged 8 FILED: NEW YORK COUNTY CLERK 01/05/2024 08:19 PM INDEX NO. 161618/2023 NYSCEF DOC. NO. 107 RECEIVED NYSCEF: 01/05/2024 unlawful conduct described below at least seven days before filing suit, as may be required by subsection 17.47(a) of the DTPA. ACTS OF AGENTS 20. Whenever in this Petition it is alleged that Facebook did any act, it is meant that Facebook performed or participated in the act, or that its officers, agents, or employees performed or participated in the act on behalf of and under the authority of Facebook. BACKGROUND Biometrics are used for everything from the benign unlocking of phones to criminal targeting and religious persecution. 21. “Biometrics” refer to physical characteristics that are unique to each individual. The most well-known example is the fingerprint. 22. Over the past two decades, the use of other biometrics has become increasingly common. Such biometric identifiers include retina or iris scans, records of face geometry, voiceprints, and the lay of blood vessels beneath an individual’s skin. These biometric identifiers were once difficult to capture without a live person, but Silicon Valley has been hard at work to enable machines to create biometric profiles without a live subject and without a human operator. 23. Today, one of the most prevalent uses of biometric identifiers by Big Tech is facial- recognition technology. This technology captures biometric identifiers by transforming a facial image—portrayed in photographs or videos—into an electronic map of the face. 24. When facial-recognition technology examines an image of a face, it extracts data from facial features and generates a face map through the use of facial-recognition algorithms. It can then compare the captured face map to other face maps it has stored in databases to see if there is a match. 9 FILED: NEW YORK COUNTY CLERK 01/05/2024 08:19 PM INDEX NO. 161618/2023 NYSCEF DOC. NO. 107 RECEIVED NYSCEF: 01/05/2024 25. Like a fingerprint, every record of facial geometry is unique, allowing face maps to serve a variety of security, financial, and law-enforcement functions. The more advanced the facial-recognition technology, the better it is at matching two facial images of the same individual. 26. Figure 1, below, shows an example of the data points that are captured by facial- recognition technology in mapping the image of a human face. Figure 1 27. Advancements in computer processing and machine learning have vastly improved facial-recognition technology, generating many commercial applications for it, while rapidly raising alarming privacy concerns about its scale, scope, and secrecy—and about the improper uses it could serve when in the wrong hands. 28. Facial recognition is now used for a variety of day-to-day functions that formerly required passwords, secondary verification, or in-person confirmation of identity. 29. For instance, many cell phones and tablets now offer biometric functionality that allows users to unlock their devices by scanning their facial geometry; face geometry is used by banks to secure access to account information and authorize transactions; and businesses are using facial-recognition systems to control access to secure facilities. 10 FILED: NEW YORK COUNTY CLERK 01/05/2024 08:19 PM INDEX NO. 161618/2023 NYSCEF DOC. NO. 107 RECEIVED NYSCEF: 01/05/2024 30. But the use of biometrics and facial-recognition technology goes far beyond these innocuous examples. 31. Facial-recognition technology is a favorite of stalkers and criminals because, by simply having a photo of their target, they are able to locate that target’s name, social-media account, and other personal information. 10 This technology is also used by retailers to identify potential thieves, but because the technology is not perfect, innocent individuals have been treated as criminals—which is particularly pernicious given that the technology is at its worst when purporting to identify minorities. 11 And governments have used this technology to suppress their constituents; the Communist Party of China, for example, has used its facial-recognition dragnet to surveil and persecute the ethnic Uyghur minority, 12 and to target Christians by deploying its technology in churches. 13 32. The creation and maintenance of sprawling databases containing millions of people’s biometrics generates an enormous risk that cyber criminals and other dangerous actors will access these unique identifiers and encroach into virtually every aspect of their owners’ lives. The risk is particularly treacherous when those people have no knowledge of—or authority over— the capture and use of their biometrics. 10 Drew Harwell, This facial recognition website can turn anyone into a cop – or a stalker, The Wash. Post, (May 14, 2021), https://www.washingtonpost.com/technology/2021/05/14/pimeyes- facial-recognition-search-secrecy/. 11 Kashmir Hill, Another Arrest, and Jail Time, Due to a Bad Facial Recognition Match, N.Y. Times, (Dec 19, 2020), https://www.nytimes.com/2020/12/29/technology/facial-recognition- misidentify-jail.html. 12 Chris Buckley and Paul Mozer, How China Uses High-Tech Surveillance to Subdue Minorities, N.Y. Times, (May 22, 2019), https://www.nytimes.com/2019/05/22/world/asia/china- surveillance-xinjiang.html. 13 Chris Meserole, Technological surveillance of religion in China, Brookings, (July 22, 2020), https://www.brookings.edu/testimonies/technological-surveillance-of-religion-in-china/. 11 FILED: NEW YORK COUNTY CLERK 01/05/2024 08:19 PM INDEX NO. 161618/2023 NYSCEF DOC. NO. 107 RECEIVED NYSCEF: 01/05/2024 33. Unlike other identifiers, such as Social Security numbers, which can be changed when stolen or misappropriated, biometric identifiers are permanent. Once a biometric identifier is captured, a bad actor can access and exploit the identifier for the rest of the victim’s life. These unique and permanent biometric identifiers, once exposed, leave victims with no means to prevent identity theft, unauthorized tracking and targeting, or other threats to privacy, safety, and security. Texas implements CUBI to protect Texans from danger. 34. Foreseeing the dangers that the capture of biometrics posed for Texans—dangers that have become only more severe as facial-technology has improved dramatically—the Texas Legislature enacted a law in 2001 to regulate the commercial capture of biometric identifiers. That law was recodified in 2009 as CUBI. To protect Texans from abuse, the Legislature chose to impose a requirement that is commonplace in the law: obtain informed consent. 35. Specifically, under CUBI, “A person may not capture a biometric identifier of an individual for a commercial purpose unless the person first: (i) informs the individual before capturing the biometric identifier; and (ii) receives the individual’s consent to capture the biometric identifier.” 14 36. Moreover, an entity in possession of a biometric identifier may not disclose it to anybody else for any purpose (with the exception of limited, enumerated purposes, such as law enforcement). 15 37. If an entity comes into possession of a biometric identifier, the entity must destroy it within a reasonable time, but no later than one year after the purpose for collecting the identifier expires. 16 14 Tex. Bus. & Comm. Code § 503.001(b). 15 Tex. Bus. & Comm. Code § 503.001(c)(1). 16 Subject to limited exceptions. See Tex. Bus. & Comm. Code § 503.001(c)(3). 12 FILED: NEW YORK COUNTY CLERK 01/05/2024 08:19 PM INDEX NO. 161618/2023 NYSCEF DOC. NO. 107 RECEIVED NYSCEF: 01/05/2024 38. And the entity possessing a biometric identifier must store it, transmit it, and protect it from disclosure using reasonable care, in a way that is at least as protective as the way it stores, transmits, and protects other confidential information. 39. These prohibitions and protections are not only reasonable, but necessary in light of the risks inherent in allowing a Big Tech firm to access Texans’ most sensitive and immutable personal information. 40. CUBI defines a biometric identifier as “a retina or iris scan, fingerprint, voiceprint, or record of hand or face geometry.” 17 Facebook routinely violates its users’ privacy rights. 41. Silicon Valley firms like Facebook are not safe guardians of this highly sensitive information. On the contrary, such firms have been caught acting recklessly with others’ private information on myriad occasions. For example, in 2011, Facebook entered into a settlement agreement with the FTC after the FTC caught the company engaging in widespread violations of users’ privacy. The FTC allegations included: (a) that, in December 2009, Facebook changed its website so that certain information users had specifically designated as private was made public— with no warning to users and no opportunity for them to withhold consent; (b) that Facebook gave third-party apps access to nearly all of users’ personal data, despite representing to users that the apps would have access only to the information they needed to operate; (c) that Facebook shared users’ personal information with advertisers—after promising users it would not do so; and (d) that Facebook continued to allow access to the photos of users who had deleted their accounts, despite telling users that their photos would become inaccessible. 17 Tex. Bus. & Comm. Code § 503.001(a) 13 FILED: NEW YORK COUNTY CLERK 01/05/2024 08:19 PM INDEX NO. 161618/2023 NYSCEF DOC. NO. 107 RECEIVED NYSCEF: 01/05/2024 42. Further, in Europe, Facebook was involved in litigation from 2015 to 2021 over its practice of gathering the personal information of users and non-users for advertising purposes without first obtaining their consent. 43. And in 2019, Facebook was fined $5 billion by the FTC for an array of privacy violations. 44. These examples illustrate Facebook’s pattern of betraying users—promising privacy while secretly disclosing personal information to third parties for its commercial gain, and failing to remove users’ personal information even after they have left Facebook. 45. We now know that, consistent with its track record, Facebook has done it again, this time secretly and recklessly disregarding the privacy of its users—and of any children, family members, or friends pictured in the users’ uploaded images and videos—to capture maps of their faces. It has thereby created one of the world’s largest databases of human face maps. Facebook has committed this abuse and placed these individuals in danger all in order to train its AI apparatus in facial recognition—and all in violation of CUBI and the DTPA. 46. For over a decade, Facebook has brazenly violated CUBI and the DTPA. Facebook did not inform Texans that it was capturing their private biometric identifiers as part of its widespread facial-recognition program, let alone obtain their consent; it then disclosed those biometric identifiers to other entities; and it failed to delete its collected biometric identifiers within a reasonable time, compounding the risk of harm for tens of millions of Texans. SPECIFIC FACTUAL ALLEGATIONS 47. The Facebook Platform allows users to upload and share photographs and videos with friends and relatives. Once a user uploads a photograph or video on the Facebook Platform, the user can “tag” (i.e., identify by name) other Facebook Platform users and non-users who appear in the photograph or video. 14 FILED: NEW YORK COUNTY CLERK 01/05/2024 08:19 PM INDEX NO. 161618/2023 NYSCEF DOC. NO. 107 RECEIVED NYSCEF: 01/05/2024 48. Tagging has been pivotal to the explosive expansion of the Facebook empire. As articulated by Ezra Callahan, an early Facebook employee, “[t]he single greatest growth mechanism ever [for Facebook] was photo tagging. It shaped all of the rest of the product decisions that got made.” 18 49. Facebook’s founder and CEO Mark Zuckerberg has similarly commented that, “the coolest thing about [Facebook Platform] photos is that you can tag them . . . in the way that makes them linked to people’s profiles.” 19 He has also stated that photo tagging is “more important than every other [Facebook Platform] feature put together,” and that “very quickly” Facebook’s “photo product became the most used photos product on the web.” 20 Other Facebook executives have similarly described photo-tagging as a “core piece of functionality” that made the Facebook Platform the “biggest photo product on the web.” 21 And its Vice President of Product Design stated: One of the stories we used to tell in the early days of Facebook was how a small, two-engineer project came to dominate the entire photo sharing landscape in the late 2000s. . . . There were no bells and whistles, save one... The one feature Facebook Photos *did* have, even in its earliest incarnation, was this: photo tagging. . . . What a simple feature. And yet. It made all the difference. Facebook Photos skyrocketed in popularity. Within a few years, it was the most popular photo sharing service on the Internet. 22 18 Adam Fisher, Valley of Genius: The Uncensored History of Silicon Valley (As Told by the Hackers, Founders, and Freaks Who Made It Boom) 365 (2018). 19 Guest Lecture by Mark Zuckerberg, Harvard University at 25:44-57, YouTube (Dec. 7, 2005), available at https://www.youtube.com/watch?v=_YpaWA_-XRw. 20 A Conversation with Mark Zuckerberg, Web 2.0 Summit 2010 at 19:15-22, YouTube, (Nov. 19, 2010), available at https://www.youtube.com/watch?v=CRUOl03nZIc. 21 Kim-Mai Cutler, Q&A: Facebook’s Bret Taylor on privacy, the transition from FriendFeed, VentureBeat (May 28, 2010), available at https://venturebeat.com/2010/05/28/bret-taylor- facebook. 22 See Julie Zhou, Twitter (Apr. 8, 2021), available at https://twitter.com/joulee/status/1380183017025511430. 15 FILED: NEW YORK COUNTY CLERK 01/05/2024 08:19 PM INDEX NO. 161618/2023 NYSCEF DOC. NO. 107 RECEIVED NYSCEF: 01/05/2024 Facebook launches Tag Suggestions. 50. To boost use of the tagging feature, Facebook announced a program in 2010 called “Tag Suggestions.” 23 51. Tag Suggestions worked by using Facebook’s proprietary facial-recognition process to capture and analyze the records of facial geometry—of both users and non-users— obtained from user-uploaded photos and videos. One part of the facial-recognition process is shown in Figure 2, below: Figure 2 52. Tag Suggestions would then use the captured records of face geometry to compare the faces in the photo or video to the faces of individuals in its database. 53. If Tag Suggestions recognized and identified one of the faces appearing in the photograph, Facebook would suggest to the user the individual’s name, so that the user could tag the individual. 23 This feature was later upgraded to be called simply “Face Recognition.” 16 FILED: NEW YORK COUNTY CLERK 01/05/2024 08:19 PM INDEX NO. 161618/2023 NYSCEF DOC. NO. 107 RECEIVED NYSCEF: 01/05/2024 54. Figure 3, below, shows an example of what Tag Suggestions looked like to a Facebook Platform user: Figure 3 55. As shown, users could accept a tag suggestion from Facebook or enter in a name for each pictured individual. By entering the name of the person in a photograph once, users were unwittingly giving Facebook’s facial-recognition algorithm a baseline against which to compare every other photo ever uploaded on the Facebook Platform, for Facebook to see if there was a facial-map match. 56. While touting Tag Suggestions as a means to improve user experience, Facebook never disclosed that Tag Suggestions was capturing facial geometry from photographs and continuously training its AI. Little did users know that when they answered the simple question 17 FILED: NEW YORK COUNTY CLERK 01/05/2024 08:19 PM INDEX NO. 161618/2023 NYSCEF DOC. NO. 107 RECEIVED NYSCEF: 01/05/2024 of who was in a photograph, they were helping to teach Facebook’s facial-recognition technology to better map and recognize human faces for the benefit of Facebook’s commercial endeavors— and to the detriment of users’ and non-users’ personal safety and security. Each time a user confirmed or changed a suggested tag, Facebook’s algorithms learned to “see” a little bit better and a little bit more. 57. Facebook began rolling out Tag Suggestions across the United States beginning in December 2010. 58. Facebook, however, was aware at the time that Texas had laws surrounding the capture and use of biometric data. 59. Initially, therefore, Facebook excluded Texas from its rollout, flagging that Texas had some extra laws surrounding biometric data. 60. Facebook’s respect for Texas law, however, was short-lived. By June 2011, Facebook had decided that the benefits of widespread use of its facial-recognition system outweighed the risk of liability under CUBI, and it secretly forced millions of Texans into its facial- recognition scheme without their informed consent. 61. Then, in 2015, Facebook opened its Texas data center, where it began capturing, processing, transmitting, and storing the biometrics of millions of Americans from all across the country—obtained through its Tag Suggestions feature—all without their informed consent. 62. Facebook thereby targeted Texans, Texas, and data processed in Texas—in particular—with its Tag Suggestions feature, despite having the ability to avoid breaching Texas law. 18 FILED: NEW YORK COUNTY CLERK 01/05/2024 08:19 PM INDEX NO. 161618/2023 NYSCEF DOC. NO. 107 RECEIVED NYSCEF: 01/05/2024 63. As a result, for the next ten years, tens of millions of users who appeared in media uploaded to Facebook unsuspectingly had records of their facial geometry captured by Facebook in Texas. 64. While Tag Suggestions initially captured records of face geometry only from photographs, its capabilities evolved, and it eventually captured such records from videos, as well. 65. Facebook never required users to acknowledge its capture of their records of facial geometry, much less obtained their informed consent before capturing those records. In fact, Facebook intentionally avoided using the term “biometric” to describe Tag Suggestions, because it knew that doing so would “scare people off” from using the service. Facebook’s deception was calculated and complete. 66. Because of Facebook’s purposeful obfuscation, when users uploaded media onto the Facebook Platform, they could not—and did not—know the full extent of Facebook’s facial- recognition scheme or the scope of the uses to which records of face geometry captured from their uploaded media would be put. 67. And Facebook has never to this day obtained informed consent from non-users to capture their biometric identifiers, which happened each time a photo or video of their faces was uploaded to the Facebook Platform. 68. Facebook has acknowledged as much, stating that it believes “it would be impossible to provide anyone (user or non-user) with prior notice, or obtain his consent, before” subjecting the person to its facial-recognition process. 24 24 In re Facebook Biometric Info. Privacy Litig., Case No. 3:15-cv-03747-JD, ECF No. 299 at 30:2–4 (N.D. Cal. Mar. 16, 2018). 19 FILED: NEW YORK COUNTY CLERK 01/05/2024 08:19 PM INDEX NO. 161618/2023 NYSCEF DOC. NO. 107 RECEIVED NYSCEF: 01/05/2024 69. On information and belief, Facebook also disclosed to third parties the biometric identifiers it captured. 70. And Facebook failed to destroy the biometric identifiers it captured within a reasonable time. When information is wrongfully obtained in the first instance, holding it for any amount of time is unreasonably long. 71. After facing public backlash over its facial-recognition program, and after facing a massive lawsuit for these same biometric-capture practices in Illinois (a suit that Facebook ultimately had to settle for $650,000,000), Facebook announced, in November 2021, that it would cease use of the face-recognition feature on the Facebook Platform, lamenting that “the experiences it made possible have been disabled.” 25 72. Facebook has made no such commitment with respect to any of the other platforms or operations under its corporate umbrella, such as Instagram, WhatsApp, Facebook Reality Labs, or its upcoming virtual-reality metaverse. Facebook illegally captures biometrics through Instagram. 73. In 2012, Facebook acquired the photo-sharing site Instagram. 74. Instagram allows users to each create a personal page where they can upload photographs and videos, participate in live video broadcasts, and communicate and interact with other Instagram users. 75. Facebook has never informed its Instagram users—or non-users—that it has been capturing their biometric identifiers. On the contrary, Facebook has maintained that Instagram does not run its face-recognition technology on Instagram media. The Instagram Data Policy states, “If we introduce face-recognition technology to your Instagram experience, we will let you 25 Facebook, https://www.facebook.com/help/mobile-touch/187272841323203 (last visited May 13, 2022). 20 FILED: NEW YORK COUNTY CLERK 01/05/2024 08:19 PM INDEX NO. 161618/2023 NYSCEF DOC. NO. 107 RECEIVED NYSCEF: 01/05/2024 know first, and you will have control over whether we use this technology for you.” None of it is true. 76. Since July 2014, Facebook has been secretly subjecting photos uploaded to Instagram—which amounted to millions of images per day in 2015—to its facial-recognition technology, with no way for Instagram users (or non-users) to know about it, let alone prevent Facebook from harvesting maps of their facial geometry. 77. Facebook has been doing this for its commercial gain, to continue to train and improve its AI apparatus and to improve Facebook’s Tag Suggestions. 78. Facebook has therefore, in Texas, captured the biometric identifiers of millions of users, without their informed consent, for a commercial purpose, and failed to destroy them in a reasonable time—all in violation of CUBI. In Sum: Facebook exploits Texans’ most sensitive data to create DeepFace. 79. Facebook’s campaign of unlawful biometric capture has led to Facebook’s creating the largest facial dataset in the world. That dataset is powered by DeepFace, Facebook’s deep- 26 learning facial-recognition system. DeepFace closely approaches human-level accuracy in identifying faces. And it exists only because—for over a decade—Facebook illegally and surreptitiously captured the biometric identifiers of tens of millions of Facebook and Instagram users and non-users. 80. In creating and maintaining this facial dataset, Facebook has also failed to destroy within a reasonable time the illicitly captured records of facial geometry belonging to users and non-users. 26 Yaniv Taigman, Ming Yang, Marc’Aurello Ranzato, & Lior Wolf, DeepFace: Closing the Gap to Human-Level Performance in Face Verification, (Jun. 24, 2014) (Meta Research, Tel