Industry News
Facing the Facts About Facial Recognition
An FTC case against photo app Everalbum shows how facial recognition can be deployed without real consent. Here is what the final order requires, what Texas's biometric privacy law demands of businesses, and the lessons for anyone handling biometric data.
Facial recognition technology has become embedded in consumer products in ways that many users do not fully understand. A Federal Trade Commission enforcement action against photo storage company Everalbum illustrates how this technology can be deployed without genuine user consent, and Texas law sets its own rules for any business that captures biometric data.
The Everalbum Case
Starting in 2015, Everalbum offered Ever, a photo storage app that let users upload photos and videos to the company's cloud servers. In February 2017, the company launched a "Friends" feature that used face recognition to group users' photos by the people pictured in them.
When the feature launched, Everalbum enabled face recognition by default for all users of the mobile app and did not provide a way to turn it off.
Beginning in May 2018, the company asked users in Texas, Illinois, Washington, and the European Union, all places with laws governing biometric data, whether they wanted face recognition turned on. Users everywhere else did not get that choice until April 2019. Meanwhile, a help article on Everalbum's website said that when face recognition was turned on, users were letting the company know it was okay to use it. According to the FTC complaint, that description was misleading for users outside those four jurisdictions, who could not turn the feature off.
Using Customer Photos to Build Commercial Technology
Separately from the Friends feature, Everalbum used images from Ever users' photos to develop its own face recognition technology. Between September 2017 and August 2019, the company combined millions of facial images extracted from users' photos with images from publicly available datasets.
The resulting technology was used in the Ever app and to build the face recognition services offered to enterprise customers under Everalbum's Paravision brand. The FTC alleged that the company applied face recognition to users' photos, in some cases, without their affirmative express consent.
The Account Deletion Problem
When users chose to deactivate their Ever accounts, the company told them their photos and videos would be deleted.
According to the FTC complaint, this was not accurate. Until at least October 2019, Everalbum retained the photos and videos of deactivated users rather than deleting them as promised.
What the Settlement Required
The FTC announced a proposed settlement in January 2021 and finalized the order in May 2021. The final order requires Everalbum to:
- Delete the photos and videos of Ever users who deactivated their accounts.
- Delete face embeddings derived from the photos of users who did not give their express consent.
- Delete the face recognition models and algorithms it developed using Ever users' photos and videos.
- Obtain express consent before using face recognition on users' photos and videos.
The order also prohibits misrepresentations about how the company collects, uses, discloses, maintains, or deletes personal information.
Texas Has Its Own Biometric Privacy Law
Texas businesses do not need to wait for a federal case to apply these lessons. Texas's Capture or Use of Biometric Identifier Act, found at Texas Business and Commerce Code Section 503.001, covers retina or iris scans, fingerprints, voiceprints, and records of hand or face geometry. Under the statute, a business that captures one of these identifiers for a commercial purpose must:
- Inform the individual before capturing the identifier and receive the individual's consent.
- Not sell, lease, or otherwise disclose the identifier except in limited circumstances, such as completing a financial transaction the individual requested or when a federal or state statute requires or permits it.
- Store, transmit, and protect the identifier using reasonable care, at least as protectively as its other confidential information.
- Destroy the identifier within a reasonable time, and generally no later than one year after the purpose for collecting it expires. For identifiers an employer collects for security purposes, that purpose is presumed to expire when employment ends.
Violations carry a civil penalty of up to $25,000 each, enforced by the Texas Attorney General. Amendments that took effect on January 1, 2026, as part of the Texas Responsible Artificial Intelligence Governance Act, clarify that a person has not consented just because an image of them is publicly available online, unless they posted it themselves. The law is enforced: in 2024, the Texas Attorney General announced a $1.4 billion settlement with Meta over facial recognition features, the first settlement under the act.
For an everyday business, this applies to more than photo apps. Fingerprint or face-scan time clocks, biometric door access, and voice authentication systems can all capture biometric identifiers. Each needs notice, consent, protection, and a destruction schedule.
Broader Lessons for Businesses and Consumers
The Everalbum case carries clear implications for any organization that collects and processes personal data. Privacy promises made to consumers are legally binding commitments, not aspirational statements.
The obligation to honor those promises applies throughout the entire data lifecycle, including at deletion. When a company tells a user their data will be permanently removed, that expectation must be met.
From a consumer perspective, this case is a reminder to review the privacy settings of any app before uploading personal photos or videos. Once Everalbum began asking, about 25% of the roughly 300,000 users who made a choice turned face recognition off.
Regulatory attention to biometric data continues to grow. Texas, Illinois, and Washington have biometric privacy laws, and other jurisdictions place requirements on biometric data through broader privacy laws. Organizations that handle biometric information should treat compliance in this area as a current priority.
Need Help with Data Privacy and Compliance?
Cyber One Solutions works with organizations to build security and privacy programs that meet regulatory requirements and hold up under scrutiny. This article is general information, not legal advice; your attorney can confirm how biometric laws apply to your business. Contact us today to schedule a consultation.