Lawsuit claims Photobucket sold user biometric data illegally

Photobucket faces a class action lawsuit over allegations of selling users’ biometric data to AI companies without proper consent, potentially affecting up to 100 million users and billions of photos stored on the platform since 2003.

Key allegations and scope: The lawsuit targets Photobucket’s recent privacy policy update that revealed plans to sell users’ photos, including biometric data like face and iris scans, to AI training companies.

• Two distinct classes are represented: users who uploaded photos between 2003 and May 2024, and non-users whose images appear in uploaded photos
• The company claimed access to approximately 6.5 billion public images eligible for AI licensing
• Violations could result in fines up to $5,000 per incident, potentially leading to substantial penalties given the volume of affected photos

Privacy law violations: Multiple state privacy laws, particularly in Illinois, New York, and California, require explicit consent for biometric data collection and usage.

• Photobucket allegedly circumvented geolocation requirements by claiming inability to determine users’ locations
• At least one Illinois user’s data has already been confirmed sold for AI training
• The lawsuit seeks to enforce compliance with strict privacy regulations requiring written consent and transparent data usage policies

Deceptive practices: The lawsuit accuses Photobucket of implementing misleading tactics to obtain user consent.

• Users received “innocuous” emails promising data protection but actually seeking consent for new terms
• The company allegedly misled users into believing they needed to accept new biometric policies to access or delete their data
• Photobucket reportedly claimed automatic opt-in after 45 days of email non-response

Business implications: The lawsuit could significantly impact Photobucket’s AI monetization strategy.

• CEO Ted Leonard previously indicated the company was in discussions with multiple potential licensees
• Expected revenue from AI training deals was described as “significant in material margins”
• The legal action also targets unnamed AI companies that purchased the data

Looking ahead: This case highlights the growing tension between legacy photo platforms seeking new revenue streams and evolving privacy regulations protecting biometric data. The outcome could set important precedents for how digital platforms can monetize historical user data in the AI era, particularly concerning biometric information and consent requirements.