Facebook will have to front up to a class action lawsuit against its use of facial recognition technology that could involve up to 7 million users after the social media giant lost a Federal Court appeal in the US.

A number of Facebook users accused Facebook of violating Illinois' 2008 Biometric Information Privacy Act in its collection of biometric data through the “tag suggestions” feature, and a class action lawsuit was launched in 2015.

Facebook had attempted to knock down the lawsuit in the US Federal Appeals Court, but the 9th US Circuit Court of Appeals in San Francisco decided unanimously to allow the case to go ahead, opening the tech titan up to potentially billions of dollars in damages.

The case centres on a feature introduced in 2011 by Facebook which uses facial recognition technology to allow users to recognise their Facebook friends from previously uploaded photos. The tag suggestions technology analyses the details of the peoples’ faces, such as the distance between their eyes, their noses and other features.

Facebook keeps a database of the face templates it collects through this feature, but users can choose to opt out of it.

The law in question in Illinois aims to protect an individuals’ “concrete interests in privacy”, and the judges at the appeals court ruled that the Facebook feature could violate this.

“The panel concluded that the development of a face template using facial recognition technology without consent invades an individual’s private affairs and concrete interests,” the ruling said.

The lawyer for the plaintiffs said that biometric data is the most personal information that an individual can possess.

“This biometric data is so sensitive that if it is compromised, there is simply no recourse,” the lawyer said. “It’s not like a Social Security card or credit card number where you can change the number. You can’t change your face.”

Under the Illinois law, Facebook could be up for damages of up to $1,000 for each negligent violation and up to $5,000 for each intentional or reckless violation, with estimates that up to 7 million Facebook users could potentially be involved with the class action.

According to the Americal Civil Liberties Union, this is the first time a US appellate court has made a decision directly addressing the privacy issues that facial recognition technology presents.

“This decision is a strong recognition of the dangers of unfettered use of face surveillance technology,” ACLU speech, privacy and technology project attorney Nathan Freed Wessler said.

“The capability to instantaneously identify and track people based on their faces raises chilling potential for privacy violations at an unprecedented scale.”

Facebook had tried to argue that the users had not experienced any “concrete harm”, but the appeals judges said that intangible injuries can still be concrete, and that new technologies have opened up more possibilities for privacy breaches.

Facebook is likely to appeal the court’s decision.

“We have always disclosed our use of face recognition technology and that people can turn it on or off at any time,” a Facebook spokesperson said.