More than 100 million people are impacted by company’s plan to sell their photos for generative AI and facial recognition, without customers’ consent or compensation, new class action lawsuit contends.
DENVER – When Photobucket launched in 2003—as an online photo storage service for users of MySpace—biometric facial recognition and artificial intelligence were the stuff of science fiction. Now, twenty years later, biometrics and AI are thriving technologies, while the photo storage industry is antiquated. Still, Photobucket amassed a cache of over 13 billion photos, and these hold the exact sorts of data that tech companies need to power their new products. So Photobucket is planning to sell these photos to the AI companies, even though its users never consented to give their images and biometric data to AI, and such uses of their photos will put them at risk of privacy violations like facial recognition in public.
This is the setting for a new class action lawsuit filed in federal court by the civil rights law firm of Loevy & Loevy. The plaintiffs include a mother whose minor child appears in the photos, and a professional photographer who entrusted his works to Photobucket. The suit seeks class action status for potentially millions of Photobucket users.
At its height, Photobucket—once the default photo sharing site of platforms such as MySpace and Twitter—boasted 100 million registered users, who entrusted the company with storing upwards of 13 billion images. As the company’s popularity waned over the last 15 years, however, Photobucket struggled to find new revenues. By 2024, the vast majority of Photobucket users had not accessed their accounts in years.
And so—today’s lawsuit contends—the company sought a new way to monetize the users’ vast library of images: by licensing the photos to third-parties to build artificial intelligence and biometric identification products. The missing piece, however, was consent. The users had not agreed to let Photobucket use their photos for AI or biometrics, nor had the millions of friends and family who appear in photos the customers uploaded.
According to the suit, Photobucket began a campaign of fraud and coercion, sending its users seemingly innocuous emails, asking whether they wanted to keep or delete their accounts. In reality, however—whichever option they chose—users were taken to a page where, if they wanted to access their images, they were forced to accept new terms that allowed Photobucket to license the photos for biometric data. Even more troublingly, Photobucket claimed that any registered user who ignored the emails would automatically be “opted in” to the biometric consent after 45 days.
These misleading practices, the lawsuit contends, knowingly violate the contractual rights of the users, as well as explicit privacy protections of state laws that safeguard biometric information, such as Illinois’ Biometric Information Privacy Act (BIPA).
“Biometric data is extremely private and sensitive. It can be abused by government officials—like how China uses facial recognition to spy on minorities and political dissidents—and by unscrupulous private companies and fraudsters that can misuse the intimate data to manipulate consumers,” explains Mike Kanovitz, partner at Loevy + Loevy. “Photobucket’s customers deserve control over how their data gets used, and by whom. And, if there is money to be made from people’s data, the people absolutely should share in the profits.”
One of the representative plaintiffs in this case, Mac Pierce, became a registered user of Photobucket more than a decade ago, when he was still a minor with a MySpace page. To the best of his recollection, Mr. Pierce had not logged into his Photobucket account in roughly 10 years before he began getting emails from the company in 2024 asking him to “reactivate,” “unlock,” or “delete” his account. In November, Mr. Pierce was informed by email that Photobucket may already have sold his data, including his biometrics, “for the express purposes of artificial intelligence and machine learning training.” The company also told him it could not retrieve any data that it had already shared.
“Once Photobucket releases your data to the AI companies, you can’t get your privacy back, ever,” Kanovitz explains. “Mr. Pierce never agreed to have his facial image marketed for any purpose, much less to identify him with facial recognition or be used by generative AI to create drawings and videos. And Mr. Pierce is one of probably millions of people whose identities are being threatened so that Photobucket can profit in this way.”
The lawsuit seeks to prohibit Photobucket from misusing the billions of photographs entrusted to its library, and appropriate damages to compensate those whose rights have been violated by the company’s actions.
The plaintiffs in the lawsuit are represented by attorneys Mike Kanovitz, Jon Loevy, Dan Twetten, Tom Hanson, Aaron Tucek, and Isaac Green of Loevy & Loevy. In October 2022, Messrs Loevy and Kanovitz won Richard Rogers, et al. v. BNSF Railway Company (Case #19 C 3083), a biometric privacy trial with a historic jury verdict of $233 million.
###
For a copy of the complaint in this lawsuit, Case No. 1:24-cv-03432, click here.
Contact
Mike Kanovitz, Partner, 312.498.8318, mike@loevy.com
Michael McDunnah, Director of Communications, 312.371.5871, mcdunnah@loevy.com
