In a ruling that could spell trouble for Facebook and other companies that use computers to identify faces, a federal judge said a Chicago man can go forward with a class action lawsuit against Shutterfly over the scrapbook service’s alleged misuse of biometric data.
The man claims he has never used Shutterfly, but that the company used photographs uploaded by others to create a “faceprint”—a unique ID similar to a fingerprint—of him.
The lawsuit turns on a large database of faceprints Shutterfly compiled to help its customers identify and label people that appear in their photos. According to the lawsuit, however, the company is violating an Illinois state law that forbids firms from collecting biometric data such as iris scans or “face geometry” without a person’s permission.
WATCH: For more on Facebook’s technology, see this Fortune video
In response to the lawsuit, which seeks damages for thousands of others whose face is stored in Shutterfly’s database, the company had asked the judge to dismiss the case. According to Shutterfly, the company should have been protected by a part of the Illinois law that makes an exception for biometrics collected from photographs; however, in his three-page ruling issued in late December, U.S. District Judge Charles Norgle declined to apply the exception.
The outcome means the case can proceed towards trial, though Shutterfly, which did not reply to a request for comment, still has an opportunity to knock it out before then.
The case is also significant because it mirrors a similar suit filed against Facebook. That case, which has been transferred to California, turns on a Facebook (FB) feature that uses faceprint technology to invite users to”tag” friends in photos. Facebook is likewise trying to get the case thrown out based on the law’s exception for photographs, and is also arguing that the law of California—which doesn’t have a biometric law like Illinois—should apply.
SIGN UP: Get Data Sheet, Fortune’s daily newsletter about the business of technology.
Some legal scholars, though, are skeptical the face scanning cases will get much further. According to Internet law experts at the Eric Goldman Blog, the Illinois court should have applied the photo exception; the scholars also suggest the lawsuits are a misguided attack on a useful technology.
On the other hand, the challenge of regulating faceprint technology looms large for privacy advocates. Governments in Europe and Canada don’t allow Facebook tagging, for instance, while a U.S. government-led working group fell apart after consumer groups walked out in protest last year. Meanwhile, retailers like Wal-Mart have experimented with the technology to catch shoplifters.
Here’s the ruling from federal court in Illinois, which is one of only three states to have a law restricting biometrics:
