A major class action lawsuit was filed against Photobucket on Wednesday following revelations that the photo storage platform plans to sell users' images and biometric data to artificial intelligence companies without proper consent.
The lawsuit targets Photobucket's recent privacy policy update that would allow the company to sell users' photos, including sensitive biometric identifiers like facial features and iris scans, to firms developing AI models.
Two distinct groups could be affected: anyone who uploaded photos to Photobucket since its 2003 founding until May 2024, and individuals who appear in uploaded photos but never used the service themselves. This could impact up to 100 million users and billions of photographs.
The legal action alleges that Photobucket violated strict privacy laws in states like Illinois, New York, and California. Users could receive up to $5,000 per violation if the company is found to have willfully disregarded privacy regulations.
According to Business Insider reports from October, Photobucket estimated that approximately half of its 13 billion stored images are public and available for AI licensing. The platform has already confirmed selling at least one Illinois user's data to AI training programs.
The lawsuit claims Photobucket employed deceptive tactics through "innocuous" emails that forced users to accept new terms, including a Biometric Information Privacy Policy, even when attempting to delete their accounts. Users were allegedly misled about requirements for downloading their data and told they would be automatically opted in after 45 days of inaction.
Beyond seeking to halt Photobucket's data sales, the lawsuit also targets unnamed AI companies that purchased user data. These firms are required by various state laws to obtain explicit consent and provide clear explanations of how biometric data will be used and stored.
Photobucket CEO Ted Leonard previously told Business Insider the company was negotiating with several firms to license images, expecting "material margins" from these deals.
Mike Kanovitz, representing the plaintiffs, emphasized that users deserve control over their data usage and should share in any profits generated from it. The lawsuit seeks both injunctive relief and compensation for affected users.
Photobucket has approximately 30 days to respond to the complaint.