A California judge on Thursday ruled against Facebook (FB) in a lawsuit that says the company violated user privacy by scanning their faces without permission and inviting others to “tag” them in photographs.
The case is significant because it’s one of the first to test the boundaries of how companies use facial recognition software, a rapidly-advancing technology that treats faces as the modern-day equivalent of a fingerprint. (At Facebook, the company has internally referred to the tool as a “faceprint.”)
Thursday’s court ruling involved three Facebook users from Illinois who sued under a state law that regulates how companies use “biometric identifiers,” including iris scans and “face geometry.” The lawsuit is in the form a class action complaint, and it could let every Facebook user in Illinois collect $1,000 or $5,000, which are the penalties for violating the law.
Read More: Facebook Loses the First Round in Its Battle Over Users’ Biometrics
In the ruling, which you can read here, U.S. District Judge James Donato agreed that Facebook’s scanning and tagging feature qualified as a use of biometric identifier covered by the statute. On a key procedural issue, he refused Facebook’s request to decide the case under California law, where companies don’t face restrictions on the use of biometrics.
The procedural issue is important because, under Facebook’s terms of service, consumers must agree to settle any legal dispute in California. While agreeing to hear the case in San Francisco, the judge, however, nonetheless ruled that the law of Illinois should apply.
“Taking all of these factors as a whole, the plain language of BIPA indisputably evinces a fundamental privacy policy of Illinois,” the ruling states. “But if California law is applied, the Illinois policy of protecting its citizens’ privacy interests in their biometric data, especially in the context of dealing with ‘major national corporations’ like Facebook, would be written out of existence.”
While the Thursday ruling does not amount a final decision, it effectively puts Facebook on the hook for violating the biometrics law. Facebook, which can appeal the finding, did not immediately reply to a request for comment.
The case could also have ripple effects for the growing number of other tech companies that use facial scanning software. Google (GOOG), for instance, is facing a similar class action case in Illinois, while the online scrapbook company Shutterfly (SFLY) quietly settled another such case in April.
Subscribe to Data Sheet, Fortune’s daily technology newsletter
In an email statement, a lawyer representing the Facebook users said the ruling could affect other cases.
“We are pleased with the court’s well-reasoned decision and look forward to the continued prosecution of the action on behalf of consumers whose biometric information has been collected in violation of the Illinois Biometric Information Privacy Act,” said Shawn Williams, of Robbins Geller Rudman and Dowd. “Given the detailed analysis undertaken by the court, it’s possible that it may impact other pending lawsuits arising under the same statute, though that remains to be seen.”
The ruling is also likely to provide for grist for the debate over who owns your face, and could spur others states to pass biometric laws of their own.
Meanwhile, other countries, including Canada and many European nations, have banned Facebook’s tagging feature on privacy grounds. And last year, the retailer Wal-Mart (WMT) has abandoned a trial program in which it used the technology to identify shoplifters.
