Two tech giants, confronted by nagging lawsuits over facial recognition technology, invoked a recent Supreme Court decision and the Commerce clause of the U.S. Constitution in a fresh attempt to smother a key biometrics law.
The legal arguments, which appear in recent court filings by Facebook and Google, are part of an attempt by the companies to defeat class action claims based of the Biometric Information Privacy Act, a state law that restricts activities such as facial scanning.
The law has given rise to a spate of lawsuits that allege companies failed to obtain consumers’ consent before scanning and storing images of their face.
In the case of Facebook, lawyers met in a California courtroom on Wednesday to discuss the next steps of the class action suit, which could go to trial next year. A similar case involving Google is at an earlier stage in Illinois.
The legal fight over face-scanning is a sensitive one for the tech giants, which depend on facial recognition software to run popular products like Facebook Moments and Google Photos. These pieces of software use artificial intelligence to identify faces among databases of millions of photos, prompting users to “tag” people they know.
Under the Illinois law, companies that collect “biometric identifiers” without consent can be forced to pay $1,000 or $5,000 for each violation. Earlier this year, the online scrapbook company Shutterfly (SFLY) quietly settled a case that alleged its face-scanning violated the law.
If the class action lawsuits against Facebook (FB) and Google (GOOGL) succeed, they could force the companies to pay millions of dollars in damages and, in what would likely be a greater nuisance, force them to change their policies around how they use faces.
Get Data Sheet, Fortune’s technology newsletter.
This threat has led Facebook and Google to act aggressively to defeat the legal challenges. The companies, for instance, were reportedly behind a lobbying gambit in late May to pressure Illinois lawmakers into rewrite the biometrics rules.
That effort came up short, and now the corporations are redoubling their efforts in court.
An Appeal to Higher Authority
Facebook incurred a major setback in May when a federal judge agreed that the photo scanning counted as a “biometric identifier” under the state law, and also rejected the company’s claim that the law of California (but not Illinois) should apply.
In response, Facebook has filed a second motion to dismiss on the basis of a recent Supreme Court decision known as Spokeo. In that case, the top court found there must be a “concrete” injury before consumers could sue under a federal privacy law — but left it open for a lower court to decide what counts as “concrete.”
Now, the Spokeo case will serve as a potential lifeline for Facebook. On Wednesday, the social network claimed that any alleged harm from the face scanning “is far too abstract and speculative” for consumers to claim damages.
Paul Geller, one the lawyers representing consumers in the case, said he is ready for a long legal fight.
“We always anticipated that Facebook would dig in, and our team is fully prepared and committed to protecting our client’s privacy rights, regardless of whether there is a relatively swift resolution or a 15 round battle that goes to trial,” said Geller by email.
A spokesperson for Facebook declined to comment on the new filing.
Google, meanwhile, is pursuing a further legal strategy in its effort to get the case in Illinois thrown out. According to a court filing, the company claims the biometric law is unconstitutional “under the Commerce Clause of the United States Constitution”—a clause that bars states from interfering with interstate trade.
Google did not reply to a request for comment about the case.
In the broader picture, the lawsuits come at a time when facial recognition technology is largely unregulated in the United States, even as it is being used by more companies, including by major retailers to catch shoplifters.
Earlier this month, consumer groups slammed industry guidelines issued under a Commerce Department initiative, claiming they did little to safeguard privacy.
Critics fear that facial recognition can serve as a powerful tool to spy on or track people. In Russia, for instance, a popular app lets consumers use their smartphone cameras to capture the faces of strangers, and then identify them based on images in a social media database. The makers of the app have marketed it in part as a way for men to meet women.
Privacy regulators in other countries, including Canada and many in Europe, have introduced restrictions on the use of facial recognition technology. But for now, it remains largely unregulated in the United States. A spokesperson for the Federal Trade Commission, which is the country’s de facto privacy cop, said he could not immediately comment on the Facebook and Google cases.
