A federal judge this week delivered a key victory for customers who claim the digital scrapbook company Shutterfly violated their privacy by collecting scans of their faces without permission.
In a 19-page opinion, U.S. District Judge Joan Gottschall rejected Shutterfly’s argument that an Illinois state law, which restricts how companies can use biometric data, should not apply.
The law, which is a source of consternation for the tech industry, covers biometric information such as thumb prints or retinal images but also geometrical data gleaned from a person’s face. Such facial data has become an increasingly sophisticated tool in recent years for identifying people, and is poised to go mainstream with tools like Apple’s new iPhone X, which uses facial recognition as a security measure to unlock the phone.
Shutterfly, which has compiled a large database of facial images to assist customers in tagging people in their online photo albums, claims it is protected by an exception to the law for photographs—and that the law only applies to in-person facial scans. The judge rejected that argument, pointing to language in the law that protects “facial geometry” to conclude that the rules does apply to photos.
Companies are still able to conduct scans of people’s faces if they first obtain permission. Shutterfly did this in the case of its customers but was nonetheless sued by a Chicago man who claimed the company added his face to its database even though he had never used the service.
Get Data Sheet, Fortune’s technology newsletter.
The Shutterfly ruling follows earlier rulings in similar class action suits against Facebook and Google, which last year lobbied unsuccessfully to change the Illinois biometrics law. According to Chris Dore, a lawyer with the firm, Edelson LC, that is leading the case against Facebook, the litigation is still underway.
While the rulings in all of the facial recognition cases are preliminary, the companies may pursue settlements since firms typically avoid trials in class action cases.
More broadly, the Illinois law is an impediment to the growing number of companies that are integrating facial recognition into their products. While the law only covers Illinois residents, it could create significant legal headaches for the tech sector if other states adopt similar requirements.
For now, such a worry appears far-off. Currently, Texas is the only other state to have a similar biometrics law but, according to Dore, the law is toothless because it lacks meaningful enforcement measures.