Facebook failed to undo a ruling that allows millions of its users to band together in a lawsuit accusing the social network of gathering and storing biometric data without consent, potentially exposing the company to billions of dollars in damages.
A federal appeals court in San Francisco on Thursday rejected the company’s request to block the privacy suit from proceeding as a class action on behalf of Illinois Facebook users going back to 2011 whose photos were tagged and collected in a company-controlled database.
The decision exposes the company to potentially huge penalties under the Illinois Biometric Information Privacy Act of 2008, which provides for fines of $1,000 to $5,000 each time a person’s image is used without consent. The appeals court said the lower court “did not abuse its discretion in determining that a class action was superior to individual actions in this case.”
Facebook said it plans to seek further review of the ruling.
“We have always disclosed our use of face recognition technology and that people can turn it on or off at any time,” a company spokesman said.
The appeal delayed a trial that had been set for July 2018 before a judge who was unsympathetic to Facebook’s arguments for limiting its legal exposure. Now that Facebook has lost the appeal, the case will once again move closer to a courtroom.
A high-stakes trial could hardly come at a worse time for Facebook, which has been under siege by activists, regulators, lawmakers, and prosecutors over its privacy practices.
Facebook launched a feature in 2010 that allows users to identify people they recognize in photos using a tool that automatically matches names to faces on pictures uploaded to the social-media site.
The company was sued in 2015 over claims that it “secretly amassed the world’s largest privately held database of consumer biometric data.” Citing an Illinois law, one of only a handful in the U.S. regulating biometrics, subscribers alleged they never gave Facebook permission to use their faces as biometric identifiers, while the company countered that all users could opt out at any time.
Google won dismissal of a similar case in December 2018.
More must-read stories from Fortune:
—What you need to know about 8chan, the controversial site tied to the El Paso shooting
—Verizon’s unlimited plans are getting cheaper. Here’s what you should know
—What CEOs, bankers, and tech execs think about a coming recession
—How an alleged Amazon theft ring got the goods
—Boeing adds a second flight control computer to the 737 Max
Catch up with Data Sheet, Fortune‘s daily digest on the business of tech.
