Image: Unsplash

On the heels of Facebook being sued in August for allegedly collecting and sharing users’ biometric data without their consent, Instagram and its parent company Facebook are on the receiving end of a $5 million-plus lawsuit accusing them of accessing “spy[ing] on users through their smartphone camera without their consent… during intimate moments and in private places, such as their bedroom, to gather lucrative data to increase its advertising revenue,” despite Instagram publicly asserting that it “only access your camera when you tell us to— for example when youswipe from Feed to Camera.”

According to a proposed class action lawsuit filed in a federal court in Northern California, Instagram user Brittany Conditi claims that as a result of Apple’s July 2020 operating system update, iPhone users are now able “to see exactly how companies access and use their personal information.” As a result of the Apple update, Conditi alleges that Instagram “users were able to discover that Instagram was secretly monitoring them” by way of their iPhone cameras “while they were not using Instagram’s camera feature and for reasons beyond any ‘service’ that Instagram claims to provide.” 

While Instagram discloses in its Data Policy that it “collects ‘information about how you use features like our camera,’” it does not “disclose that, when users are not using its camera feature, Instagram is secretly accessing users’ smartphone camera to monitor individuals,” Conditi argues. “This is beyond the scope of services that Instagram provides and Instagram has no legitimate reason to access users’ smartphone cameras while they are not interacting with Instagram’s camera feature.” 

The purpose of such “egregious violations of [users’] privacy rights”? The complaint asserts that Instagram and its parent Facebook “abused their ability to access users’ smartphone cameras, and committed egregious privacy violations, for one specific reason: to increase their advertising revenue,” which Conditi alleges made up “substantially all of Facebook’s $55.8 billion [revenues] in 2018,” citing the 2019 complaint that the Federal Trade Commission filed against Facebook. 

“By obtaining extremely private and intimate personal data on their users, including in the privacy of their own home, Facebook and Instagram are able to target users more than ever before,” she asserts in furtherance of their “core business model” of “monetizing user information.” 

As a result of the foregoing and given the apparent lack to disclosure by Instagram about how it  “accesses users’ smartphone camera while the camera feature is not in use,” and its alleged failure to “obtain consent to do so,” Conditi claims that the social media platform runs afoul of both federal and state law. In addition to violating California state business laws, she asserts that the social media giants have violated the California Consumer Privacy Act, which protects consumers’ personal information from collection and use by businesses without providing proper notice and obtaining consent, and which Instagram and Facebook are subject to “because they individually earn more than $25 million in annual gross revenue.” 

Moreover, the two defendants have allegedly violated the Wiretap Act, which “prohibits the interception of any wire, oral, or electronic communications without the consent of at least one authorized party to the communication;” and the California Invasion of Privacy Act in connection with its “surreptitious monitoring and spying … which was highly offensive because it violated expectations of privacy that have been established by general social norms.” 

In addition to seeking a certification of her class action suit in order to potentially enable “millions of individuals” who have been subject to such alleged spying to join in the case, Conditi is seeking damages of upwards of $5 million, and injunctive relief in order to bar Facebook and Instagram from further engaging in such allegedly illegal activities. 

Neither Facebook nor Instagram have commented on the suit. 

*The case is Brittany Conditi v. Instagram LLC and Facebook, Inc., 3:20-cv-06534 (N.D.Cal.)