A judge for the US District Court for the Northern District of California approved a $650 million settlement in a biometric privacy class action lawsuit against Facebook. The settlement is one of the largest ever for a privacy lawsuit and represents a major victory for data privacy advocates.

The lawsuit originated in 2015 and was filed by a Chicago attorney who alleged that Facebook’s facial recognition features violated Illinois law. The Illinois Biometric Information Privacy Act (BIPA) allows consumers to sue companies that collect and store biometric data without asking for permission. In 2018, the lawsuit became a class action. It used innovative methods to reach out to class members by utilizing Facebook, resulting in a claims rate significantly higher than normal.

In 2019, Facebook responded to the lawsuit and other data privacy concerns by making facial recognition features opt-in only. In accordance with the settlement, Facebook will now set facial recognition features off by default globally. Facebook users’ preexisting biometric face templates will also be deleted unless they explicitly consent.

While companies including Facebook, Google and eBay dispute that a privacy violation is an actual injury, the settlement order holds that a statutory privacy violation is a real harm. Judge James Donato lauded the settlement as a landmark result and stated that “[it] is a major win for consumers in the hotly contested area of digital privacy.”

The 1.6 million members of the class action will each receive at least $345, and the court ordered that the settlement amount be paid out “as expeditiously as possible.” While the ruling could be appealed, Facebook has expressed its willingness to move past the matter, indicating the settlement will likely stand as is.