Facebook — inarguably the world’s better facial database — has a lost a federal appeal in a class-action accusation that claimed it illegally calm and stored biometric data of millions of users after their consent.

The accusation began in 2015 when Illinois-based Facebook users sued the aggregation for actionable the state’s Biometric Information Aloofness Act (BIPA), which mandates that companies advance a public “written policy” before such data is calm and stored, and authorize a assimilation agenda after which the said biometric identifiers will be destroyed.

Facebook’s contravention stems from its “Tag Suggestions” affection that lets you automatically tag your friends in photos uploaded to the service.

The technology analyzes the capacity of people’s faces in the photos — the ambit amid their eyes, their nose, and other appearance — to create a face arrangement that can be used to analyze them in other photos.

The plaintiffs argued the company’s facial acceptance affection failed to meet the requirements of the law.

In a 3-0 decision, the 9th U.S. Circuit Court of Appeals in San Francisco — which has administration over Facebook’s address in Menlo Park — absolutely alone the company’s appeal to rescind the class-action lawsuit.

“We achieve that the development of face arrangement using facial-recognition technology after accord (as declared here) invades an individual’s clandestine diplomacy and accurate interests,” the court ruled in its decision.

Privacy advocates have long bidding apropos that facial acceptance systems could be exploited for mass surveillance. The American Civil Liberties Union (ACLU) said “the accommodation is a major win for aloofness rights, and recognizes the dangers posed by the added use of face acceptance technology.”

Now that the case can move forward, this could potentially cost the social media giant billions of dollars in amercement if it loses. Reuters notes the accusation “could accommodate 7 actor Facebook users.”

Under BIPA, each user afflicted by Facebook’s actionable biometric accumulating could be advantaged to amercement of $1,000 for each behindhand abuse and $5,000 for each advised or adventuresome violation.

Read next: Facebook is allure publishers with multi-million dollar deals to launch its news tab this fall