Is it really the “happiest place on Earth”? A new proposed class action lawsuit accuses the Walt Disney Company of violating privacy, unfair competition, and consumer protection laws by using facial recognition technology at Disneyland park entrances to verify tickets. The proposed class action seeks at least $5 million in damages and a court order requiring Disney to obtain written consent before using the technology.
How Does Disney Use Biometric Data?
In April, Disney implemented facial recognition at the entrances to Disneyland and its sister park, Disney California Adventure (aka where you go for Radiator Springs Racers). Disney takes photographs of guests’ faces and compares them with images that were taken when they first used their annual passes or tickets. Disney has said that this makes entering and reentering the park easier and helps prevent fraud.
There are signs posted at four entrances indicating that visitors can avoid the technology by using separate non-biometric entry lanes. But critics say these signs are easy to miss, and most guests opt to have their faces scanned.
Disney has said publicly that the biometric information it collects at Disneyland entrances is deleted within 30 days, unless it’s retained for legal or fraud-prevention purposes.
The Complaint
The complaint was filed in the U.S. District Court for the Southern District of New York on May 15, on behalf of a woman named Summer Christine Duffield. Duffield lives in Riverside County and visited Disneyland with her kids. The complaint alleges that Disney “does not adequately disclose the use of their biometric collection, so consumers — which almost always include children — have no idea that Disney is collecting this highly sensitive data.”
The lawsuit argues that posting signs telling people they can skip the scan is not the same as giving meaningful notice. Instead, the complaint says, explicit written consent should be required to protect guests’ privacy at Disney parks.
The complaint also takes issue with Disney’s failure to tell guests how the facial recognition technology operates or how their information is used, shared and stored. The lawsuit notes that biometric identification can be a problem if there’s a data breach because it’s so easily linked to a person’s identity and records, including their credit cards and government-issued ID.
Disney has publicly denied these allegations.
It’s Legal in California — But There Are Rules
In California, businesses can use facial recognition technology, but they are required to follow a growing set of rules. They’re required to disclose the use of certain technology and to allow consumers to limit the way their data is used and shared.
California isn’t alone in regulating facial recognition this way. Other states, including Illinois, Washington, and New Jersey, have enacted stricter laws requiring notice and consent.
It’s a Trend That’s Spreading
The lawsuit challenges a trend that’s been spreading across major sports and entertainment venues, as well as airports, hospitals, casinos, amusement parks, and stores — using facial recognition technology to help prevent fraud, streamline entry, and improve safety.
Rolling Stone reported that Taylor Swift used it to look for stalkers at a Los Angeles concert by hiding a facial-recognition camera inside a special kiosk. The kiosk featured her rehearsal clips. When mesmerized fans stopped to stare, they unknowingly had their pictures taken and cross-referenced with a database of hundreds of Taylor’s known stalkers.
The New York Times reported that Madison Square Garden uses facial recognition technology to ban entry for the “enemies” of its billionaire owner, James Dolan. The list of banned enemies includes not only lawyers who sue his company, MSG Entertainment, but all lawyers at their law firms. The article tells the story of a mom on a Girl Scout troop trip to see the Rockettes who was turned away for being an attorney.
Ticketmaster has invested in Blink Identity, a startup that claims its sensors can identify people walking past at full speed in about half a second. The technology aims to replace tickets with facial recognition. And more and more applications for facial recognition technology seem to roll out every day.
The Problem With Using Facial Recognition
The mass adoption of facial recognition technology has raised concerns about a private surveillance state and the commercialization of sensitive personal information. Biometric data is a tremendously powerful technology with lots of potential. But it’s important to have checks and balances on that power to make sure it’s not abused.
One set of issues that has been of concern to courts and regulators is what’s done with the photos that are collected. Are they all saved? If so, where are the servers located? Will they be shared with anyone else, or even used for marketing purposes?
Another set of issues involves notice. People like to be told when their faces are scanned for security purposes, preferably before they’ve bought the ticket and are at the park gates covered in sunscreen and ready to ride Space Mountain. That way, they can make an informed decision.
This technology is new, and it’s not always completely accurate. It could be possible for someone to be wrongly accused of something they didn’t do (like a pregnant mom in Detroit who was arrested for carjacking, for example). Even without doing anything wrong, a Disney guest could mistakenly wind up on a private watchlist that banned them from Disneyland Resort access for life.
The law is changing quickly. Many lawsuits challenge biometric privacy laws enacted before facial recognition systems became widely used in everyday consumer settings, forcing courts to decide how older privacy and consumer protection rules apply to newer surveillance systems. How will this lawsuit play out? We don’t know, but we’re all ears — mouse ears, that is.
