WASHINGTON, 18 April (VERGE) — Facebook could face billions of dollars in fines after a federal judge ruled that the company must face a class action lawsuit. The lawsuit alleges that Facebook’s facial recognition features violate Illinois law by storing biometric data without user consent.

The lawsuit involves Facebook’s Tag Suggestions tool, which identifies users in uploaded photos and suggests automatic tagging of your friends. The feature was launched on June 7th, 2011. According to the suit, the complainants allege that Facebook “collects and stores their biometric data without prior notice or consent in violation of their privacy rights.” Illinois’ Biometric Information Privacy Act (BIPA) requires explicit consent before companies can collect biometric data like fingerprints or facial recognition profiles.

It should be noted that Facebook has since also added a more direct notification alerting users to its facial recognition features, but this lawsuit is based on the earlier collection of user data. With the order, millions of the social network’s users could collectively sue the company, with violations of BIPA incurring a fine of between $1,000 to $5,000 each time someone’s image is used without permission.