You uploaded baby photos. Google scanned every face and built a biometric profile for your child before they could consent to anything. Google Photos contains the largest facial recognition training dataset on Earth — billions of labelled faces, contributed by parents who thought they were backing up memories. Your family album is Google's AI training data. $100 million settlement. Google scanned the faces of millions of Illinois residents through Google Photos without getting written consent — a violation of BIPA. They had the technology to ask permission. They chose not to. One hundred million dollars later, the faces are still in the database.
What they claim: Google Photos promotes itself as a safe, private place to store your memories
What we found: Google Photos uses facial recognition to automatically identify and group faces across your entire library — including children. This creates one of the largest facial recognition training datasets in history. Google has used Photos data to train its AI models, including Gemini's image understanding capabilities. Users who upload family photos are contributing to a biometric database they never explicitly agreed to build.
What they claim: Google Photos privacy policy describes photo analysis for search and organisation features
What we found: Google settled a $100 million lawsuit in Illinois for collecting facial recognition data through Google Photos without consent, violating the state's Biometric Information Privacy Act (BIPA). Google had scanned and categorised faces of millions of Illinois residents without obtaining the written consent required by state law.
What they claim: Google originally offered unlimited free photo storage to attract users
What we found: In 2020, Google ended unlimited free storage, retroactively applying storage limits to a service billions of people had used to store their entire photo libraries. Users who had deleted local copies — because Google said storage was unlimited — now faced paying for Google One or losing access. The bait-and-switch affected an estimated 1 billion users.