Facebook must face a class action lawsuit over its use of facial recognition technology, a California judge has ruled.
The lawsuit alleges that Facebook gathered biometric information without users' explicit consent.
It involves the "tag suggestions" technology, which spots users' friends in uploaded photos; the lawsuit says this breaches Illinois state law.
Facebook said the case had no merit and it would fight it vigorously.
On Monday, US District Judge James Donato ruled to certify a class of Facebook users - a key legal hurdle for a class action suit.
The class of people in question is Facebook users "in Illinois for whom Facebook created and stored a face template after June 7, 2011", according to the court order.
In a successful class action suit, any person in that group could be entitled to compensation.
In his order, Judge Donato wrote: "Facebook seems to believe... statutory damages could amount to billions of dollars."
The decision comes days after Facebook CEO Mark Zuckerberg faced intensive questioning by US lawmakers over the company's collection and use of user data.
What does the facial recognition do?
June 2011 was the date on which Facebook rolled out its "tag suggestions" feature.
The feature suggests who might be present in uploaded photos, based on an existing database of faces.
In Judge Donato's ruling, he laid out the four-step process behind the technology:
- Initially, the software tries to detect any faces in an uploaded photo
- It standardises and aligns them for size and direction
- Then, for each face, Facebook computes a face signature - a mathematical representation of the face in that photo
- Face signatures are then run through a stored database of user face templates to look for similar matches.
On its help pages, Facebook says the face templates are made from information about the similarities in every photo the user has been tagged in.
"If you've never been tagged in a photo on Facebook or have untagged yourself in all photos of you on Facebook, then we do not have this summary information for you," the company says.
The feature is not available to users in most countries, including the UK - and can be turned off in settings for US users.