It's only been a few weeks since The Walt Disney Company began deploying facial scanning at the gates of Disneyland and other California parks, but the technology is already the subject of a $5 million proposed class action lawsuit filed against the company in a US District Court in New York.
The federal complaint, filed on behalf of Summer Christine Duffield, says she visited two Disney parks -- Disneyland and Disney California Adventure Park -- earlier this month and that her face was scanned "without adequate consent." The lawsuit accuses Disney of violating privacy, competition and consumer‑protection laws by failing to sufficiently disclose its use of the technology and the data collected.
A Disney representative didn't immediately respond to a request for comment.
Disney began using the technology in late April and said it gives visitors the option to skip face scanning, though there are more lines to enter the parks with scanning and fewer lines without it. The scanning, which is also in practice at Universal Studios parks in Florida, can speed up reentry for those who don't want to hunt for passes on their phones. Disney is also using the tech to ID people and prevent them from using someone else's park pass.
The scanning technology has raised questions about how Disney uses the biometric data it collects and what happens to that data. Disney said in a blog post that it converts photos to numerical values and compares those numbers, not the photos themselves, when detecting unauthorized pass use. The numeric data is deleted within 30 days, except in cases of alleged fraud or other legal reasons for keeping it, the company has said.
Children under 18 can have their faces scanned with a parent or guardian's consent.
Watch this: Imagineers Share Secrets of Disney's New Ride Technology
Blake Hunter Yagman, a lawyer representing Duffield in the case, said Disney isn't giving customers adequate consent to opt in or out, and that its collection of children's facial data is especially problematic. What Disney can do with collected data has not been established, he said.
"Disney remains unclear about their retention of this data, as they claim there is a 30-day deletion schedule while simultaneously disclosing in their privacy policy that facial recognition is compared against annual passes and other photos that Disney retains," Yagman said.
Other high-profile venues in the Los Angeles area also use facial recognition technology at entrances, including Intuit Dome and Dodger Stadium, for reasons that include enabling fast entry or detecting whether visitors are over 21.