Google LLC has been hit with a class action lawsuit claiming that its Google Photos service uses facial recognition technology that violates an Illinois biometric privacy law that carries stiff statutory penalties.

The lawsuit, filed Thursday in U.S. District Court for the Northern District of California, claims that Google has failed to get the consent or written release required under the Illinois Biometric Information Privacy Act, a 2008 law that requires companies that collect and store state residents’ unique identifiers such as fingerprints, iris scans, DNA and face geometry to provide details on how they store and protect the sensitive information. The statute carries statutory damages of $1,000 for negligent violations and $5,000 for violations found to be intentional or reckless.