Ironically, Facebook may be in legal trouble for storing data of faces. A federal judge in California has ruled that Facebook can be sued in a class-action lawsuit brought by users in Illinois. The complainants say, that without their consent, Facebook used facial recognition technology on their uploaded photographs.

The lawsuit was filed by Jay Edelson of Edelson PC, a firm based in Chicago, which specializes in suing technology companies for privacy violations.

The lawsuit contends that Facebook has “secretly amassed the world’s largest privately held database of consumer biometrics data,” and is seeking penalties of up to $5,000 for every time a user’s facial image is used without permission.

The potential damages could amount to billions of dollars. The case concerns a feature, which was introduced in 2010 by Facebook that analyzes users’ photos and then suggests names to go with the faces in the picture from the users’ lists of friends. The lawsuit contends that the social network violated an Illinois law, called the Biometric Information Privacy Act, by storing images of its users’ faces without obtaining their permission and also did not make it clear how long it planned to keep the digital data. The Biometric Information Privacy Act says that information that uniquely identifies an individual is, in essence, their property and specifically prohibits a private entity from selling, leasing, trading or otherwise profiting from a person’s biometric information.

Facebook has issued a statement saying it continued to believe that the lawsuit has no merit. Now it’s up to the courts to decide who will win this face off.