Facebook Inc. users who say the social network’s facial scanning flouts their privacy rights won the first round of a court fight.

A federal judge in San Francisco on Thursday rejected Facebook’s request to throw out a lawsuit alleging the company “secretly amassed the world’s largest privately held database of consumer biometric data.”

The dispute is over technology introduced in 2010 that allows users to identify people they recognize in photos using a tool that automatically matches names to faces on pictures uploaded to the social media site.

Citing an Illinois law, subscribers alleged they never gave Facebook permission to use their faces as biometric identifiers, while the company countered that all users could opt out at any time. Facebook also argued that information derived from photographs wasn’t covered by the law.

Facebook had no immediate comment on Thursday’s ruling.

Lawyers for the users said the decision is “an important step towards protecting the privacy rights of consumers.”

“We look forward to the continued prosecution of the action, and ultimately proving our case at trial,” according to a joint statement by law firms Edelson PC, Robbins Geller Rudman & Dowd LLP and Labaton Sucharow.

47 States

California is one of 47 states without laws regulating the use of biometrics and facial recognition technology. Only Illinois, Texas and Connecticut have passed such measures. The Illinois Biometric Information Privacy Act of 2008 is the only law that allows companies to be sued for failing to get consent from consumers.

Google has also been sued for allegedly violating the same law.

The Facebook litigation started as three separate lawsuits in Chicago that were moved to San Francisco and consolidated into a single case.

Facebook argued the case had to be dismissed because the attempt to enforce Illinois law runs afoul of its user agreement that requires disputes to be resolved under the laws of California, where it’s based.

U.S. District Judge James Donato rejected that argument.

‘Complete Negation’

‘Illinois will suffer a complete negation of its biometric privacy protections for its citizens if California law is applied,” he wrote. “In contrast, California law and policy will suffer little, if anything at all,” if the Illinois law is applied.

Pam Dixon, executive director of the World Privacy Forum in San Diego, said the judge’s ruling is a significant win for consumers.

“That’s a huge victory because what that will say is that state law will be applicable in cases where a national company attempts to try cases in their own state without applying all states’ laws,” she said in an interview before Thursday’s ruling.

The case is In re Facebook Biometric Information Privacy Litigation, 3:15-cv-03747, U.S. District Court, Northern District of California (San Francisco).