In 2019, a viral Internet meme called the “10-Year Challenge” flooded social-media newsfeeds, asking users the question: “How hard did aging hit you?” Users responded by sharing side-by-side photographs of themselves from 2009 and 2019 with their followers. While the challenge spread across social-media platforms, commentators began speculating about the challenge’s origins after a writer for Wired magazine published an op-ed questioning whether Facebook used the challenge to train its facial recognition technology. The op-ed argued that the challenge, while seemingly harmless, could provide Facebook with a sufficient dataset to train its facial recognition technology on age progression. While Facebook denied playing a role in generating the challenge, the op-ed poignantly observes the chilling possibility of tech companies using manipulative tactics to compel disclosure of otherwise private information.
This Article examines the potential remedies available to consumers who have been manipulated into surrendering their biometric data. Using the 10-Year Challenge as a test case, this Article assesses the viability of the causes of actions currently available to consumers who have surrendered their biometric data as a result of manipulative, or at least less-than-forthright, data-collection tactics and concludes that neither common-law tort claims nor recently enacted biometric privacy laws at the state level provide adequate protection from campaigns designed to manipulate consumers into surrendering their private information. Congress must address these types of tactics when crafting broader federal privacy legislation; this Article proposes a legislative starting point.