Six years after Facebook launched a feature that scans uploaded photos to see if it can recognize faces and suggest people to tag, a lawsuit about the social media site’s facial-recognition tech has been given the go-ahead by a federal court.

The lawsuit [PDF], filed in 2015 by a group of three Facebook users from Illinois, alleges that Facebook violated an Illinois state law, the Biometric Information Privacy Act, by failing to properly alert users to the fact that Facebook was collecting and storing a massive database of potentially hundreds of millions of users’ faces. Facebook is also accused of failing to publicly reveal its retention policies for biometric data.

While Facebook users can opt out of the “Tag Suggestions” feature, the lawsuit claims that the company doesn’t make it easy.

“In fact, since the Tag Suggestions feature was rolled out, Facebook has kept its biometrics data collection practices out of its privacy policies and has instead placed ambiguous statements about the true nature of its Tag Suggestions program on remote sections of its website (such as in its “Help Center” or the now defunct “Notes” sections),” reads the complaint. “Uncovering these remote sections not only requires a user to know about Tag Suggestions in the first place, but also requires them to affirmatively seek out more information through multiple layers of additional pages.”

In response to the lawsuit, Facebook argued that the plaintiffs could not bring the case under Illinois law because they had, as part of the Facebook terms of use, agreed that California law governs any disputes with Facebook.

While the court found that the plaintiff users had indeed agreed to the Facebook terms of use, it ultimately determined that Facebook could not use this clause to negate the Illinois state law.

In a ruling [PDF] released yesterday, the District Court judge found that Facebook’s requirement that all disputes be governed by California law runs “contrary to a fundamental policy of Illinois” and that Illinois “has a greater interest in the determination of this case.”

“There can be no reasonable doubt that the Illinois Biometric Information Privacy Act embodies a fundamental policy of the state of Illinois,” explains the court, noting “if California law is applied, the Illinois policy of protecting its citizens’ privacy interests in their biometric data, especially in the context of dealing with ‘major national corporations’ like Facebook, would be written out of existence.”

It seems likely that Facebook will appeal the court’s ruling, as it could set a consumer-friendly precedent.

Pam Dixon, executive director of the World Privacy Forum, tells Bloomberg that the court in this case if effectively saying that “state law will be applicable in cases where a national company attempts to try cases in their own state without applying all states’ laws.”

Want more consumer news? Visit our parent organization, Consumer Reports, for the latest on scams, recalls, and other consumer issues.