The ruling of a federal appeals court late last week has Facebook once again at risk of facing fines north of $1 billion.

The 9th U.S. Circuit Court of Appeals in San Francisco ruled 3-0 Thursday to reject Facebook’s argument to dismiss a class action lawsuit regarding alleged violations of Illinois’ Biometric Information Privacy Act (BIPA).

An initial complaint was filed by three Facebook users in 2015 who claimed the social media giant was illegally collecting, using, and storing biometric data from their photos through its facial recognition technology in violation of sections 15(a) and 15(b) of the BIPA. The feature alleged to be at fault was Facebook’s photo tag suggestions, launched in 2010.

“The panel concluded that the development of a face template using facial-recognition technology without consent (as alleged in this case) invades an individual’s private affairs and concrete interests,” the ruling states. The panel also defended class action determination over individual actions after Facebook argued Illinois legislature did not intend for the BIPA to have extraterritorial effect.

“If the violation of BIPA occurred when the plaintiffs used Facebook in Illinois, then the relevant events occurred ‘primarily and substantially’ in Illinois, and there is no need to have mini-trials on this issue,” says the ruling.

The class action lawsuit applies to Facebook users located in Illinois for whom Facebook created and stored a face template after June 7, 2011—of note given the state’s millions of Facebook users. The BIPA calls for fines of up to $5,000 per person for intentionally breaking the law. The penalty drops to $1,000 per person if the company is found negligent.

A Facebook spokesman told Reuters the company plans to appeal the decision.

Just last month, Facebook was fined a record-breaking $5 billion by the Federal Trade Commission over the company’s handling of users’ privacy.