A US federal judge in California ruled Monday that Facebook will have to face a class action suit over allegations it violated users’ privacy by using a facial recognition tool on their photos without their explicit consent.

The ruling comes as the social network is snared in a scandal over the mishandling of 87 million users’ data ahead of the 2016 US presidential election.

The facial recognition tool, launched in 2010, suggests names for people it identifies in photos uploaded by users — a function which the plaintiffs claim runs afoul of Illinois state law on protecting biometric privacy.

Judge James Donato ruled the claims by Illinois residents Nimesh Patel, Adam Pezen, and Carlo Licata were “sufficiently cohesive to allow for a fair and efficient resolution on a class basis.

“Consequently, the case will proceed with a class consisting of Facebook users located in Illinois for whom Facebook created and stored a face template after June 7, 2011,” he said, according to the ruling seen by AFP.

A Facebook spokeswoman told AFP the company was reviewing the decision, adding: “We continue to believe the case has no merit and will defend ourselves vigorously.”

Facebook also contends it has been very open about the tool since its inception and allows users to turn it off and prevent themselves from being suggested in photo tags.

The technology was suspended for users in Europe in 2012 over privacy fears.

Also on Monday, Facebook confirmed that it collected information from people beyond their social network use.

“When you visit a site or app that uses our services, we receive information even if you’re logged out or don’t have a Facebook account,” product management director David Baser said in a post on the social network’s blog.

Baser said “many” websites and apps use Facebook services to target content and ads, including via the social network’s Like and Share buttons, when people use their Facebook account to log into another website or app and Facebook ads and measurement tools.

But he stressed the practice was widespread, with companies such as Google and Twitter also doing the same.