Facebook might think it’s facing enough problems right now, but the company's about to run into another privacy-related headache. A federal judge has just given the go-ahead for three Illinois users to file a class action lawsuit against the social network over its facial recognition systems.

The suit—first filed in 2015—alleges that Facebook’s photo-tagging feature violates Illinois’ Biometric Information Privacy Act (BIPA), which forbids collection of identifiable biometric data without a person’s explicit consent.

Facebook’s motion to dismiss the lawsuit was rejected in May 2016. Now, US District Judge James Donato has ruled that it can proceed with class-action status.

The plaintiffs say Facebook’s creation and storing of face templates for automatic photo-tagging purposes is prohibited under BIPA. But despite Facebook’s success in getting the case moved from Illinois to San Francisco, the judge ruled that “plaintiffs’ claims are sufficiently cohesive to allow for a fair and efficient resolution on a class basis.”

Facebook’s arguments that no “actual” harm was caused and that the Act can’t apply because its servers aren’t in Illinois failed to convince Donato. The company also tried and failed to claim that the data it collects isn’t covered by BIPA, which restricts the collection of fingerprints, voice prints, and “hand or face geometry.”

Under BIPA, Facebook could be fined between $1000 and $5000 for every occasion that a person’s image was used without their consent. A company spokesperson said it is "reviewing the ruling,” adding that "we continue to believe the case has no merit and will defend ourselves vigorously."