A class action lawsuit targeting Facebook’s collection of biometric data has cleared its latest hurdle in court. 

On Thursday, the United States Court of Appeals for the Ninth Circuit shut down the tech giant’s attempt to quash a potential $35 billion lawsuit, which claims that it mapped and collected users’ facial recognition data without their permission. The suit dates back to 2015, when lead plaintiff Nimesh Patel accused Facebook of obtaining and storing facial data for its Photo Tag Suggest feature without proper consent. 

The company argued that collecting this data did not impart any “concrete harm” to users, but the Ninth Circuit three-judge panel concluded otherwise.

“We conclude that the development of a face template using facial-recognition technology without consent (as alleged here) invades an individual’s private affairs and concrete interests,” wrote U.S. Circuit Judge Sandra Ikuta. 

Up to $35 billion in potential damages

The class action, which seeks to represent 7 million affected Facebook users in Illinois, has taken a step forward with this latest ruling, but members of the class still face an uphill battle. 

Because the class is specific to users in Illinois, Facebook says that it cannot be held responsible for illegally collecting and storing their biometric data because it was done via servers outside the state. The plaintiffs argue that the illegal actions happened the moment that users within the state uploaded photos. 

A federal jury may ultimately decide which party has the right of it, but if it rules with the plaintiffs, it could be devastating for Facebook. The company could be forced to pay up to $5,000 for each violation of Illinois law; with 7 million members in the class, that could lead to up to $35 billion in potential damages.