Facebook users who felt that their privacy was violated by the website’s use of facial recognition software — which it uses to help identify and tag people in photographs — won an early legal victory Thursday when a San Francisco federal judge rejected a request by the internet company to dismiss a lawsuit challenging its collection of biometric information.

“The court accepts as true plaintiffs’ allegations that Facebook’s face recognition technology involves a scan of face geometry that was done without plaintiffs’ consent,” U.S. District Judge James Donato ruled.

Three Illinois residents filed separate lawsuits — that were later combined — under the state’s Biometric Information Privacy Act of 2008, which allows companies to be sued for failing to get consumers’ consent before collecting or storing their biometric information, which includes “faceprints” used by Facebook (and also Google) for identifying people in photographs.

Facebook introduced its face-recognition feature in 2010. California, where Facebook is based, does not have a law regulating the use of biometrics. In fact, other than Illinois, only Texas and Connecticut have such laws. Facebook’s argument that its user agreement required all disputes to be settled under California law was dismissed by the judge.

“Illinois will suffer a complete negation of its biometric privacy protections for its citizens if California law is applied,” Judge Donato wrote. “In contrast, California law and policy will suffer little” if the Illinois law was applied in the case.

In its defense, Facebook also said that users could opt out of using the tool whenever they wanted, and that information derived from photographs wasn’t covered by the Illinois law.

Speaking to the Verge, Alvaro Bedoya of the Center on Privacy and Technology at Georgetown Law used an analogy to explain the issue: “If you run a bar, the law doesn’t prevent you from picking up my used pint glass, but it prevents you from pulling my DNA off it.”

Facebook was also hit with a lawsuit late in April over its plan to issue new stock under a new class of non-voting shares that would allow Mark Zuckerberg to keep control of the company.

In March, a lawsuit was filed against Google for its photo-tagging system under the same Illinois law.