After paying $650 million earlier this year to settle a lawsuit alleging improper use of facial-recognition data, Facebook is now facing a new lawsuit alleging that its subsidiary, Instagram, also collects biometric data without user-consent. The suit alleges that the company collects, stores and profits from the biometric data of more than 100 million Instagram users, without their knowledge or consent.

The lawsuit, filed Monday in California by one Kelly Whalen, alleges that Instagram’s face-tagging tool uses facial recognition to create create ‘face templates’ that are then stored in Facebook databases. According to her, Instagram uses this tool automatically without obtaining any consent from anyone, even if the people in the images don’t have Instagram accounts themselves. Whalen, an Illinois resident, says she has been using Instagram since 2011.

“Once Facebook captures its Instagram users’ protected biometrics, it uses them to bolster its facial recognition abilities across all of its products, including the Facebook application, and shares this information among various entities”, says the complaint.

According to Bloomberg, the practice violates a state privacy law that bars the unauthorized collection of biometric data. Local law in the state of California provisions for punitive damages of up to $1,000 per violation in cases of illicit collection and dissemination of biometric data, going up to $5,000 if the jury believes that the indicted company acted recklessly or intentionally.

Reacting to the lawsuit, Facebook has released an official statement denying any wrongdoing. In an email to Bloomberg, Stephanie Otway, a Facebook spokesperson, said: “This suit is baseless. Instagram doesn’t use face recognition technology”.