Facebook can store an indefinite record of a user’s identity using a facial recognition tool, which if not switched off can also affect Facebook non-users, a leading tech expert has confirmed.

The social network giant will have to face a class action lawsuit for allegedly creating and storing facial recognition algorithms of Facebook users in Illinois without their consent, US District Judge James Donato ruled on Monday.

Anyone in Illinois who claimed to have had their images unlawfully scanned and their biometric data stored after June 7, 2011 – the date when Facebook introduced its ‘Tag Suggestions’ tool – will be able to partake in the class action against the company.

In a statement, cited by Reuters, Facebook said the case had “no merit” and that the company would defend itself “vigorously”.

While Facebook’s facial recognition feature may breach privacy laws in Illinois, the tool essentially gives Facebook permission to analyse images “in ways that are not necessarily obvious to you”, Tama Leaver, associate professor in internet studies at Curtin University, said.

Anytime somebody uploads a photo, Facebook will attempt to detect any faces by scanning the image. For each face it recognises, Facebook creates a mathematical signature and runs it through a database of face templates to look for similar matches.

“That all happens whether you like it or not,” Dr Leaver said.

Even if users avoid uploading images altogether, Facebook can still find you in images that other people upload and start the facial recognition process again.

“For there to be no record of you ever made, you and anyone who has ever uploaded a photo of you must have turned face recognition off,” Dr Leaver said.

“Because it’s not the default setting it’s very unlikely for that to ever be the case.”

Parents need to be especially “mindful” of any images they upload of their children, because Facebook can create a face template of any non-user, he said.

“Once you’ve got a few hundred photos of your kids, then Facebook will be able to identify them indefinitely, even if those kids don’t have Facebook profiles of their own.”

Even as few as 20 images can allow Facebook to build a facial recognition index of a user.

“If they were good quality photographs of a similar kind, 20 or 30 would probably do the job,” Dr Leaver said.

“One-hundred photos would be more than enough to be highly effective in most cases.

“It means Facebook has a better idea of who we are, and who we interact with.”