The decision comes days after Facebook chief executive Mark Zuckerberg faced intensive questioning by U.S. lawmakers over the company's collection and use of user data. This could result in Facebook paying out billions of dollars.
At the heart of the issue is a 2008 state regulation known as the Biometric Information Privacy Act, which prohibits the collection or use of biometric data without precise public disclosure.
They are referring to Facebook's "tag suggestions" feature, which uses facial recognition to suggest which friends to tag in a photo. Judge Donato put the extent of the damages into perspective, "Facebook seems to believe statutory damages could amount to billions of dollars".
In the case before Donato, he has ruled that the IL law is clear: Facebook has collected a "wealth of data on its users, including self-reported residency and IP addresses".
On Monday, Judge Donato ruled to certify a class of Facebook users - a key legal hurdle for a class action suit.
Giroud double keeps Chelsea in Champions League hunt
It's very disappointing that the officials didn't see it. Thankfully he is okay, he just got a rake down the calf. Southampton are 18th on 28 points in the league table.
Under BIPA, Facebook could be fined between $1000 and $5000 for every occasion that a person's image was used without their consent.
Donato previously rejected Facebook's argument that the case had to be dismissed because the attempt to enforce IL law runs afoul of its user agreement that requires disputes to be resolved under the laws of California, where it's based.
Facebook said the case had no merit and it would fight it vigorously. And that paves the way for the class action lawsuit to proceed.
The feature is not available to users in most countries, including the United Kingdom - and can be turned off in settings for USA users.
Like many features which bear privacy implications, the tag suggestion is enabled by default-a move that upset some watchdogs, who believe any function providing access to data should be opt-in.
The company has altered the controversial feature in the time since it was first rolled out to users back in 2011 by adding a more direct notification alerting users to the facial recognition features.