In a huge victory for Facebook privacy advocates, a federal judge has rejected Facebook’s request to toss a lawsuit alleging that Facebook’s facial recognition technology violates user privacy.

“The Court accepts as true plaintiffs’ allegations that Facebook’s face recognition technology involves a scan of face geometry that was done without plaintiffs’ consent,” U.S. District Judge James Donato wrote in the ruling.

The lawsuit, filed in Illinois but being heard in Facebook’s home state of California, alleges that Facebook’s photo-tagging system creates “faceprints” of people’s faces without their consent. According to the suit, that violates the Biometric Information Privacy Act, an Illinois law created in 2008. This facial recognition technology is disclosed in the site’s data policy, and users can opt out of it if they want, but neither of those things are all that clear to the average user. In other words, it may not legally count as user consent.

Facebook’s Terms of Service say the site can only be held to California and federal laws, though in this case, the judge found that those terms aren’t enough to toss the Illinois suit.

While this is a relatively small legal victory for Facebook’s opponents, it could prove to be a big one. If the Illinois suit succeeds, it could pave the way for many more pro-privacy cases like it.