One of the major truths about innovation is that a new invention tends to come first, and then the law has to catch up to it. Cars became a reality, then came speed limits and rules about headlights and seat belts.

The telegraph was invented, and then the FCC was established to regulate it (by the way, there’s a really interesting reason why the FCC was formed, and it involves the Titanic). In more recent years, social media, Google glass, and unmanned drones became a reality, and legal regulations for their use were later enacted.

But one state has already pre-emptively enacted legislation intent on protecting consumers’ privacy in light of new advances in biometric technology. Illinois’ Biometric Information Privacy Act (BIPA) prevents violations of citizens’ privacy rights where things like fingerprints, facial recognition, retinal scans, and other identifying body traits are concerned.

lawsuit filed in that state against photo storage and printing service Shutterfly and social media platform Facebook was initially on hold as defendants filed motions to dismiss, but the court has now ruled that the case can proceed under BIPA’s guidelines. That’s not an indicator of any kind of finding or violation, of course, but only that the court has found enough of a case for the proceedings to move forward.

In the lawsuit, the plaintiff argues that Shutterfly and Facebook engage in “tagging,” which allows you to list people by name in accordance with their photos. A friend of the plaintiff once uploaded personal photos to Shutterfly—a web service which the plaintiff does not use and therefore whose terms and conditions he did not agree to—and labeled the plaintiff through this tagging. Now, those websites have the photograph of the plaintiff along with his name, and that name is tagged to those specific images.

Here’s how it gets even stickier. In the future, if this same friend (or any other customer) uploads new pictures of the plaintiff, Shutterfly and Facebook’s technology will allow them to automatically add the plaintiff’s name as a tag. The companies not only store this information, they use it as a biometric indicator. The plaintiff argues that this constitutes a violation of his privacy under BIPA since those companies are storing and using the information to identify him.

On the surface, it’s tempting to be dismissive of this case. If you don’t want your picture on a website, tell your friends not to do it, right? Not exactly.

By giving the individual with the camera permission to upload the picture in order to print copies for personal use, the plaintiff argues that he still had an expectation of privacy under BIPA. Down the road, if this same plaintiff is standing in the background of a different picture—say, some stranger’s picture at the Statue of Liberty, where the plaintiff also happens to be on vacation—there’s a possibility that the websites will tag the plaintiff in the stranger’s photos because of the information they stored about him.

These are the very types of issues we have to consider as new innovation takes place. It’s all too easy to get caught up in the excitement of new inventions and concepts, but at the heart of every new idea is the need to make sure it can’t harm us in some way.