SAN FRANCISCO (Reuters) — A U.S. federal judge ruled on Monday that Facebook Inc must face a class action lawsuit alleging that the social network unlawfully used a facial recognition process on photos without user permission.

The ruling adds to the privacy woes that have been mounting against Facebook for weeks, since it was disclosed that the personal information of millions of users was harvested by the political consultancy Cambridge Analytica.

U.S. District Judge James Donato ruled in San Francisco federal court that a class action was the most efficient way to resolve the dispute over facial templates.

Facebook said it was reviewing the ruling. “We continue to believe the case has no merit and will defend ourselves vigorously,” the company said in a statement.

Lawyers for the plaintiffs could not immediately be reached for comment.

Facebook users sued in 2015, alleging violations of an Illinois state law about the privacy of biometric information.

The class will consist of Facebook users in Illinois for whom Facebook created and stored facial recognition algorithms after June 7, 2011, Donato ruled. That is the date when Facebook launched “Tag Suggestions,” a feature that suggests people to tag after a Facebook user uploads a photo.

In the U.S. court system, certification of a class is typically a major hurdle that plaintiffs in proposed class actions need to overcome before reaching a possible settlement or trial.

(Reporting by David Ingram; Editing by Sandra Maler and Cynthia Osterman)