One week after Facebook CEO Mark Zuckerberg testified before Congress on his company's data privacy policies in the wake of the Cambridge Analytica scandal, the social-media company is being hit with a lawsuit over its facial recognition technology practices.

On Tuesday, a California federal judge ruled that a class-action lawsuit against Facebook for allegedly improperly using users' facial information without their prior consent will move forward to trial, according to TechCrunch.

The case, originating in Illinois, was brought up by three Facebook users in 2015 who sued under a 2008 state law known as Biometric Information Privacy Act. The law requires all companies that collect biometric data to give prior notification and obtain users' consent. Illinois and Texas are the only two states that have laws requiring the informed consent of people who are identified with such technology. There are no federal laws governing the use of facial recognition technology.

The social-media giant argued that the case has no merit--saying that the plaintiffs had to prove that they were actually harmed. But the judge disagreed with Facebook and supported the plaintiffs' claims of an "injury to privacy rights," according to Gizmodo.

A Facebook spokeswoman told Inc., "We are reviewing the ruling. We continue to believe the case has no merit and will defend ourselves vigorously."

Facebook's facial technology is used for tag suggestions in photos. So when the algorithms detect your face, Facebook can encourage the user to tag you--making it easier for users to tag their photos. Users do have the option to turn it off. The social-media giant estimates that 90 percent of faces in photos can be accurately detected. Facebook collects a lot of data on users, reportedly including more than 350 million user-uploaded photos every day.

Facebook is only the latest company involved in high-profile data scandals that are making users more aware of how their information is being collected. Yahoo, Equifax, and Under Armour were involved in data breaches recently. Next month, the European Union's General Data Protection Regulation (GDPR) will go into effect and will re-shape how companies collect EU users' information online.

While Congress pushes to regulate U.S. tech companies, a Wall Street Journal/NBC News poll Tuesday showed that only some 37 percent of respondents think that such platforms are not regulated enough.