"The state’s attorney general said the company repeatedly captured and commercialized biometric data in photos and videos for more than a decade without users’ permission."