Judge Sandra Ikuta said in the ruling that Illinois users can bring a class action lawsuit against Facebook, whose facial recognition software "invades an individual's private affairs and concrete interests".
The Circuit Court rejected a Facebook appeal to block the class action lawsuit by the Facebook users who accused the US media company of storing biometric data for millions of users without their consent.
"Facebook's facial recognition technology violated Illinois's Biometric Information Privacy Act (BIPA)," said the court document.
"Violations of the procedures in BIPA actually harmed or posed a material risk of harm to those privacy interests," it added.
BIPA provides for $1,000 dollars for each negligent violation and $5,000 for each intentional or reckless violation.
The ACLU hailed the court decision as the first one by a US appellate court to directly address privacy concerns caused by facial recognition technology.
The lawsuit could make Facebook face billions of dollars in potential damages if it eventually loses the legal battle.