The 3-0 decision could lead to Facebook paying fines of $1,000 to $5,000 per violation, which could total billions of dollars.
The lawsuit was filed in 2015 and later became a class-action suit. The judges sided with the plaintiffs Thursday.
"We conclude that the development of a face template using facial-recognition technology without consent (as alleged here) invades an individual's private affairs and concrete interests," the court ruled.
The social media giant said it plans to appeal the case and could take it to the Supreme Court. Facebook said the plaintiffs declined to show injury.