Meta faces class action lawsuit over alleged unauthorized biometric data use in AI development and smart glasses technology

A federal lawsuit filed in Chicago last week has ignited a fresh legal battle over the boundaries of digital privacy, as parents from Illinois and California allege that Meta Platforms Inc. has systematically harvested the biometric identities of millions of users without consent. The proposed class action lawsuit contends that the tech giant utilized photos uploaded to Facebook and Instagram to train its generative artificial intelligence models and to engineer an unreleased, controversial facial recognition system codenamed NameTag, which was designed to integrate with Meta’s smart glasses.

The litigation, representing a potential class of millions of American users, claims that Meta’s data practices violate stringent privacy statutes in both Illinois and California. At the heart of the complaint is the allegation that Meta transformed personal, private photographs into biometric signatures—digital maps of faces—without providing notice or obtaining the explicit consent required by law.

The Anatomy of the Allegations

The plaintiffs, led by Illinois residents Francisco Alvarez and his son, alongside California residents Jeremy Wahl and his minor daughter, argue that Meta’s pursuit of AI dominance has come at the expense of user privacy. The core of their argument rests on the claim that the company’s vast repository of user-uploaded content serves as an unauthorized training ground for its advanced systems, including the generative AI models Emu and Muse Image.

According to the legal filing, Meta has effectively turned the digital archives of its users into a biometric goldmine. While Meta has publicly stated that its AI models are trained on “large quantities” of platform data, the lawsuit asserts that this process inherently involves the extraction of biometric identifiers—specifically, the unique geometry of users’ faces—from the images provided by those users.

The NameTag Controversy: A Secret Architecture

The lawsuit draws heavily from recent investigative findings regarding NameTag, a facial recognition tool that was discovered embedded within the code of the Meta smart glasses companion application. Despite the app being downloaded over 50 million times, the feature was never formally activated for public use. However, technical analysis revealed that the underlying architecture was designed to capture real-time video, convert faces into biometric signatures, and cross-reference them against a localized database stored on the user’s device.

The complaint alleges that this database was configured to receive background updates directly from Meta’s servers, potentially populating the device with “faceprints” derived from the company’s massive library of Facebook and Instagram profile photos. This configuration suggests that Meta’s smart glasses were intended to function as real-time surveillance tools, capable of identifying individuals in the physical world through their social media footprint.

A Pattern of Legal Friction

This lawsuit is far from an isolated incident; rather, it represents the latest chapter in a long-standing conflict between Meta and privacy regulators. Meta’s history with biometric data is marked by record-breaking settlements that underscore the severity of the legal risks it faces.

In 2020, Meta reached a landmark $650 million settlement to resolve an Illinois class action lawsuit regarding its earlier "Tag Suggestions" feature, which automatically identified people in uploaded photos. Following that settlement, the company shuttered the feature and committed to deleting over one billion individual faceprints. More recently, in 2024, Meta agreed to a $1.4 billion settlement with the State of Texas, which had alleged that the company unlawfully captured and used biometric data of Texans without their consent.

The current lawsuit attempts to frame these historical violations not as errors of the past, but as a persistent corporate culture. The filing even references a controversial 2004 private chat transcript attributed to CEO Mark Zuckerberg, in which he referred to early Facebook users as “dumb f***s” for trusting him with their data. While the comment is two decades old, plaintiffs’ attorneys argue it provides essential context for a company they claim has consistently prioritized data acquisition over user privacy.

Meta’s Defense and Public Stance

In response to the filing, a Meta spokesperson issued a categorical denial, characterizing the lawsuit as meritless and a misrepresentation of the company’s AI development efforts. “We’ve been transparent about how we use people’s information to build and improve our AI products,” the statement read. “As for NameTags, nothing has shipped to consumers, and no final decision has been made on what to do here, if anything.”

Regarding the broader concerns of biometric surveillance, the spokesperson emphasized that Meta is not constructing a “universal face database.” The company has maintained that any future rollouts of such technology would be conducted with “full transparency” and a “thoughtful approach.”

Meta executives have previously defended the existence of NameTag code. CTO Andrew Bosworth, in a podcast appearance following public reports of the code’s discovery, defended the potential utility of such a feature, suggesting that the ability to recognize people a user had previously met could be a valuable consumer service. He dismissed earlier media reports regarding the secret existence of the technology as “incredibly misleading” and “absolutely dishonest,” despite the fact that independent researchers had confirmed the code was functional and embedded within the public-facing application.

Implications for the AI Industry

The outcome of this lawsuit could have profound implications for how tech companies train generative AI models. As AI systems become more dependent on high-quality visual data, the legal distinction between “training data” and “biometric harvesting” is becoming increasingly blurred.

If the court finds that the act of training an AI model on human faces constitutes the collection of biometric information, it could force a massive shift in how Meta and other tech giants operate. Such a ruling would likely necessitate a move toward strictly opt-in data policies, potentially handicapping the development of products that rely on massive datasets of human imagery.

Furthermore, the case brings the Illinois Biometric Information Privacy Act (BIPA) back to the forefront of national discourse. BIPA is considered one of the most stringent privacy laws in the United States, allowing for significant statutory damages—up to $5,000 per intentional violation. For a company with millions of users, the potential financial liability is staggering, far exceeding typical regulatory fines.

The Human Cost of Data Aggregation

The plaintiffs’ legal team, led by Justin Boley, argues that the central issue is one of bodily autonomy in the digital age. “People shouldn’t have to worry if their biometric information will be misused simply because their photographs appear on a social media platform,” Boley stated.

The inclusion of minor children in the lawsuit adds an emotional and ethical dimension to the case. For parents, the prospect that their children’s images are being used to train algorithms that could eventually identify them in public spaces represents a significant escalation in privacy concerns. The lawsuit seeks both monetary damages and, crucially, injunctive relief—a court order that would force Meta to cease the alleged collection and destroy any biometric data already derived from the class members’ images.

Looking Ahead: The Path to Trial

As the litigation moves into the discovery phase, the court will likely require Meta to produce documentation detailing the exact source of its biometric training sets. The company has thus far kept the specific data-sourcing methods for its generative models and NameTag architecture as trade secrets, citing proprietary interests.

Legal analysts suggest that the transparency Meta claims to champion will be put to the ultimate test in the coming months. If Meta is forced to reveal that it did, in fact, derive biometric signatures from private user photos to fuel its AI ambitions, it may face not only further financial penalties but a lasting loss of consumer trust.

For now, the case sits in the U.S. District Court in Chicago, acting as a barometer for the future of privacy rights. Whether this lawsuit results in a massive settlement or a precedent-setting trial, it underscores a growing public demand for accountability in an era where the boundary between a digital profile and a physical identity has effectively evaporated. As the class action expands to potentially include millions of participants, Meta finds itself at a crossroads, forced to balance its aggressive pursuit of the next generation of AI with the mounting legal and ethical requirements of the digital age.