Meta Faces Federal Class Action Lawsuit Over Alleged Unauthorized Biometric Data Harvesting for Generative AI and Smart Glasses

A group of parents and their children from Illinois and California have initiated a significant federal class-action lawsuit in Chicago, accusing Meta Platforms Inc. of orchestrating an expansive, unauthorized campaign to harvest biometric information from millions of Facebook and Instagram users. The plaintiffs allege that the social media giant surreptitiously utilized private photos and videos to train its generative AI models, such as Emu and Muse Image, while simultaneously developing a controversial facial recognition system known as NameTag, intended for use with its line of smart glasses.

The core of the legal complaint centers on the unauthorized extraction of biometric data—specifically unique facial geometries or "faceprints"—from uploaded media. The lawsuit posits that these actions represent a direct violation of both the Illinois Biometric Information Privacy Act (BIPA) and various California privacy statutes, which mandate stringent notification and consent requirements for the collection of sensitive biological identifiers.

The Emergence of NameTag and Surveillance Concerns

The controversy surrounding NameTag first surfaced in June 2024, when a technical analysis revealed that code for a facial recognition system had been embedded within the Meta AI companion app. Despite being dormant for end-users, the software had been distributed to over 50 million devices. The code was designed to interface with Meta’s smart glasses, enabling the hardware to capture a person’s face, convert that image into a digital biometric signature, and compare it against a database of faceprints stored locally on the user’s smartphone.

While Meta has consistently maintained that it is not constructing a "universal face database," the plaintiffs argue that the technical architecture of the NameTag system strongly suggests otherwise. According to the court filing, internal company patents and statements from Meta employees indicate that the system was built to cross-reference captured images against the vast repository of images already held by Meta, including those found on public Instagram accounts and through the company’s internal social graph.

A Chronology of Conflict

The legal history between Meta and privacy regulators regarding biometric data is extensive, suggesting that the current lawsuit is the latest chapter in a long-standing tension between the company’s data-hungry business model and consumer privacy rights.

• 2004–2010: The formative years of Facebook, during which the company established its data collection infrastructure. The current lawsuit references early internal communications attributed to CEO Mark Zuckerberg, framing them as evidence of a systemic, long-term disregard for user trust.
• 2020: Meta agreed to a landmark $650 million settlement to resolve a BIPA-related class-action lawsuit in Illinois regarding its previous "Tag Suggestions" feature.
• November 2021: Following increased regulatory pressure, Meta announced the shutdown of its facial recognition system and committed to deleting over one billion individual faceprints.
• June 4, 2024: A report revealed the existence of NameTag code within the Meta AI app.
• June 5, 2024: Meta removed the code from the app, labeling the reporting as "misleading" and asserting the feature was never functional for consumers.
• July 2024: Meta CTO Andrew Bosworth addressed the controversy on a podcast, characterizing NameTag as a potentially beneficial feature for recognizing acquaintances rather than a surveillance tool.
• September 2024: The filing of the current federal class-action lawsuit by residents of Illinois and California.

Data Advantage or Data Exploitation?

Meta’s business model relies heavily on the massive ingestion of user-generated content. Chief Product Officer Chris Cox has previously described the immense library of Facebook and Instagram photos as a "data advantage" for the company’s artificial intelligence development. This sentiment is echoed in the plaintiffs’ complaint, which argues that Meta’s generative AI systems—specifically Emu—were trained on user content without regard for the biometric data embedded within those files.

The Muse Image tool, which allows users to generate AI-based imagery, faced significant backlash shortly after its release when it was discovered that users could generate images based on the public Instagram profiles of others. Although Meta removed the feature within days, characterizing it as a mistake that "missed the mark," the incident solidified concerns that Meta’s AI development process prioritizes rapid deployment over the protection of individual identities.

Official Responses and Legal Defense

In response to the lawsuit, a spokesperson for Meta issued a statement defending the company’s practices: "This lawsuit is without merit and misrepresents our work. We’ve been transparent about how we use people’s information to build and improve our AI products. As for NameTag, nothing has shipped to consumers and no final decision has been made on what to do here, if anything."

The spokesperson further emphasized that the company is "not building a universal face database" and promised that if any such feature were to be released, it would be done with "full transparency."

Conversely, Justin Boley, an attorney representing the plaintiffs, stated, "People shouldn’t have to worry if their biometric information will be misused simply because their photographs appear on a social media platform." The legal team argues that the mere potential for such technology to exist creates a state of perpetual surveillance for the average citizen.

Implications for the AI Industry

The legal implications of this case extend far beyond Meta. If the plaintiffs successfully argue that training AI models on biometric data without explicit consent constitutes a violation of state privacy laws, the decision could set a restrictive precedent for the entire generative AI industry. Currently, most AI developers operate under the assumption that scraping publicly available internet data is fair game. A ruling that classifies biometric extraction as a protected activity could force tech companies to fundamentally alter their data acquisition pipelines.

Furthermore, the scale of the proposed class—potentially reaching millions of individuals—raises questions about the financial viability of such data practices. Under Illinois law, which is among the strictest in the nation, companies can be held liable for $5,000 per intentional or reckless violation of BIPA. Even a fraction of that amount, when multiplied by millions of users, represents an existential financial threat to any corporation.

The Future of Biometric Privacy

The lawsuit also highlights the shifting technological landscape. As smart glasses and wearable AI become more prevalent, the boundary between "public observation" and "biometric identification" is blurring. The plaintiffs argue that whereas a person might expect to be seen in public, they do not expect their physical features to be instantaneously converted into a unique digital identifier that can be used to track their identity across databases.

The defense strategy, which relies on the argument that the feature was never "shipped" or enabled for public use, will likely be tested by forensic evidence. The plaintiffs contend that the mere presence of the code in millions of devices constitutes a form of negligent data handling, regardless of whether the system was fully activated.

Conclusion

As the court processes this litigation, the broader technology sector will be watching closely. The case serves as a high-stakes litmus test for how courts will balance the rapid pace of innovation against the fundamental rights of individuals to control their own biometric identities. Whether the case results in a massive settlement similar to previous BIPA outcomes or establishes new legal definitions for "biometric extraction" in the age of AI, the proceedings will undoubtedly influence the future of how artificial intelligence interacts with the human face. The plaintiffs, including Francisco Alvarez and Jeremy Wahl, represent a growing segment of the public that is increasingly unwilling to accept the "black box" nature of modern data processing, signaling a new era of accountability for tech giants.