Meta Faces New Privacy Lawsuit Over AI Training and Hidden Face-Recognition Work

Meta is being sued by parents and children in Illinois and California who say the company secretly used their Facebook and Instagram photos to train artificial intelligence systems and an unreleased face-recognition feature for smart glasses. The proposed class action, filed in federal court in Chicago, could affect millions of people and raises fresh questions about how Meta gathered biometric data for its AI products.

The lawsuit claims Meta collected face-based identifiers without meaningful notice or consent, violating Illinois and California privacy laws. It also says the company’s image-generation tools were trained on user photos in ways that captured biometric information from people who appeared in those images.

What the lawsuit says Meta did

The complaint alleges that Meta extracted biometric information from photos posted to Facebook and Instagram and used it in two separate ways: to support an internal face-recognition project called NameTag and to train generative AI systems, including Emu and Muse Image.

According to the plaintiffs, this was done without asking for permission from the people in the images or explaining how that information would be stored, shared, or used. The case argues that the company turned ordinary social media photos into a source of facial data at scale.

How NameTag is at the center of the case

NameTag is an unreleased face-recognition feature that WIRED reported in June was hidden in Meta’s AI companion app for smart glasses. The app had already been downloaded more than 50 million times, and while NameTag was not turned on for users, researchers found code suggesting the system could identify faces seen by the glasses and match them to faceprints stored on a phone.

Those faceprints were designed to update from Meta’s servers, but at the time it was unclear where the underlying data originated. The new lawsuit argues that the most likely source was photos already held by Meta through Facebook and Instagram.

The complaint points to internal claims attributed to Meta employees, as well as a company patent describing face matching against profile images and other photos stored by the company. Taken together, the plaintiffs say, these details support the inference that Meta built a biometric identity system using its social networks as a data pipeline.

“People shouldn’t have to worry if their biometric information will be misused simply because their photographs appear on a social media platform,” said Justin Boley, a partner at Wexler Boley & Elgersma and one of the attorneys representing the plaintiffs.

What Meta has said about NameTag

Meta has denied that it is creating a central face database and says no consumer product has been released. In a statement to WIRED, the company said the lawsuit “is without merit” and argued that it had been transparent about how it uses data to improve its AI products.

The company also said that no final decision has been made on NameTag and that, if anything is ever launched, it would be done carefully and openly. Meta reiterated that it is not building a universal face database.

That response did not satisfy the plaintiffs, who say the company has not disclosed which images, if any, were used to derive biometric data. The lawsuit argues that Meta is uniquely positioned to know the answer and has kept that information to itself.

Why the AI training allegations matter

The case is not limited to glasses and face recognition. It also targets Meta’s generative AI training pipeline, especially the company’s use of photos and text from Facebook and Instagram to build Emu, one of its image-generation systems.

Meta has previously described those platforms as a key “data advantage” for its AI development, according to remarks by chief product officer Chris Cox. The plaintiffs say that advantage came with a legal cost because the training process allegedly collected biometric data from people whose faces appeared in the source material.

Muse Image, another Meta image-generation product released this summer, is also named in the suit. The tool drew criticism after users were able to generate images based on other people’s public Instagram accounts, a feature Meta later removed within days after saying it had missed the mark.

From the plaintiffs’ perspective, these products are part of the same pattern: Meta using enormous volumes of user-generated content to improve its AI systems without providing a clear opt-out or a meaningful explanation of what was being extracted from each image.

Who is suing Meta?

The named plaintiffs are Francisco Alvarez and his son, both residents of Illinois, and Jeremy Wahl, a California resident, along with his 10-year-old daughter. They are asking the court to let the case proceed as a class action on behalf of people in Illinois, California, and across the United States.

According to the complaint, the proposed class includes people whose photos were uploaded to Facebook or Instagram, as well as those who submitted prompts to Meta’s generative AI systems. The lawsuit says the class could reach into the millions.

Because biometric privacy laws vary by state, the complaint relies heavily on Illinois and California statutes, while also seeking relief for a broader national class based on the company’s alleged conduct.

How much money could be at stake?

The financial exposure could be enormous if the case survives and the plaintiffs prevail. Under Illinois’ Biometric Information Privacy Act, the complaint seeks $5,000 for each intentional or reckless violation, or actual damages if those are greater. For negligent violations, it seeks $1,000 per violation, again or actual damages if higher.

Those penalties can add up quickly in biometric class actions because each face scan, each image, or each affected person may be treated as a separate violation. The complaint also seeks injunctive relief, which would force Meta to change how it handles facial data if the court agrees with the plaintiffs.

California law could add further damages and remedies, though the exact amount would depend on how the court interprets the facts and the applicable statutes.

How does this connect to Meta’s earlier biometric cases?

The new complaint lands against a backdrop of previous legal trouble over face recognition and biometric data. Meta paid $650 million in 2020 to settle an Illinois class action over its earlier face-recognition system. A year later, in 2021, the company announced that it would shut down that system and delete more than one billion faceprints.

More recently, in 2024, Meta agreed to pay Texas $1.4 billion to settle allegations that it unlawfully collected biometric data from users. That history gives the new lawsuit added weight, because it suggests the latest claims are not isolated allegations but part of a continuing dispute over the company’s data practices.

Biometric privacy has become one of the biggest legal pressure points for AI companies, especially when their products rely on massive social graphs, photographs, and user-generated content. Meta’s scale makes those concerns much larger.

Why Illinois matters so much

Illinois matters because its biometric privacy law is one of the strongest in the United States. The state allows individuals to sue when a company allegedly collects biometric identifiers, such as faceprints, without notice and informed consent.

That legal structure has made Illinois a magnet for class actions involving face recognition, photo tagging, and voice data. For companies like Meta, even experimental features can become legal liabilities if plaintiffs can plausibly argue that biometric information was processed without authorization.

What changed after WIRED’s June report?

The lawsuit relies heavily on reporting that surfaced earlier this year. In June, WIRED reported that hidden NameTag code had been embedded in Meta’s smart glasses companion app. The day after that report, Meta removed the code from the app.

Meta argued at the time that NameTag never truly existed because the feature was not available to consumers. But outside researchers found that the code appeared technically functional, suggesting the company had built a working face-recognition system inside software already distributed to tens of millions of users.

That distinction matters. Even if Meta never switched NameTag on for users, the company may still have developed and distributed biometric tools in a way that could trigger legal obligations under privacy law.

What Bosworth said later

After the report, Meta CTO Andrew Bosworth criticized the coverage as deeply misleading and untrue. Weeks later, however, he described NameTag on a podcast as a feature that could help glasses identify people the wearer had met before and asked the device to remember.

Bosworth said it would be a useful capability, reinforcing the impression that Meta had been actively exploring the idea even if it had not launched it. That tension between internal development and public denial is now one of the central issues in the lawsuit.

Meta said the lawsuit distorts its work and that it has been clear about how it uses data to improve AI products. The company also maintained that it is not building a universal face database and that no consumer version of NameTag has been released.

What evidence does the complaint rely on?

The complaint is built from a mix of public reporting, corporate disclosures, patent references, and what the plaintiffs say they can reasonably infer from Meta’s own products. In other words, it is not based on one leaked document but on several strands of evidence that, taken together, suggest a broader system of biometric collection.

The plaintiffs cite:

• WIRED’s June reporting on the hidden NameTag code
• Meta’s public comments on training Emu using Facebook and Instagram data
• Descriptions of NameTag’s technical design, including faceprints and device-level updates
• A patent that appears to describe face matching using profile photos and other company-held images
• Criticism surrounding Muse Image and its use of public Instagram accounts

The company’s refusal to answer detailed questions about how faceprints were created leaves a major factual gap, and the lawsuit attempts to fill that gap with circumstantial evidence.

Why the case could matter beyond Meta

The suit could have implications well beyond one company. If the plaintiffs succeed, the case may reinforce a legal standard that treats facial data embedded in ordinary photos as protected biometric information, even when the images are already public or posted on social media.

That would make life more complicated for tech companies building AI systems from large photo libraries, especially those experimenting with smart glasses, identity recognition, and personalization features that depend on visual memory.

It would also raise the stakes for any company that trains generative models on user content while assuming that public visibility equals legal permission. Courts have increasingly been asked to decide whether AI training turns ordinary content into sensitive data.

What companies are watching

Several categories of companies are likely paying close attention:

1. Social platforms that hold massive archives of user photos and videos
2. AI startups training models on consumer-generated images
3. Wearable-device makers building camera-based assistants
4. Advertisers and analytics firms using face-related signals for targeting

If courts draw a stricter line around biometric extraction, those businesses may need to revisit how they collect data, document consent, and explain model training practices to users and regulators.

What happens next?

The immediate next step is procedural: Meta will likely seek to dismiss the case or narrow its scope, while the plaintiffs will push to have the class action certified. That battle could take months or longer.

If the court allows discovery, plaintiffs could try to force Meta to disclose information about how NameTag was built, what photos were used, how faceprints were generated, and whether biometric identifiers were retained or synchronized across devices. Those records could become the most important evidence in the case.

Even if the lawsuit does not end in a major judgment, the discovery process itself could reveal how far Meta went in developing face-recognition tools and how closely that work was tied to its social-media data.

Timeline of the Meta biometric dispute

The latest lawsuit fits into a long-running sequence of investigations, settlements, product changes, and public disputes over biometric data. The timeline below highlights the key moments referenced in the complaint and related reporting.

What the complaint is really testing

At its core, the case asks whether a company can use people’s photos to improve AI systems when those people never consented to biometric analysis. It also asks whether a hidden or unreleased feature can still create legal exposure if the underlying code and data pipeline are already in place.

For Meta, the stakes are not only financial but strategic. The company has been betting heavily on AI across social apps, wearables, and image generation. Any court ruling that limits how it can use its massive content reservoir would affect how it builds future products.

For users, the suit is another reminder that photos shared online may contain far more than a visible image. In the age of AI, they can become raw material for recognition systems, model training, and data products that outlive the original post.

Whether the plaintiffs can prove that Meta crossed the legal line will depend on discovery, technical evidence, and how the courts interpret biometric privacy law. But the lawsuit has already put a spotlight back on one of the most persistent questions in consumer AI: when does a photo stop being a post and start becoming a faceprint?