Meta Sued Over Alleged Illegal Use of Facebook and Instagram Photos for AI Training and Face Recognition System

A significant legal challenge has emerged against Meta Platforms, the tech giant behind Facebook and Instagram, as a group of parents and their children from Illinois and California have filed a proposed class-action lawsuit. The suit, lodged last week in federal court in Chicago, accuses Meta of illicitly utilizing their personal photographs, uploaded to Facebook and Instagram, for two primary purposes: to develop an unreleased face-recognition system for its smart glasses, codenamed NameTag, and to train its advanced generative AI models, Emu and Muse Image.

The plaintiffs allege that Meta’s actions constitute a direct violation of both Illinois and California privacy statutes, specifically by extracting sensitive biometric information from individuals’ photos without obtaining proper notice or explicit consent. This legal contention centers on the argument that users’ images, shared within Meta’s ecosystem, were repurposed for sophisticated technological development without their knowledge or permission, leading to the unauthorized collection of their unique biometric data.

The controversy surrounding NameTag first gained public attention through a June report by WIRED, which revealed that code for the sophisticated face-recognition system had been secretly embedded within the Meta glasses AI companion application. This app, a crucial interface for Meta’s smart eyewear, had already amassed more than 50 million downloads globally. While the NameTag feature itself had not been activated for consumers, WIRED’s analysis indicated that the underlying system was fully designed to convert faces captured by the smart glasses into distinct biometric signatures. These signatures were then intended to be compared against a database of "faceprints" stored locally on the user’s phone. Crucially, this database was configured to receive regular updates directly from Meta, raising questions about the origin and management of such sensitive data. At the time of WIRED’s initial reporting, the exact source of these foundational faceprint data points remained undetermined.

The recently filed complaint sheds more light on this mystery, alleging that these faceprints were, in all likelihood, derived from existing Facebook and Instagram images. The plaintiffs cite internal reporting, including claims from Meta employees, suggesting that NameTag possessed the capability to recognize individuals through their Meta connections or public Instagram profiles. Further supporting this claim, the lawsuit references a company patent that describes a system for face matching against profile photos and other images held within Meta’s vast data repositories.

In response to WIRED’s inquiries in June regarding NameTag, Meta issued a statement asserting it was "not building a central face database." However, the company conspicuously declined to answer specific questions concerning whether NameTag would operate on an opt-in basis or how it intended to retain any collected faceprints. The current lawsuit underscores this lack of transparency, noting that Meta has yet to disclose which specific images, if any, were utilized for generating biometric data, emphasizing that such crucial information remains exclusively within the company’s possession.

Beyond the NameTag controversy, the lawsuit also targets Meta’s burgeoning image-generation AI systems. Meta has openly acknowledged that its Emu model, designed for creating AI-generated content, was trained on "large quantities of Facebook and Instagram images and text." Chris Cox, Meta’s chief product officer, famously referred to these platforms as a "data advantage" for the company’s ambitious AI initiatives. The complaint, however, argues that this training process illegally harvested biometric information belonging to individuals who appeared in the vast datasets of images. Another Meta AI product, Muse Image, which launched last summer, faced immediate backlash after it permitted users to generate images based on other people’s public Instagram accounts. This controversial feature was swiftly removed by Meta within days, with the company publicly admitting it had "missed the mark."

A Meta spokesperson, in a statement addressing the lawsuit, declared, "This lawsuit is without merit and misrepresents our work. We’ve been transparent about how we use people’s information to build and improve our AI products." Regarding NameTag specifically, the spokesperson added, "As for NameTags, nothing has shipped to consumers and no final decision has been made on what to do here, if anything. If we do decide to roll something out, we will take a thoughtful approach and do so with full transparency. One decision we can be clear about—we are not building a universal face database."

However, the plaintiffs’ legal team emphasizes the broader implications of Meta’s alleged practices. Justin Boley, a partner at Wexler Boley & Elgersma and an attorney representing the plaintiffs, stated, "People shouldn’t have to worry if their biometric information will be misused simply because their photographs appear on a social media platform." This sentiment underscores the core concern about digital privacy rights in an era of rapidly advancing artificial intelligence.

The plaintiffs named in the suit are Francisco Alvarez and his son, both residents of Illinois, alongside Jeremy Wahl, a California resident, and his 10-year-old daughter. The proposed class action, however, extends far beyond these individuals, aiming to include people in Illinois, California, and potentially across the entire United States. The criteria for inclusion encompass anyone whose images were uploaded to Facebook or Instagram, or whose images were submitted to Meta’s generative AI systems through prompts, with the timeframe dating back to September 4, 2021. The complaint estimates that the national class could potentially number in the millions, highlighting the vast scope of the alleged privacy violations.

Under the stringent provisions of Illinois’ Biometric Information Privacy Act (BIPA), a landmark law in digital privacy, the plaintiffs are seeking significant financial compensation. For each intentional or reckless violation, they demand $5,000, or actual damages if greater. For each negligent violation, they seek $1,000, or actual damages if greater. In addition to monetary relief, the lawsuit also seeks injunctive relief, which would entail a court order compelling Meta to cease certain practices. The California claims within the lawsuit seek additional damages and other forms of relief, reflecting similar legal protections against unauthorized biometric data collection in that state.

This is not Meta’s first encounter with legal repercussions concerning its handling of biometric data. The company has a well-documented history of such challenges. In 2020, Meta agreed to a substantial settlement of $650 million to resolve an Illinois class-action lawsuit over an earlier face-recognition system, which demonstrates the potent force of BIPA. Following that settlement, in November 2021, the company announced it would shut down the implicated system and delete more than a billion faceprints. More recently, in 2024, Meta agreed to pay the state of Texas $1.4 billion to settle separate allegations that it had unlawfully collected biometric data from its users, further underscoring a pattern of recurring privacy disputes across different jurisdictions.

The timeline surrounding WIRED’s June 4 report on NameTag also reveals a contentious exchange between Meta and the media. The day after the report’s publication, Meta promptly removed the NameTag code from its AI companion app. The company subsequently argued that the feature "never existed" because it had not been made available to consumers. However, WIRED’s rigorous analysis, corroborated by testing from independent researchers, found that a "technically functional face-recognition system" had indeed been shipped within an app downloaded by tens of millions of people, highlighting a crucial distinction between a feature being present in code and its active deployment to end-users.

Meta’s CTO, Andrew Bosworth, initially reacted strongly to WIRED’s reporting, publicly calling it "incredibly misleading" and "absolutely dishonest." Yet, weeks later, Bosworth himself discussed NameTag on a podcast, describing its potential functionality. He explained that the system "could recognize people that a glasses wearer had previously met and had asked the device to remember," adding that he believed it "would be a great feature." Despite this detailed description from a top executive, Meta continued to characterize NameTag as merely an exploratory concept rather than a developed product available to consumers, maintaining a narrative of ongoing research rather than active implementation.

The current complaint frames this case as part of a much longer and deeply ingrained pattern of privacy violations attributed to Meta. The lawsuit even reaches back into Facebook’s earliest days, citing a widely reported 2004 chat attributed to CEO Mark Zuckerberg, where he allegedly referred to individuals who had trusted him with their data as "dumb fucks." This historical anecdote serves to underscore the plaintiffs’ argument that a fundamental disregard for user privacy has been a consistent element of Meta’s corporate culture.

The outcome of this proposed class-action lawsuit could have far-reaching implications, not only for Meta but for the broader tech industry. It represents a critical juncture in the ongoing debate over how social media companies can leverage vast amounts of user-generated data for advanced AI development, particularly when it involves sensitive biometric information. The potential for millions of plaintiffs and significant financial penalties under robust privacy laws like BIPA underscores the high stakes involved in balancing technological innovation with individual privacy rights.