Meta Sued for Using Facebook and Instagram Photos to Train AI and Face-Recognition

A group of parents and children from Illinois and California filed a proposed federal class action in Chicago last week, accusing Meta of illegally extracting biometric data from Facebook and Instagram photos to build NameTag, an unreleased face-recognition system for its smart glasses, and to train generative AI models Emu and Muse Image. The complaint alleges violations of Illinois and California privacy laws, seeks up to $5,000 per intentional violation under Illinois' Biometric Information Privacy Act, and estimates the national class could run into the millions of people.

What happened

Detail	Fact
Filed	Last week, federal court in Chicago
Plaintiffs	Francisco Alvarez and son (Illinois), Jeremy Wahl and his 10-year-old daughter (California)
Systems named	NameTag (face recognition), Emu, Muse Image (generative AI)
Class start date	September 4, 2021
Illinois damages sought	$5,000 per intentional/reckless violation; $1,000 per negligent violation
Prior Illinois settlement	$650 million (2020)
Prior Texas settlement	$1.4 billion (2024)

The lawsuit targets two distinct products. First, NameTag: WIRED reported on June 4 that code for the system had been secretly embedded inside Meta’s glasses AI companion app, which had been downloaded more than 50 million times. The code was designed to convert faces captured by the glasses into biometric signatures and compare them against faceprints stored in a database on the user’s device. That database was configured to receive updates from Meta.

The complaint argues those faceprints likely come from Facebook and Instagram photos, citing statements from Meta employees that NameTag could identify people through Meta social connections or public Instagram accounts, plus a company patent describing face matching against profile images held by Meta.

Second, the suit targets Meta’s image-generation systems. Meta’s chief product officer Chris Cox publicly called Facebook and Instagram a “data advantage” for training Emu. The complaint argues that pulling faces from those training images amounts to illegal biometric harvesting. Muse Image, released this past summer, drew criticism for briefly allowing users to generate images based on other people’s public Instagram accounts. Meta removed that feature within days, saying it had “missed the mark.”

What Meta says

A Meta spokesperson called the lawsuit “without merit” and said the company has been “transparent about how we use people’s information to build and improve our AI products.” On NameTag specifically, the spokesperson said nothing has shipped to consumers and no final decision has been made. “If we do decide to roll something out, we will take a thoughtful approach and do so with full transparency,” the statement reads. “We are not building a universal face database.”

Meta removed the NameTag code from its app on June 5, the day after WIRED’s report. Meta CTO Andrew Bosworth called that reporting “incredibly misleading” and “absolutely dishonest.” Weeks later, Bosworth described NameTag on a podcast as a feature that could recognize people a glasses wearer had previously met and asked the device to remember, adding: “I think [it] would be a great feature.”

Why it matters

This case sits inside a well-established legal pattern. Meta settled an Illinois biometric class action for $650 million in 2020, shut down that earlier face-recognition system in November 2021, and deleted more than a billion faceprints. In 2024 it paid Texas $1.4 billion over separate unlawful biometric data collection claims. A third major settlement would signal that the company’s legal exposure on biometric data has not gone away, even as it builds more capable AI systems on the same user-generated content.

The scope is also broad. The proposed class covers anyone in Illinois, California, or across the United States whose images were uploaded to Facebook or Instagram, or submitted to Meta’s generative AI systems through prompts, going back to September 4, 2021. “People shouldn’t have to worry if their biometric information will be misused simply because their photographs appear on a social media platform,” said Justin Boley, a partner at Wexler Boley and Elgersma and an attorney for the plaintiffs.

For businesses using Meta’s AI tools or advertising on its platforms, this is worth watching. Regulatory or court-ordered restrictions on how Meta can use social-media imagery could affect model quality, feature availability, and ad-targeting capabilities. If you rely on Meta advertising for lead generation, any platform disruption driven by litigation is worth factoring into your contingency planning.

Our take

The legal exposure here is real, not theoretical. Two prior settlements totaling over $2 billion prove that Illinois and Texas courts are willing to impose meaningful consequences. What’s new is the generative AI angle: this is one of the first major suits to argue that training image models on user photos constitutes biometric data harvesting, not just a terms-of-service dispute. If that argument gets traction, it could reshape how every major AI lab thinks about training data sourcing.

The NameTag timeline is also telling. Code shipping inside an app with 50 million downloads, with a database configured to receive remote updates, is not an “experiment.” Calling it one after the fact is exactly the kind of post-hoc framing that juries tend to dislike. Meta’s 2004 Zuckerberg chat quote, which the complaint includes for context, will not help in front of a judge either.

For anyone building AI products that process images of real people, this case is a useful reminder: consent and transparency are not optional extras. The consequences of treating AI as a lawless space keep getting more expensive. If you are exploring AI integration for your own business, make sure the data you train on or pass to models is either public-domain, licensed, or collected with explicit consent.

What to do about it

1. Audit any AI tools you use that process photos of customers or employees. Confirm what data those vendors retain and how.
2. Check whether your business falls inside the proposed class period (from September 4, 2021 onward) if you submitted images to Meta’s generative AI systems.
3. Review your own privacy policy if you collect user photos. Illinois BIPA and California privacy law both set a high bar for consent.
4. Watch this case for rulings on the generative AI training angle. A ruling that training on social-media images equals biometric harvesting would affect far more than Meta.

The safest posture right now: treat any image of a real person as biometric-adjacent data and get explicit consent before it goes anywhere near a model.

Source: WIRED · AI