Meta is facing a major legal battle as a newly proposed class-action lawsuit accuses the tech giant of unlawfully extracting and using biometric data from users' private and public photos. The lawsuit, filed in federal court, alleges that the company violated strict privacy laws in Illinois and California by gathering this sensitive information without providing proper notice or obtaining explicit consent from the affected individuals. The legal action points to a systemic practice of harvesting personal physical characteristics to power Meta's advanced artificial intelligence and facial recognition technologies.
The NameTag Controversy and Smart Glasses
Central to the legal complaint is a controversial facial recognition feature known as NameTag. Software code for this tool was discovered secretly embedded within the companion application for Meta's smart glasses. Although this companion app had been downloaded more than 50 million times, the NameTag feature had not been officially activated for the general public. However, a detailed analysis of the application's underlying code revealed that the system was technically fully functional. It was engineered to capture human faces through the smart glasses, convert those visual images into unique biometric signatures, and then compare them against a localized database of faceprints stored directly on the user's mobile phone. This local database was configured to regularly receive automatic updates and data transfers directly from Meta's servers.
Data Sources and Meta's Defense
The origin of the biometric data used to build these faceprints remains a highly contentious point. The legal complaint alleges that these digital faceprints are likely extracted from the vast repository of photos hosted on Facebook and Instagram. To support this claim, the lawsuit points to statements made by Meta's own employees who asserted that NameTag possessed the capability to identify individuals by cross-referencing their established social connections or public Instagram accounts. Furthermore, the plaintiffs cite a patent held by Meta that outlines a technical process for matching live facial scans against profile pictures and other images stored within its social media network. In response to initial inquiries, Meta stated that it was not building a centralized facial database, but the company repeatedly declined to clarify whether NameTag would operate on an opt-in basis or explain how the system would manage and retain faceprint data over time.
Generative AI Training Under Scrutiny
Beyond facial recognition, the lawsuit targets Meta's generative artificial intelligence models, specifically focusing on its image-generation system called Emu. Meta has previously acknowledged that Emu was trained using massive datasets comprising billions of images and text captions sourced directly from Facebook and Instagram. The company's chief product officer, Chris Cox, publicly described this vast treasure trove of user-generated content as a key data advantage for Meta's developing AI infrastructure. The plaintiffs argue that this training methodology illegally harvested the biometric identities of millions of people who appeared in those uploaded images. The lawsuit also references another image-generation tool, Muse Image, which faced intense public backlash after it allowed users to generate entirely new images based on other people's public Instagram accounts. Meta quickly removed that specific capability within a few days, admitting that the feature had missed the mark.
The Plaintiffs and Financial Demands
The lawsuit has been brought forward by several individuals representing a potentially massive class of affected users. The named plaintiffs include Francisco Alvarez and his son, who are residents of Illinois, alongside Jeremy Wahl and his 10-year-old daughter, who reside in California. The proposed class action seeks to represent not only residents of these two states but also individuals across the entire United States whose photographs were uploaded to Facebook or Instagram, or whose data was processed through Meta's generative AI systems via user prompts. This proposed class covers activities dating back to September 4, 2021. Legal representatives estimate that the nationwide class of plaintiffs could easily number in the millions of internet users.
Justin Boley, a partner at Wexler Boley & Elgersma and an attorney representing the plaintiffs, emphasized the broader implications of the case, stating, "People shouldn't have to worry if their biometric information will be misused simply because their photographs appear on a social media platform."
The financial consequences for Meta could be staggering under the Biometric Information Privacy Act, commonly known as BIPA, in Illinois. Under this strict state statute, the plaintiffs are seeking statutory damages of $5,000 for each intentional or reckless violation of the law. For negligent violations, the law allows for damages of $1,000 per occurrence, or actual financial damages if they prove to be greater. The lawsuit is also seeking comprehensive injunctive relief to stop Meta's current data practices. Additional damages and legal remedies are being pursued under California's consumer protection and privacy laws. This legal challenge is part of a recurring pattern of biometric privacy disputes for the social media conglomerate. In 2020, Meta agreed to a massive $650 million settlement to resolve an Illinois class-action lawsuit centered on an earlier automatic facial-recognition system. Following that settlement, in November 2021, the company announced it would shut down its face-recognition systems entirely and delete more than one billion individual faceprints. More recently, in 2024, Meta agreed to pay a historic $1.4 billion settlement to the state of Texas to settle separate legal allegations that it had unlawfully harvested biometric data from its residents.
Corporate Denial and Historical Context
The revelation of the hidden NameTag code prompted swift actions and sharp denials from Meta's leadership. Within twenty-four hours of the technical details becoming public, Meta pushed out an update that completely removed the controversial NameTag code from its smart glasses companion app. The corporation argued that because the feature was never officially launched or made accessible to everyday consumers, the capability never truly existed. This assertion stood in stark contrast to technical analysis and independent testing by external researchers, which confirmed that a fully functional facial recognition mechanism had indeed been distributed within software downloaded by tens of millions of people. Meta CTO Andrew Bosworth reacted strongly to the initial disclosures, calling the findings incredibly misleading and absolutely dishonest. However, a few weeks later during a podcast appearance, Andrew Bosworth openly described the NameTag concept in detail. He explained that the system could identify people whom a smart-glasses wearer had previously met and had explicitly requested the device to remember, calling it a potentially great feature. The company continues to maintain that NameTag is merely an exploratory concept rather than a finalized product. The lawsuit, however, frames these recent events as part of a long-standing corporate culture that disregards user privacy. To support this narrative, the legal complaint references internal communications dating back to the very origins of Facebook in 2004, including a widely publicized chat log where CEO Mark Zuckerberg allegedly referred to the early users who trusted him with their personal information in highly derogatory terms.
