What happened
Recent class action lawsuits have been filed against Grok, a platform, alleging violations of the Illinois Biometric Information Privacy Act (BIPA) arising from the processing of user-uploaded photographs. The lawsuits claim that the platform analyzed or extracted facial geometry from the photographs to generate AI-generated images without providing the required disclosures, obtaining written releases, or maintaining publicly available retention and destruction policies.
The lawsuits were filed in the U.S. District Court for the Northern District of Illinois in October 2026.
The complaints reportedly involve consumers who uploaded personal photographs and requested AI-generated images, including professional headshots and stylized portraits.
The plaintiffs contend that the alleged processing constitutes the collection of biometric identifiers or biometric information, even though the original photographs themselves fall within a statutory exclusion.
The lawsuits remain in their early stages, and the allegations have not been established.
The litigation highlights an emerging area of risk for organizations developing, licensing, or incorporating applications into their operations.
Source details: natlawreview.com
Why it matters
The lawsuits highlight an emerging area of risk for organizations developing, licensing, or incorporating applications into their operations. BIPA imposes specific obligations on private entities that collect, capture, purchase, receive through trade, or otherwise obtain biometric identifiers or biometric information. The statute identifies a 'scan of hand or face geometry' as a biometric identifier but excludes photographs from that definition.
BIPA imposes specific obligations on private entities that collect, capture, purchase, receive through trade, or otherwise obtain biometric identifiers or biometric information.
The statute identifies a 'scan of hand or face geometry' as a biometric identifier but excludes photographs from that definition.
A business may reasonably understand that collecting a customer's photograph does not, by itself, constitute collecting a biometric identifier under BIPA.
However, the legal analysis may change when software processes that photograph to extract facial measurements or other information that qualifies as biometric data.
The emerging litigation instead focuses attention on what happens to the photograph after it is uploaded, including what information is derived from the image, how that information is used, and whether it is retained or disclosed.
Interactive Mechanism: How It Actually Works
Explore the underlying technology behind this development interactively.
crm_get_transaction(id='4092').Why can ethical evaluation not be reduced to one model score?
What to watch next
Businesses using or evaluating AI-powered image technologies should consider the following proactive measures to identify compliance gaps before they become the subject of litigation.
Businesses should consider whether their agreements and due diligence processes adequately address the collection, use, and retention of biometric data.
They should also evaluate potential privacy obligations when using or evaluating AI-powered image technologies.
Businesses should consider the following proactive measures to identify compliance gaps before they become the subject of litigation.
These steps may help organizations identify compliance gaps before they become the subject of litigation.
The outcome of these cases could help clarify the circumstances under which image processing constitutes biometric collection.