Unlike previous lawsuits under Illinois’s Biometric Information Privacy Act (“BIPA”) that related to fingerprint time clocks or social media photo tagging, the newest BIPA lawsuits are targeting something common: a user uploading a selfie to a chatbot and asking it to make the photo look better.

On October 12, 2026, Illinois resident Scott Wilson filed a putative class action in the Northern District of Illinois against SpaceAI Corp. and SpaceXAI LLC (together, “xAI”), the companies behind Grok, a generative AI chatbot and image tool that xAI launched on X (formerly Twitter) just a few years ago.  The complaint alleges that when users ask Grok to analyze, rate, edit, or transform a photo of a face, Grok captures a scan of face geometry without the notice, written release, or retention policy that BIPA requires. 

This is not just a Grok problem.  This theory could reach any generative AI product that processes human faces.

The Claims

The plaintiff brings two claims:

• Section 15(a): xAI allegedly processed biometric data without publishing a retention schedule and destruction guidelines.  It also allegedly kept the data after its purpose was fulfilled, in stored conversation histories and, on information and belief, in model training data.

• Section 15(b): xAI allegedly collected biometric data without telling users in writing, without stating the purpose and how long the data would be kept, and without obtaining a written release.

The complaint alleges that Grok’s privacy policy does not disclose any biometric collection, contains no retention schedule or guidelines for destroying biometric data, states that xAI does not “aim” to collect sensitive personal information such as “biometric scans,” and asks users not to provide it.  The plaintiff seeks $5,000 per intentional or reckless violation, or $1,000 per negligent violation.  He seeks disgorgement and an injunction requiring xAI to delete all biometric data and adopt a BIPA-compliant retention policy.

The Theory: It Is Not the Photo, It Is What the Model Gets From It

BIPA excludes photographs from the definition of “biometric identifier.”  The complaint here, however, addresses that directly.  The plaintiff says he is not challenging xAI’s receipt of the photograph itself, but rather the separate face-specific representation that he alleges Grok derives from it.  The complaint uses Grok’s own outputs as evidence that this “scan” happens:

• “Aesthetic reports.”  Users upload a face and ask Grok to rate it.  Grok responds with assessments of facial thirds, gonial angle, ramus height, canthal tilt and symmetry, which the complaint describes as the vocabulary of craniofacial measurement.  The argument is simple: Grok can’t report the angle of your jaw without locating your jaw and measuring it.

• Edits that keep the person recognizable.  Grok can change a person’s expression, age, or facial hair while keeping them identifiable.  The complaint argues that a representation detailed enough to re-render a specific face is, by definition, a representation of that face’s geometry.

• Grok's own descriptions.  According to the complaint, Grok has told users that its edits keep a person’s identity consistent while changing only the requested features.

Importantly, the complaint cites reporting on “Project Skippy,” an internal 2025 initiative in which xAI reportedly asked employees to sign releases before their faces were recorded to train Grok.  The plaintiff’s point is that xAI knew how to get written consent for facial data and chose not to do so for users.

The Bigger Picture: AI is BIPA’s Next Frontier

This case reflects a broader shift in BIPA litigation: generative AI is becoming a main source of biometric privacy litigation.  BIPA was written for a world of fingerprint scanners and facial recognition databases.  Those were purpose-built systems, and companies knew they were collecting biometric data.  Generative AI changes that.  Today’s multimodal models take in images of human faces as an ordinary input.  They analyze, edit, animate and learn from those faces as part of everyday consumer features, often without the company ever thinking of what it’s doing as “biometric collection.”  That leaves a large and growing gap between how AI products work and how biometric privacy laws are written.  Statutory damages, fee-shifting and the class action mechanism give plaintiffs every reason to exploit that gap.  Every AI feature that touches a face is a potential claim, including virtual try-ons, avatar generators, age filters, image-to-video tools and smart glasses.  For companies building or deploying AI, biometric privacy is no longer a niche compliance issue.  It’s a frontline litigation risk. 

Key Takeaways

1. AI is now the center of biometric privacy risk.  Plaintiffs are recasting ordinary generative AI features as biometric collection.  Any project that processes human faces (or voices) should be reviewed for BIPA exposure, not just products that explicitly perform facial recognition.

2. The target is the derived representation, not the photo.  The plaintiff’s argument is that anything a model builds from a face, including internal numerical representations, can be a “scan of face geometry.”

3. Your product’s outputs can be used as evidence.  If a tool can report facial measurements or keep a face recognizable through edits, plaintiffs may argue that it must have measured that face.

4. Generic privacy policies won’t hold up.  Saying that you don’t aim to collect biometric data while offering features that can analyze faces can be used to argue recklessness.

5. Know your product and be realistic.  Understand and map what face-related representations your AI features create and how long they’re kept.  Publish a BIPA-compliant retention and destruction policy, and obtain written consent from users.