Two proposed class actions filed in Chicago allege that Grok violates Illinois biometric-privacy law when it analyses or transforms uploaded facial photographs.
One complaint claims that generating a professional headshot or identity-preserving edit requires Grok to locate facial landmarks and create a face-specific geometric representation. It alleges this amounts to collecting biometric information without the written notice, consent, retention policy and destruction rules required by Illinois’ Biometric Information Privacy Act. The plaintiff seeks statutory damages and orders requiring deletion and compliant data practices. SpaceXAI has not responded publicly to Reuters’ reporting on the cases. The allegations have not been determined.
The legal question is consequential because photographs themselves are excluded from the Illinois statute’s definition of biometric identifiers. The claim instead targets information allegedly derived during AI processing—even where the user voluntarily uploads their own image.
For Australian providers, the cases expose a similar classification risk. OAIC guidance says facial images and biometric templates used for automated identification or verification are sensitive information, while a facial image is not biometric information in every context.
AI developers therefore need to determine and document what image-processing systems extract, why they extract it, whether it identifies an individual, how long derived data persists and what consent is obtained. Calling a feature “editing” does not settle the privacy analysis.
Sources: complaint; Reuters; OAIC guidance.
Leave a Reply