Executive Summary

Key Numbers

Four numbers. The first two are what the law charges for a single violation and the largest sum actually paid out under it. The second two are the number of suits Grok has drawn and the arithmetic the 2024 amendment changed.

Source: MediaPost, Sigma Law Group, and the text of the Illinois Biometric Information Privacy Act (740 ILCS 14).

Cesar Padilla, a Grok user living in Illinois, did nothing unusual. A selfie went up with a request for something usable as a headshot, and a few restyled images came back. That is the most ordinary use an image generation service sees. Padilla says there was no sign along the way that Grok was separately measuring the face.

On October 7, 2026 the class action went to the U.S. District Court for the Northern District of Illinois. The complaint describes Grok as having worked "by automatically locating and scanning plaintiff's face, and by extracting geometric data relating to the contours of plaintiff's face and the proportions of, and spatial relationships among, facial landmarks."

One more allegation sits next to that one. The numbers pulled out this way get tied to the user's account, and no public document says when they are deleted. Measuring a face and attaching the result to an account stand as two separate acts in the pleading, and the second runs straight into the retention and destruction clause.

The claim rests on two subsections of Section 15 of the Illinois Biometric Information Privacy Act. One requires a private entity to tell a person in writing, before collecting, that biometric data is being collected, for what purpose, and for how long it will be kept, and to obtain that person's written release. The other requires any private entity holding biometric data to maintain a publicly available written schedule for retention and destruction. Padilla asks for damages, an order stopping further collection, and destruction of what has already been gathered.

The class definition is in the pleading too. It covers every user in Illinois who uploaded a photograph of their own face to Grok and asked for that face to be analyzed, or asked for something to be generated from the photograph. The line runs along what the user requested, not along what the company stored.

The defendant's name is a little confusing. The parties named are SpaceXAI Corp. and SpaceXAI LLC. xAI, which built Grok, merged with X Corp and then moved under SpaceX, and the corporate name changed along the way while the product name Grok stayed put. So people call this a suit against Grok, while the party in court is SpaceXAI. No statement from the company had surfaced as of this writing.

Read the statute alone and the suit looks like it should fail. The Illinois Biometric Information Privacy Act, written in 2008, lists retina and iris scans, fingerprints, voiceprints, and a "scan of hand or face geometry" as the biometric identifiers it regulates. That same definition then expressly excludes photographs. The definition of biometric information works the same way, excluding information derived from anything the first definition left out. If photographs are out, surely whatever comes from a photograph is out as well.

Defendants have made exactly that argument more than once, and courts have declined it more than once. In Monroy v. Shutterfly the defendant said that excluding information derived from photographs showed the legislature meant to put all biometric data drawn from photographs outside the law. The court read the two definitions apart. Data drawn from a photograph may not be biometric information, and it can still be a biometric identifier, which is to say a scan of face geometry. In Vance v. Microsoft the court likewise set the photograph exclusion aside as beside the point, since the plaintiffs never objected to the company merely holding face photographs. Sosa v. Onfido came out the same way, allowing that data extracted from a face can amount to a scan of face geometry.

The line, then, does not fall on the image. Keeping a photograph sits outside the law, and running that photograph through a face alignment or matching algorithm sits inside it. Two companies can hold the same file, and what each one did with it decides who is liable.

Still, the line is not drawn just anywhere. A suit against X Corp was dismissed in June 2024. The target there was PhotoDNA, the technology used to detect child sexual abuse material, which turns an image into a hash value and compares it against known images. The court found the plaintiff had not alleged that the hash value was a scan of face geometry able to identify the person in the photograph. A computation that cannot pick out an individual is not a biometric identifier.

Padilla's case is not the first biometric suit Grok has drawn. A month earlier, in early September 2026, a class action under the same law was filed in the Circuit Court of Cook County in Illinois. That one is narrower, alleging that Grok collects face geometry data every time a user uploads a photograph and asks for AI image editing. It also sits in state rather than federal court. Then, five days after Padilla's filing, on October 12, one more class action over face scanning reached the same federal court. Press accounts do not name the plaintiff in that one. Three proceedings are now running against a single product.

The firm behind the Cook County suit had filed a nearly identical theory against Google in the same court a few months before, aimed at the photo editing feature in Gemini. The argument that a photo editing feature amounts to a face scan moved from Google to xAI unchanged. Another suit arrived around the same time. Alvarez v. Meta, filed on September 4 in the U.S. District Court for the Northern District of Illinois, alleges that photographs posted to Facebook and Instagram were used without consent for the face recognition feature in smart glasses and for training generative models. Within four days in the first week of September, Illinois produced two suits aimed at AI image pipelines: the Cook County case against Grok and this one against Meta.

Two things make companies treat this law as heavy. One is the money. Meta settled for $650 million. Google Photos settled for $100 million in 2022, which worked out to roughly $95 per claimant. Clearview AI gave up no money at all in its 2022 Illinois settlement, agreeing instead not to sell its face database to private companies, while a separate nationwide case produced a settlement handing the class 23 percent of the company rather than cash. That one was approved and then vacated by an appeals court in July 2026. A case that looked closed by settlement can open again. The other is the structure. This law gives individuals a private right of action, so nobody has to wait for a regulator to act.

So in 2024 the law was adjusted. Before that, collecting biometric data from the same person could be read as a separate violation each time. One employee scanning a fingerprint at the door every morning would accumulate violations, and critics pointed out that exposure on that scale could wipe out a company. The amendment collapsed violations against the same person into one and recognized electronic signatures as written consent. A ceiling was placed on the amount. The obligations did not shrink.

How a selfie turns into a headshot is no secret in the industry. First the system finds where the face is in the photograph, then it picks out dozens to hundreds of points on that face: the corner of an eye, the bridge of a nose, a jawline. Those coordinates are used to straighten and crop the face, which then goes to the generative model as a condition. The output of that second step is substantially the same kind of data the pleading describes as "the proportions of, and spatial relationships among, facial landmarks." That language translates a common preprocessing step into legal terms rather than exposing a secret technique.

Those coordinates are usually invisible to the user. They are not written to a database either. They sit in memory for the few seconds a request takes and then they are gone. So when a company says it does not build a face database, that is usually true. The open question is whether being true makes it a defense.

Padilla's complaint refuses that premise where Grok is concerned, since it alleges the extracted numbers are tied to an account and that no document says when they are deleted. If that allegation holds, how long the numbers survive never comes up. The case that has to be argued is the other one, where the allegation does not hold and a pipeline really does throw the numbers away in seconds.

The statute does not make storage a condition. The duty to give notice and obtain written consent attaches at the moment of collecting or capturing, and the duty to hold a retention and destruction policy attaches to an entity in possession of biometric data. Courts have moved the same way, saying that holding face photographs is not itself unlawful while treating the act of running those photographs through an algorithm to obtain geometric data as the problem. On the case law so far, being an intermediate output that gets discarded quickly does not by itself end the exposure.

The constraint running the other direction belongs in the same reading. As the X Corp case showed, computing something from an image does not turn all of it into a biometric identifier. Whether the result lets someone recognize an individual is the fork in the road. Whether facial landmark coordinates clear that bar will be fought out in court, and all three suits against Grok are still at the pleading stage.

This story usually gets read as Musk's AI company drawing another lawsuit. For anyone whose work is data, something else comes up first. It is a story about what we count as data when we build a data inventory.

Most data inventories record what came in and what was kept. The files a user uploaded, the columns that went into a table, the objects piling up in object storage all make the list. Feature values, embeddings and landmark coordinates that appear mid-process and then disappear usually do not, because they get treated as part of a computation rather than as data. An item that is plainly visible in the code ends up missing from the inventory.

These suits assert that the intermediate output is exactly what the law regulates. The unit of liability becomes whether it was computed, not whether it was stored or shown to the user. Whether courts carry that argument all the way is still unknown. That several rulings already lean toward carrying it is a matter of record.

So there are three things worth confirming before anything goes wrong. First, do the derived data your pipeline produces mid-process have names of their own in the data inventory and the lineage documents. Second, if even one feature takes an input that can identify a person, such as a face or a voice, is there a document that explains to legal what that feature computes along the way. Third, does your consent language stop at 'you upload a photograph' without saying 'we calculate the measurements of the face in that photograph'.

Korea is worth a line here as well. The Personal Information Protection Act treats physical, physiological and behavioral characteristic data produced by technical means for the purpose of identifying an individual as sensitive information requiring separate consent. How the phrase 'for the purpose of identifying an individual' applies to an image editing feature is its own question. Korea does not have the Illinois structure, where a fixed amount per violation sits alongside an individual's ability to go straight to a class action.

Thank you for reading this far. If you build a service that handles images or voice, it may be worth reading out loud, once today, the names of the things your pipeline produces in its middle steps. If those names are not in your data inventory, that is the whole of what this article has to say. We would be glad to hear how your own inventory writes down derived data.

News Coverage

• 1.Davis, W. (2026, October 9). "Grok Sued Over Biometric Privacy." MediaPost.
• 2.Wayas, I. (2026, October 13). "SpaceXAI faces two Illinois lawsuits over Grok's facial analysis." Cryptopolitan.

Law Firm Analysis

• 3.Sigma Law Group. (2026, September 9). "Two BIPA Suits in Four Days Put AI Training on Uploaded Photos in the Crosshairs." Sigma Law Group.

Precedent & Settlement Record

• 4.American Civil Liberties Union. (2022, May 11). "ACLU v. Clearview AI." ACLU.
• 5.Recording Law Editorial Team. (2026, July 15). "Clearview AI Settlement Vacated by Seventh Circuit, Sent Back to District Court." RecordingLaw.com.

Statute

• 6.Illinois General Assembly. (2008). Biometric Information Privacy Act, 740 ILCS 14.