Meta Sued Over Instagram Photos and Face Recognition

A proposed class action accuses Meta of converting Facebook and Instagram images into biometric data used for an unreleased facial-recognition system and to train generative AI models. The case could turn on a crucial distinction in Illinois privacy law: a photograph itself is not biometric data, but a face geometry scan derived from it can be.

A photo posted to Instagram is legally still just a photograph. The harder question is what happens when software turns the face inside it into a mathematical identity. That distinction sits at the center of a new proposed class action against Meta, filed on September 4 in the US District Court for the Northern District of Illinois. Four plaintiffs from Illinois and California, including two minors, accuse the company of using images uploaded to Facebook and Instagram to develop facial-recognition technology and generative AI systems without obtaining the biometric consent they say the law requires.

The allegations have not been proven yet, and the class has not been certified. But the lawsuit brings together two disputes that have largely developed in parallel: how technology companies reuse content to train AI systems, and when analyzing a human face turns ordinary image data into legally protected biometric information. An ill-timed episode for Meta, at a time when distrust of AI and Big Tech is on the rise.

The case centers on NameTag

The most controversial technology named in the complaint is NameTag, an unreleased facial-recognition system developed for Meta’s smart glasses.

In June, WIRED reported that dormant NameTag components had been embedded in the Meta AI companion app installed on tens of millions of phones. The code was designed to take a face captured by the glasses, transform it into a biometric signature and compare that representation with stored faceprints in order to recognize a person. Meta said the feature had not been released to users and disputed suggestions that it maintained a universal centralized facial-recognition database. The company removed the main NameTag components from the app shortly after WIRED published its findings.

The new lawsuit goes a step further than the original reporting. The plaintiffs allege that Meta developed this recognition system using biometric information derived from photographs posted to Facebook and Instagram. They also allege that facial data extracted from images was used in connection with generative AI models including Emu and Muse Image.

A photograph is not automatically biometric data

Illinois Biometric Information Privacy Act, or BIPA, explicitly excludes ordinary photographs from its definition of a biometric identifier. But the same law expressly includes a scan of face geometry. It also protects information derived from a biometric identifier when that information is used to identify someone. BIPA requires private companies to tell the person in writing that the data is being collected, explain its purpose and retention period, and obtain a written release.

That makes the technical process unusually important to the legal case. If Meta merely possessed photos uploaded by users, that fact alone does not establish the BIPA claim. If, as the plaintiffs allege, Meta processed those photos into persistent faceprints or numerical representations of facial geometry used to identify individuals, the legal question becomes very different. The lawsuit also raises California privacy and right-of-publicity claims and seeks to represent a nationwide class as well as Illinois and California subclasses.

Meta has been here before

The dispute arrives with considerable history behind it. In 2021, Meta announced that Facebook would shut down its broad facial-recognition system, end automatic recognition in photos and videos, and delete more than one billion individual facial-recognition templates. At the time, the company said it wanted to move away from broad identification systems while continuing to explore narrower uses of facial recognition, particularly on personal devices.

Three years later, Meta agreed to a $1.4 billion settlement with the Texas attorney general over separate allegations that Facebook had captured biometric information without the authorization required under Texas law.

That history does not establish liability in the new case, but does explain why NameTag attracted scrutiny so quickly. Smart glasses change the setting entirely. Facial recognition on a social network analyzes an uploaded image. Facial recognition built into wearable cameras could potentially perform identification while someone is physically standing in front of the wearer. Meta says its current AI glasses use visible capture indicators and that it has designed privacy safeguards around their cameras. Its publicly released glasses do not currently offer NameTag facial identification.

The deeper fight is over what uploaded content can become

Millions of people uploaded photos to Facebook and Instagram for social purposes years before generative AI and consumer AI glasses became mainstream products. The lawsuit asks whether those images can subsequently be transformed into a different category of asset: training material for AI, numerical representations of faces, or identity infrastructure for future devices.

The plaintiffs now have to substantiate their claim that Meta crossed those lines. Until they do, Meta is facing a serious legal test over whether the enormous visual archive accumulated by social networks can also become a biometric dataset for the AI era.