Face scanning in AI chatbots: New lawsuits in the US target Grok and Gemini

When you upload a selfie to an AI chatbot and ask it to edit the image, does it also store a kind of digital imprint of your face? That question is now at the heart of two lawsuits in the state of Illinois.

The case against Grok

On October 12, 2026, Scott Wilson filed a proposed class action in the federal district court for the Northern District of Illinois. It targets SpaceAI Corp. and SpaceXAI LLC (xAI), the companies behind the AI tool Grok.

The lawsuit alleges that Grok captures a scan of face geometry when users ask the tool to analyze, rate, edit or transform a face photo. According to the plaintiff, this happens without the notice, written release and retention policy required by Illinois' Biometric Information Privacy Act, BIPA.

The theory does not target the photograph itself, which the law excludes. It targets a separate face representation that the AI derives, for example measurements of jaw angles and symmetry. It also covers data in chat history and model training.

The claims are made under BIPA Section 15(a), on the lack of a published retention and destruction policy, and 15(b), on collection without written notice, purpose, retention period and written consent. The law provides for $1,000 per negligent violation and $5,000 per intentional or reckless violation. The plaintiff is seeking, among other things, disgorgement of profits, an injunction ordering deletion of all biometric data, and a retention policy that complies with the law.

Gemini and Lensa

Another class action in Illinois alleges that Google has scanned faces in photos uploaded to Gemini for editing. The plaintiff, John Adams, says that in late 2025 he uploaded a close-up of his face and asked for edits. The lawsuit argues that Google did not obtain his written consent before the scan, even though he voluntarily uploaded the image. According to Legal Newsline, Google had not responded in court. The court and filing date are not stated in the sources.

The theory is not entirely new. In 2023, Prisma Labs, the company behind the Lensa app, was sued in California. The plaintiffs alleged that the company collected the face geometry of Illinois users through its Magic Avatars feature without consent and used it to train neural networks. They also claimed that Lensa's privacy policy in December 2022 did not disclose that face geometry would be collected. The outcome of the case is not stated in the sources.

Assessments and advice

Biometric Update wrote in January 2026 about Grok's image processing. In that piece, Graeme Whiles of the consultancy Captain Compliance called it mass processing of biometric data without consent on an industrial scale and a biometric data processing crisis, with minors among the victims. That is his assessment. According to the Captain Compliance blog post cited by Biometric Update, a researcher recorded roughly 6,700 sexually suggestive images per hour generated by Grok, and the blog post extrapolates that to more than 160,000 instances of biometric data processing per day.

The same January 2026 article states that Malaysia and Indonesia have banned Grok and that the UK's Ofcom demanded action. This predates and is independent of the Illinois lawsuits. The article does not describe a specific lawsuit, but points out that BIPA's private right of action could provide grounds for class actions.

In a law firm blog post about the Wilson case, the advice to companies is that they should review all AI features that process faces, map which face data is created and how long it is stored, publish a retention and destruction policy, and obtain written consent before data is collected.

All claims in the lawsuits are allegations by the plaintiffs, and neither case has been decided.