Grok users in US sue xAI over face scanning in selfies

Two residents of the US state of Illinois filed proposed class actions in October 2026 against xAI, the company behind the Grok chatbot. They allege that Grok scans faces in images users upload themselves, without asking permission first. Everything below is the plaintiffs' allegations. None of the sources contains a court ruling or a response from xAI.

What is alleged?

One case was filed by Scott Wilson on October 12, 2026, in the federal court for the Northern District of Illinois. According to Wilson, Grok captures facial geometry when users upload selfies to have them analyzed, edited or rated. He says this happens without the information, written consent and retention policy required by the Illinois law BIPA. BIPA is a biometric data law, covering information about physical traits that can be used to identify a person.

As evidence, the lawsuit points to, among other things, Grok's face reports with measurements such as gonial angle, ramus height and canthal tilt, to edits that preserve a face's identity, and to an internal training project, "Project Skippy," in which employees were required to give consent.

A second case, Padilla v. SpaceXAI Corp., was filed on October 7, 2026, with similar allegations. It claims that xAI measures facial proportions, symmetry and angles, that the privacy policy does not mention biometric collection, and that the scans are linked to user accounts. The sources give different case names and numbers, so there may be several parallel cases.

The core of the argument

BIPA excludes photographs. However, the plaintiffs in the Wilson case argue that the facial representations AI models derive from images are separate biometric identifiers. This is the plaintiff's argument as relayed by the law firm Freeborn, and it has not been tested in court.

Wilson is seeking damages at the statute's rates: $5,000 per intentional or reckless violation and $1,000 per negligent violation. It is unclear whether the amount sought in the Padilla case is the same.

Not the first time

In February 2023, a similar case was filed against Prisma Labs, which makes the Lensa app and its "Magic Avatars" feature, where users uploaded 8-20 selfies. The plaintiffs argued that the privacy policy did not disclose the collection of facial geometry and implied that the data was anonymized and stayed on the device. The outcome of that case is not stated in the sources.

Advice for companies

The law firm Freeborn recommends that companies review all AI features that process faces, map the internal facial representations and how long they are stored, publish retention and deletion policies, obtain explicit written consent and avoid blanket privacy disclaimers that conflict with how the feature actually works.