Two proposed class-action lawsuits against Elon Musk’s SpaceXAI have brought renewed attention to the privacy risks surrounding artificial intelligence, alleging that its Grok platform handled facial images in violation of Illinois’ strict biometric privacy law.
Filed in federal court in Chicago, the complaints accuse the company, previously known as xAI, of collecting and using biometric information from uploaded selfie photographs without providing the required written notice. One of the lawsuits was filed on Monday.
At the centre of the dispute is Grok’s ability to analyse faces and manipulate images while potentially preserving a person’s identity. The complaints argue that such processing can trigger obligations under the Illinois Biometric Information Privacy Act (BIPA), even when users upload photographs of themselves.
SpaceXAI had not immediately responded to a request for comment.
AI companies face growing privacy challenges
The cases add to a widening wave of litigation examining how artificial intelligence companies collect, process and use sensitive personal information. Facial data and voiceprints have become particular areas of concern as developers expand the capabilities of their platforms.
Illinois’ BIPA imposes strict requirements on businesses that collect or use biometric identifiers, including fingerprints and retinal scans. Companies can face substantial financial exposure if they fail to comply with the law, which has generated years of litigation across multiple industries.
The consequences can be significant. Facebook agreed in 2020 to pay $650 million to settle class-action allegations involving its handling of biometric information. BNSF Railway later agreed to a $75 million settlement in a separate case concerning alleged violations of the same law.
AI developers are now increasingly finding themselves in the crosshairs of similar claims.
Voice technology also draws legal challenges
Google and Otter.ai are among the companies facing allegations linked to the collection and use of biometric information.
In May, a group of journalists filed a proposed class action against Google, alleging that the company used recordings of their voices to train artificial intelligence models without complying with Illinois law. Google has denied the allegations and sought dismissal, arguing that the complaint failed to establish that it had obtained biometric voice identifiers tied to specific individuals.
Otter.ai is facing separate litigation over its handling of recorded conversations. The claims, consolidated in federal court in California, allege that the company collected and generated voiceprints associated with speakers without meeting BIPA’s requirements. Otter.ai has denied the allegations and asked the court to dismiss the cases.
The disputes illustrate how biometric privacy rules, originally enacted before the current AI boom, are increasingly being applied to newer technologies.
Consent becomes a central question
The complaints against SpaceXAI contend that Grok’s facial analysis and identity-preserving image manipulation can fall within the scope of Illinois’ biometric protections. According to the plaintiffs, processing a photograph without obtaining the required consent and providing appropriate notice may violate the statute.
The broader question is whether companies developing increasingly sophisticated AI tools can collect and process biometric information without exposing themselves to legal claims over how that data is obtained and used.
As facial recognition and image-generation capabilities become more advanced, the legal boundaries around personal data are likely to face further scrutiny. For AI companies, the lawsuits serve as another warning that technological innovation does not remove the obligation to comply with privacy laws.
