Two class action lawsuits have been submitted against Elon Musk’s SpaceXAI in Chicago on accusations claiming that Grok scans people’s faces in any photos uploaded on the platform without their permission. The court hearings will help determine if facial scans produced by AI imaging technology qualify as biometric data.
The complaint says Grok maps faces without consent
The lawsuits, filed on October 7 and 12, allege that Grok scans facial features when users upload photos for analysis or editing. Cesar Padilla, a Cook County resident, claims the system records details such as the shape and positioning of the eyes, nose, lips and jaw. He also alleges that these scans can be traced to users’ accounts, with no publicly disclosed policy explaining when the data is deleted.
Why BIPA treats a scan differently from a photo
Padilla’s lawsuits differentiate a normal picture from the facial data derived from it. The Illinois Biometric Information Privacy Act (BIPA) requires companies to give written notice, secure signed consent, and disclose how long biometric data will be stored and when it will be disposed of. Violations are punishable with damages amounting to $1,000 for negligence or $5,000 for intentional or reckless conduct. However, the state law sets a maximum limit for damages for repeated scans.
Facebook settled for $650 million; BNSF for $75 million. Google and Otter.ai face similar claims. Paul Hastings attorneys Aaron Charfoos and Michelle Reed warned in an April advisory that “a new wave of biometrics litigation has arrived.” They added: “When they are used together, these exposures compound.”
xAI is already fighting Minnesota over Grok Imagine
As per the report by Cryptopolitan, Judge Donovan Frank refused to suspend Minnesota’s law banning AI nudification tools. The law stipulates fines of as much as $500,000 for every image, while xAI still pursues an appeal. Unlike the cases in Illinois, the law in Minnesota prohibits harmful AI-generated images, instead of restricting the collection of facial data. The punishments are awarded even to the service providers who had no idea that the pictures were created without consent.
The case quotes a report estimating Grok’s production of 3 million sexual images within a mere 11 days. Approximately 23,000 of the images were thought to show children. xAI claimed to have closed 52,222 accounts and reported to the National Center for Missing and Exploited Children (NCMEC) 73,604 cases.
The EU wrote different rules for the same technology
Since August 2, 2026, obligations provided in the AI Act are being enforced by the European Commission, including chatbot disclosures, deepfake labeling, and marking content in a machine-readable format. More than 180 organizations have joined in signing this code of transparency. Developers are now bound by new rules that regulate the lawful processing of images and the attribution of altered images to its authors.
Governance spending is climbing as rules fragment
Gartner expects spending on AI governance platforms to reach $492 million in 2026 and exceed $1 billion by 2030. AI regulations could affect 75% of the world’s economies, while effective governance tools could cut regulatory costs by 20%.
Meanwhile, BCG found that nearly half of companies are seeing returns from AI. Spending has doubled to 3.3% of revenue, yet only 5% have all the necessary safeguards for autonomous AI agents. Companies are investing more in AI, but oversight has yet to catch up.
Researchers are building ways to keep faces off the server
A Purdue-led study introduces PrivateEdit, which masks identity-sensitive facial regions on-device before cloud editing and restores them locally afterward. Tests involving Gemini, Grok and LLaMA found facial-attribute inference often fell more than 50%.
For AI companies, privacy-by-design could reduce risk before courts settle the rules.
The smartest crypto minds already read our newsletter. Want in? Join them.