Grok Lawsuit Claims SpaceXAI Unlawfully Collects Biometric Facial Scans from Users’ Photos

New to ClassAction.org? Read our Newswire Disclaimer

A proposed class action lawsuit alleges that SpaceXAI, the artificial intelligence subsidiary of Elon Musk’s SpaceX, unlawfully collects biometric facial information from images uploaded to the generative AI chatbot Grok without providing notice or obtaining user consent.

Want to stay in the loop on class action lawsuits that matter to you? Sign up for ClassAction.org’s free weekly newsletter.

The 31-page lawsuit alleges that when a user uploads a photo of a human face to Grok, the AI model developed and operated by defendants SpaceXAI Corp. and SpaceXAI LLC, to analyze, rate, edit, transform or generate media based on the picture, the tool scans facial geometry from the underlying image without written notice or a written release from users. The case also accuses SpaceXAI of failing to publish biometric data retention and destruction policies, in violation of the Illinois Biometric Information Privacy Act (BIPA).

Under the BIPA, private entities are prohibited from collecting, storing and using Illinois residents’ sensitive biometric information without informing them in writing that their data will be collected, the filing says. In addition, entities that collect biometric information must obtain written consent and implement and publish a written data-retention and destruction policy that specifies how long the data is to be kept and for what reason, the case states.

However, the class action lawsuit accuses the defendants, formerly known as x.AI Corp. and x.AI LLC, of failing to provide Grok users with requisite notice before obtaining scans of facial geometry from photographs that may include facial proportions, symmetry, angles and spatial relationships between specific features, such as the eyes, nose, lips, and more.

The filing emphasizes that while photographs themselves are not considered biometric information, which the BIPA defines as “any information…based on an individual’s biometric identifiers used to identify an individual,” facial geometry data extracted or created from a photo is subject to the protections of the state law.

According to the complaint, xAI employees were asked for an internal project known as “Project Skippy” to execute release forms before their faces were recorded to train various Grok products. The case also claims that despite knowing that it must collect written consent before collecting facial geometry, SpaceXAI continues to flout the law’s requirements.

Further, the case says that SpaceXAI’s privacy policy fails to mention facial geometry or biometric identifiers, and does not contain any retention schedule or destruction guidelines for biometric data, even as the company continues to profit from paid subscriptions that provide access to the image-analysis and generative features that capture biometric identifiers.

Images uploaded to Grok are used to train and improve SpaceXAI’s commercial AI products unless users specifically opt out, the suit says.

The filing relays that individualized scans of facial geometry are generated within a user’s Grok account and can be tied back to the account through which the original photo was uploaded, along with identifying information about the accountholder and their conversation history.

As a result, Grok users who upload a photo of their faces and whose biometric information is collected have an increased risk of surveillance, stalking, identity theft, social engineering, and more, the lawsuit conveys.

“Defendants’ collection, capture, and retention of [plaintiff’s] biometric identifiers without the notice and written release [the] BIPA required deprived them of the opportunity to consider whether, and on what terms, to permit [SpaceXAI] to obtain their biometric data, and stripped them of control over their immutable biometric identifiers,” the lawsuit emphasizes.

The SpaceXAI class action lawsuit looks to cover all Illinois residents who, while located in the state and logged into an authenticated Grok account, uploaded to Grok a photograph depicting their own face and used Grok to analyze, rate, edit, transform, or generate content based on the face during the relevant time period.

Check out ClassAction.org’s lawsuit list for the latest open class action lawsuits and investigations.