In October 2026, SpaceXAI (formerly xAI) was hit with two proposed class actions in Chicago federal court alleging its Grok platform illegally collected biometric information from an uploaded selfie — manipulating facial images without written notice. It's part of a growing wave: Google and Otter.ai face BIPA class-action claims too. Illinois' Biometric Information Privacy Act requires written consent before collecting face geometry, voiceprints, or fingerprints — and you don't need to harm anyone to be sued: a bare technical violation is enough (Rosenbach v. Six Flags, 2019). Damages run $1,000–$5,000 per violation. Facebook paid $650 million in 2020; BNSF paid $75 million in 2024. This 60-second check scores your AI product's BIPA exposure. Free, no signup.
BIPA is cybersecurity news for AI companies because Illinois law sets fines up to $5,000 per violation for collecting biometric data without written consent — and AI products that scan faces or voices are prime targets. Several AI firms have already paid multi-million-dollar settlements. This 60-second check scores your exposure before regulators do.
This page checked one risk. DisclosureGuard tracks AI compliance obligations — disclosure, consent, and retention duties across regulations.
BIPA Section 15(b) requires private entities to give written notice and obtain a written release before collecting biometric identifiers — including face geometry, fingerprints, retina/iris scans, and voiceprints. Section 15(a) requires a publicly available retention and destruction schedule. No actual injury is needed to sue: the Illinois Supreme Court held in Rosenbach v. Six Flags (2019) that a bare statutory violation confers standing.
$1,000 per negligent violation and $5,000 per intentional or reckless violation, plus attorneys' fees and injunctive relief. A 2024 amendment (SB 2979) limits accrual to the first unlawful scan or transmission per person, but with large user bases the exposure is still enormous — Facebook paid $650 million in 2020 and BNSF paid $75 million in 2024 to resolve BIPA class actions.
AI products that analyze faces or voices — photo editing, avatars, face filters, voice cloning, meeting transcription — collect biometric identifiers as a core function. In October 2026, SpaceXAI (formerly xAI) was hit with two proposed class actions alleging its Grok platform illegally collected biometric information from an uploaded selfie without written notice. Google and Otter.ai face similar BIPA class-action claims. Defense firm Paul Hastings warned of 'a new wave of biometrics litigation' targeting AI companies.
Yes, if you collect biometric data from Illinois residents. BIPA follows the person, not the company — out-of-state and foreign AI companies have been sued under it. If your product has any Illinois users and touches face or voice biometrics, you are in scope.