LIVE · cybersecurity feed
Live wire
ai

Meta Sued Over Training Data for Its AI and Face-Recognition Systems

A proposed class-action lawsuit has been filed against Meta in federal court in Chicago, alleging that the company illegally used photos from Facebook and Instagram to train its AI image-generation models and to develop an unreleased face-recognition feature called "NameTag." The lawsuit claims that Meta violated privacy laws in Illinois and California by extracting biometric information from…

ZeroDay News ·

Source: WIRED — Security

A proposed class-action lawsuit has been filed against Meta in federal court in Chicago, alleging that the company illegally used photos from Facebook and Instagram to train its AI image-generation models and to develop an unreleased face-recognition feature called "NameTag." The lawsuit claims that Meta violated privacy laws in Illinois and California by extracting biometric information from individuals' photos without their knowledge or consent.

The complaint, filed by parents and their children in Illinois and California, specifically targets Meta's generative AI models, Emu and Muse Image. Meta's Chief Product Officer, Chris Cox, has previously stated that the company trained Emu on extensive quantities of Facebook and Instagram images and text, referring to these platforms as a "data advantage" for its AI systems. The lawsuit contends that this training process involved the unlawful harvesting of biometric data from individuals appearing in the images. Muse Image, released this summer, had previously drawn criticism for allowing users to generate images based on other people's public Instagram accounts, a feature Meta subsequently removed, acknowledging it "missed the mark."

The lawsuit also focuses on "NameTag," an unreleased face-recognition system intended for Meta's smart glasses. Code for NameTag was reportedly embedded in the Meta glasses AI companion app, which has been downloaded over 50 million times. While the feature was not enabled for users, analysis indicated it was designed to convert faces captured by the glasses into biometric signatures and compare them against "faceprints" stored in a database on the user's phone. This database was configured to receive updates from Meta.

The complaint alleges that these faceprints may have been derived from Facebook and Instagram images. This claim is supported by reports of Meta employees stating NameTag could recognize individuals through their Meta connections or public Instagram accounts, as well as a company patent describing face matching against profile photos and other images held by Meta. Meta previously stated in June that it was "not building a central face database" and declined to comment on whether NameTag would be opt-in or how faceprints would be retained.

A Meta spokesperson issued a statement calling the lawsuit "without merit" and a "misrepresentation" of their work. The company asserted transparency regarding its use of user information to develop and enhance AI products. Regarding NameTag, Meta stated that "nothing has shipped to consumers and no final decision has been made on what to do here, if anything," adding that any rollout would be "thoughtful" and "with full transparency," reiterating that they are "not building a universal face database."

The plaintiffs in the case are Francisco Alvarez and his son, both Illinois residents, and Jeremy Wahl, a California resident, and his 10-year-old daughter. The proposed class includes individuals in Illinois, California, and across the United States whose images were uploaded to Facebook or Instagram or submitted to Meta’s generative AI systems through prompts, dating back to September 4, 2021. The complaint estimates the national class could number in the millions.

Under Illinois’ Biometric Information Privacy Act (BIPA), the plaintiffs are seeking $5,000 for each intentional or reckless violation, or actual damages if greater, and $1,000 for each negligent violation, or actual damages if greater, in addition to injunctive relief. The California claims seek additional damages and other forms of relief.

This is not the first instance of Meta facing legal challenges concerning its handling of biometric data. In 2020, the company agreed to a $650 million settlement in an Illinois class action related to an earlier face-recognition system. In November 2021, Meta announced the shutdown of that system and the deletion of over a billion faceprints. In 2024, Meta also agreed to pay Texas $1.4 billion to resolve separate allegations of unlawful biometric data collection from users.

The day after a June 4 report detailing NameTag, Meta reportedly removed the associated code from its app. While Meta argued the feature never existed because it was not available to consumers, analysis and testing by independent researchers indicated a technically functional face-recognition system had been included in an app downloaded by tens of millions. Meta CTO Andrew Bosworth described the reporting as "incredibly misleading" and "absolutely dishonest," though he later discussed NameTag on a podcast, suggesting it could recognize people a glasses wearer had previously met and asked the device to remember, calling it a "great feature." Meta has consistently described NameTag as an exploratory concept rather than a consumer product.

ai
ShareXLinkedInWhatsAppFacebook

More News

view all →
breach

Criminal IP Introduces AITEM as the Next Evolution of Attack Surface Management

AI SPERA, the company behind the cyber threat intelligence platform Criminal IP, has announced AITEM (AI-Powered Threat Exposure Management), an expansion of its Attack Surface Management (ASM) offerings. AITEM aims to move beyond traditional asset discovery to provide a more comprehensive approach to understanding, prioritizing, and responding to security exposures. The platform is scheduled…

ai

AI Is Getting Really Good at Messing With Cybercriminals

Anti-cybercrime initiatives are increasingly deploying artificial intelligence to disrupt scammers by engaging them with lifelike bots, which the criminals mistake for genuine victims. This strategy aims to waste scammers' time and resources while gathering intelligence on their operations.

ai

The Third-Party Agent Problem: Why Security Built for AI You Chose Misses the Agents You Didn't

A new report highlights a significant blind spot in enterprise security architectures concerning the proliferation of third-party AI agents. The forthcoming 2026 State of Agent Security Report indicates that current security models, often designed to protect AI systems directly chosen and deployed by an organization, frequently fail to account for AI capabilities embedded within third-party…

security

Canadian cybersecurity executive arrested in federal extortion case

A Canadian cybersecurity executive was arrested in Pennsylvania on Thursday, facing federal charges of conspiracy to commit extortion. Edward Dubrovsky, 54, a co-founder and former Chief Operating Officer of CYPFER, a firm specializing in ransomware negotiation, is charged with conspiring to threaten the confidentiality of information for extortion and conspiring to commit Hobbs Act extortion,…

ransomware

FBI Arrests Ransomware Negotiation Firm Co-Founder in ShinyHunters Probe

The Federal Bureau of Investigation (FBI) has reportedly arrested Edward Dubrovsky, a co-founder of the ransomware negotiation firm Cypfer and currently associated with CyberSteward. The arrest is said to be part of the ongoing ShinyHunters investigation, specifically in connection with an incident involving FBI job applicant data.

security

Insider Cyber Extortion Plot Against Industrial Firm Lands Engineer in Prison

A former core infrastructure engineer has been sentenced to prison for an attempted cyber extortion plot against an industrial firm. The engineer reportedly deleted administrative accounts and reset hundreds of user passwords, subsequently demanding a ransom of 20 Bitcoin to prevent further disruption to the company's servers.