Uploading a photograph and authorizing every form of analysis performed on it are different questions.
A proposed U.S. class action, Padilla v. SpaceXAI, alleges that Grok extracted facial biometric information from uploaded selfies without the notice and consent required by Illinois law. The allegations have not been proven, and the case remains a proposed class action.
For AI developers and privacy counsel, the dispute highlights the importance of understanding what an image tool does beneath its interface.
A photograph is not automatically a biometric identifier
The Illinois Biometric Information Privacy Act, commonly called BIPA, distinguishes between photographs and specified biometric identifiers. Its definition includes scans of face geometry, while excluding photographs themselves.
That distinction prevents a simplistic conclusion that every AI selfie feature necessarily processes regulated biometric data.
The relevant inquiry concerns the system’s actual operations and whether the alleged processing falls within the statute. The appearance of the final image alone may not answer that question.
A tool that preserves someone’s likeness raises factual questions about how it achieves that result. Counsel need technical information before drawing a legal conclusion.
The upload does not answer every consent question
The plaintiffs’ theory challenges the assumption that a user’s voluntary upload resolves the privacy analysis.
Someone may understand that an application will alter a photograph without understanding what measurements, representations or other information it creates during processing.
Whether a particular notice and consent process satisfies applicable law must be assessed against the actual activity - not simply the presence of an upload button or a general privacy policy.
For product teams, that means legal review should occur alongside technical design. Counsel cannot accurately describe processing that engineers have not explained.
What Canadian lawyers should take from the dispute
These are Illinois claims. They do not establish a Canadian rule governing AI image editing.
Their practical relevance is the need to distinguish the information supplied by a user from information generated through analysis of that material.
Canadian counsel advising a business with U.S. users should identify which jurisdictions and privacy requirements may apply. Counsel evaluating a vendor should also seek a clear account of the vendor’s processing, retention and downstream uses.
A product’s description as an editing tool does not provide a complete account of its data practices.
Questions for product and procurement teams
An effective review should examine:
- Processing: What information does the tool derive from an uploaded face?
- Purpose: Is that information used only for the requested edit or for additional functions?
- Retention: What remains after the output is delivered?
- Notice: Does the user receive an intelligible explanation of the relevant processing?
- Access: Which suppliers or other parties receive the information?
These questions are useful even where the legal classification remains contested. They help counsel identify the evidence needed to assess exposure.
The Grok lawsuit will turn on allegations, technical facts and the applicable statutory requirements. They should not be treated as a finding that identity-preserving generation invariably violates biometric privacy law.
The privacy question begins with what the system creates from the photograph - not just what the user uploads.
For related analysis, read Minnesota AI “Nudification” Law Temporarily Halted in xAI Appeal and Supreme Court Considers Privacy Rights and Religious Freedom in Vabuolas Appeal.