Two proposed class actions in Chicago federal court allege Grok scanned Illinois users' face geometry from uploaded photos without written consent. The suits name SpaceXAI Corp. and SpaceXAI LLC and invoke Illinois' Biometric Information Privacy Act (BIPA), the state law that controls private-company collection of biometric identifiers.
Illinois resident Cesar Padilla filed the first proposed class action on Oct. 7, 2026, alleging Grok kept faceprints from headshot selfies without written consent, according to a MediaPost report. A second suit followed days later. These are early pleadings, not findings of liability, and no settlement or claim form exists.
Official resources:
- Read the official notice from Fkks — Use this primary source to verify the official announcement.
- Read the official notice from Shumaker — Use this primary source to verify the official announcement.
Table of Contents
- What do the two lawsuits allege?
- What does Illinois BIPA require?
- Who is in the claimed group and what is at stake?
- What should Illinois users do now?
What do the two lawsuits allege?
Padilla filed in the U.S. District Court for the Northern District of Illinois. He focuses on selfies uploaded for headshots. Illinois resident Scott Wilson filed the second putative class action on Oct.
12, 2026, in the same court over facial-image analysis, rating, editing and transformation. Both complaints allege Grok captures a scan of face geometry whenever a user uploads a face photo to analyze, rate, edit, transform or generate media, according to a Frankfurt Kurnit technology-law analysis. The alleged missing steps were prior written notice, a purpose statement, a retention period and a written release. Histories and training-data retention are also at issue.
What does Illinois BIPA require?
BIPA treats a scan of hand or face geometry as a biometric identifier. Illinois law then requires private companies to give written notice, state the purpose and retention length, obtain a written release, publish destruction schedules and refrain from selling the data, according to the Illinois BIPA text. The Grok cases assert two counts.
Section 15(a) covers processing without published retention and destruction policies. Section 15(b) covers collection without informed written consent. In plain terms, 15(a) concerns company-wide policies and storage limits, while 15(b) concerns permission before each person's data is taken.
Who is in the claimed group and what is at stake?
The claimed group is Illinois Grok users who uploaded face photos in Illinois. That location link matters because BIPA is an Illinois statute. Uploads from outside Illinois, non-face images and non-Illinois residents fall outside the pleaded class.
BIPA allows an aggrieved person to seek $1,000 per negligent violation or $5,000 per intentional or reckless violation, according to a Fashion Law Journal summary. Courts decide whether violations count per upload, per retention act or another unit. No damages have been awarded here.
What should Illinois users do now?
Save your own records while the cases proceed. Useful records include upload dates, the email or phone number used for Grok, receipts, headshot or avatar outputs and any notices Grok showed before upload.
Keep original photos and avoid deleting account history. The broader question, described by Shumaker, Loop and Kendrick, is whether AI feature analysis counts as regulated collection when the source photograph itself is excluded from BIPA. If plaintiffs prevail, routine headshot, avatar and portrait tools that analyze facial features could need BIPA disclosures, releases and public retention policies even without identity verification.
- Confirm you uploaded your own face photo while in Illinois.
- Save dates, outputs, receipts and any consent screens.
- Watch for class certification, dismissal or settlement news.
- Do not pay anyone to file; no claim form is available.