The complaint in Alvarez et al. v. Meta Platforms, Inc., No. 1:26-cv-10773, was filed on September 4, 2026 in the United States District Court for the Northern District of Illinois, Eastern Division. It runs to 66 pages and pleads five claims across three proposed classes on behalf of two adults and their minor children, residents of Illinois and California. The case-tracking page is Alvarez v. Meta Platforms; this page summarises the pleading itself.
The complaint's structure is unusual for a biometric-privacy action in that it advances two distinct theories about where a biometric identifier resides in a generative model, and only the first has an analogue in earlier litigation. Counsel are Kenneth Wexler, Justin N. Boley, Zoran Tasić and Gwyneth F. Lietz of Wexler Boley & Elgersma LLP, Chicago.
Framing
The introduction places the alleged conduct in a twenty-year pattern rather than treating it as a discrete incident. It opens with Facemash, the 2003 site for which Mark Zuckerberg scraped Harvard directory photographs, quotes his contemporaneous note that "[i]ssues about violating people's privacy don't seem to be surmountable," and states that Facebook launched four months later. It then tallies what it describes as more than $10 billion in privacy fines and settlements paid over seven years — $5 billion in FTC civil penalties, approximately $1.3 billion in GDPR fines, $725 million over third-party data sharing including Cambridge Analytica, a $650 million Illinois BIPA settlement, and $1.4 billion over the Texas Capture or Use of Biometric Identifiers Act — and asserts that these "seem to have done little to deter" the company.
A recurring allegation is one of pattern rather than of a single act: Meta "launches a feature that expands data collection or diminishes privacy by default, faces public or regulatory backlash, and then either withdraws the feature or apologizes while preserving the feature's core function." The complaint applies that reading to both products at issue — the NameTag code was removed from the Meta AI app and the Muse Image feature removed from Instagram, but the complaint alleges the underlying collection continued and that the Muse Image feature "is still active and accessible without restrictions" through meta.ai and the Meta AI app.
The NameTag allegations
Section IV.A sets out the smart-glasses timeline: a September 2020 announcement of the Meta–EssilorLuxottica collaboration, then Ray-Ban Stories in September 2021, Ray-Ban Meta in September 2023, and Meta Glasses in June 2026. It alleges Meta has been considering face recognition for the glasses since before the 2021 release, citing Andrew Bosworth's February 2021 remark that "[i]t's really a debate we need to have with the public. If people don't want this technology, we don't have to supply it."
The June 2026 discovery of unreleased face-recognition code in the Meta AI companion app is drawn from WIRED's reporting, which the complaint quotes: that NameTag would "transform faces captured by Meta's glasses into unique biometric signatures, commonly known as faceprints, and check each one against faceprints stored on the user's phone — a database that's currently configured to receive updates from Meta," and that the app "had been downloaded over 50 million times." It also quotes the New York Times account of an internal Reality Labs memo stating that "[w]e will launch during a dynamic political environment where many civil society groups that we would expect to attack us would have their resources focused on other concerns."
The complaint adds evidence the coverage did not carry. It pleads a Meta patent application published May 21, 2026 — U.S. Patent Publication No. 20260142974 A1, "User Identity Verification without Sharing Biometric Data With Platforms" — as corroboration, describing it as disclosing "a complete operational workflow involving smart-glasses devices, cameras, face-detection and face-embedding algorithms, machine-learning models trained on faces, profile-photo matching, and identity verification against user accounts." The pleading acknowledges that the patent "emphasizes a privacy-preserving architecture in which certain biometric embeddings need not be transmitted from the user's device to Meta's servers," and argues that it nonetheless establishes that Meta built the capability to match captured faces against "biometrics already in Meta's possession."
The two biometric theories
Sections IV.B.3 and IV.B.4 plead the theories separately, at two stages of a model's life.
At training. The complaint alleges that training a text-to-image model on photographs containing faces causes Meta's systems to "detect, encode, and preserve measurements and relationships among identity-relevant facial features in model parameters, embeddings, latent representations, feature vectors, or materially equivalent numerical representations," and that these are "forever stored in the code of the GenAI model that the image was used to train." It anticipates the objection that a diffusion model's latents are not face embeddings of the kind a recognition system uses: "Despite the model-retained data being stored in compressed latent form rather than as face embeddings that are utilized by traditional face-recognition models, these data are biometric identifiers and biometric information because these data can be used to recognize an image of a person's face and even to reproduce it." It cites Meta's own Emu paper for the model having "an autoencoder (AE) to encode an image to latent embeddings," and academic work on diffusion models and representation learning in support.
The claimed consequence is stated without qualification: memorization of biometric identifiers occurs "regardless of whether or not the depicted person uploaded the image, maintained a Meta account, or knew that the image would be used for training."
At inference. The second theory is that when a user submits a photograph of a person as part of a prompt, "the model analyzes features in the photo and generates and stores numerical representations of the person's face that likewise can be used to identify the person and is therefore a biometric identifier or information under BIPA." The complaint grounds the storage element in Meta's own privacy policy, which states the company collects and uses information submitted to its generative AI products including "questions, messages, media and other information," and adds that such submissions are used to train the models further.
The inference theory is what makes the class definitions reach beyond people who posted anything: a face submitted by someone else's prompt is, on this pleading, a face from which Meta created and stored an identifier. Every class definition carries a third limb for it.
The complaint also asserts a bridge between generative and perceptive systems, alleging that generative models "have often been found to have strong perceptive abilities as well — abilities such as recognizing faces, identifying objects in images, and answering questions about an image," and that the extraction step is the same in both: feature extraction, conversion to a numerical representation, and association of that representation with personally identifiable information.
Data-advantage allegations
The complaint quotes Meta chief product officer Chris Cox in a May 2024 Bloomberg interview: "Our data advantage is really the public images that have been shared on Facebook and Instagram, as well as the public text… And if you look at our image model — Emu is its name … you get really amazing quality images and a lot of that is because Instagram is the dataset that was used to train it." It alleges disclosure was inadequate rather than absent: the statement that Meta trains on "posts or photos and their captions" appears neither in the 5,386-word Terms of Service nor the 21,118-word Privacy Policy, "but rather in a separate document tucked away in a corner of Facebook's website."
On Muse Image, the complaint recounts the July 2026 Instagram feature that generated images from public accounts, alleges it "automatically opted in any Instagram user with a public account," and notes Meta withdrew it three days after launch saying "[w]e've heard the feedback that this feature missed the mark."
Limitations
Section IV.D pleads delayed discovery, equitable tolling and fraudulent concealment together. The plaintiffs allege they could not have discovered the facts through reasonable diligence until mid-2026, because the systems "were maintained within Meta's internal systems and were not publicly disclosed in any meaningful manner" and their "existence, scope, operation, and use … were uniquely within Meta's knowledge and control." Two disclosure events are identified as starting the clock: the June 2026 NameTag reporting and the July 2026 Muse Image backlash. On that basis the complaint asserts the limitations period "did not begin to run until mid-2026" — which is what allows a class period reaching back to September 4, 2021 to be pleaded as timely.
Claims and relief
Five claims are pleaded. Claims 1 and 2 are under BIPA sections 15(a) and 15(b) for the Illinois Class: the failure to develop and publish a retention schedule and destruction guidelines, and the collection of biometric identifiers without written notice of the fact, the specific purpose and the term, and without a written release meaning informed written consent. Claims 3 and 4 are the California common-law right of publicity and California Civil Code § 3344(a) commercial misappropriation, for the National Class or alternatively the California Class. Claim 5 is the California constitutional right to privacy, for the California Class.
The California claims move the case beyond biometric privacy into identity and likeness. Claim 3 alleges Meta "appropriated Plaintiffs' and Class Members' identities, likenesses, facial characteristics, and biometrics for its own commercial advantage without authorization," and distinguishes storage from extraction: "Rather than merely storing photographs, Meta extracted identity-related information from Plaintiffs' and Class Members' facial images, used those identity attributes to train and improve AI and facial-analysis systems, and incorporated the resulting capabilities into products and services from which Meta derives substantial economic benefit." Claim 4 recites § 3344(a)'s remedy of the greater of $750 or actual damages plus attributable profits, and pleads that the use had no connection with news, public affairs, sports or a political campaign — the statutory exemptions. Claim 5 rests on a reasonable expectation "that Meta would not transform their photographs and videos into biometric templates, facial embeddings, faceprints, identity vectors, or other machine-readable representations," and on the proposition that biometric characteristics are "unique, immutable, and capable of identifying a person across platforms, locations, and time."
The prayer for relief at Section VII asks the court to certify all three classes under Rule 23(a), (b)(2) and (b)(3) with the named plaintiffs as representatives; to declare that Meta's actions violate BIPA §§ 15(a) and (b); to award the National and California Classes "statutory, compensatory, punitive, exemplary, consequential, general, and nominal damages in an amount to be determined at trial"; to award the Illinois Class the greater of actual or statutory damages of $5,000 per intentional or reckless BIPA violation and $1,000 per negligent violation; to grant permanent injunctive relief prohibiting the practices alleged; and to award fees, expenses and pre- and post-judgment interest. The per-violation figures are BIPA's statutory amounts, restated in the prayer. The injunctive relief sought in the prayer is stated generally; the claim-level requests are specific, seeking an order requiring Meta to publish a BIPA-compliant retention policy under § 15(a) and to comply with § 15(b) before collecting, storing or using biometric identifiers. A jury is demanded on all issues so triable.
Class size
The complaint pleads numerosity from Meta's own figures: that Meta "publicly stated that it used 1.1 billion text-pair images to train its Emu model," and that with over 250 million Facebook and over 160 million Instagram users in the United States, "by conservative estimates, members of the National Class number in the millions and members of the Illinois and California Classes number in the hundreds of thousands." The class period is September 4, 2021 through the present. Meta, entities it controls, and its legal representatives, officers, directors, assignees and successors are excluded.
Provenance
Captured September 12, 2026 from the CourtListener RECAP archive, complete at 66 pages. The PDF's text layer drops spaces between some word pairs, so quotations were checked against the page images before reproduction. Twelve divergences between the complaint and the secondary coverage from which Alvarez v. Meta Platforms was first written are recorded in the raw file's ## Source-fidelity notes; the case page has been corrected against them.
Relationships
- depends-on: Alvarez v. Meta Platforms — the case-tracking page
- related: Meta AI — defendant
- related: Muse Image and Muse Video (Meta Superintelligence Labs) — one of four models named; the July 2026 Instagram feature is pleaded as a disclosure event
- instance-of: AI and Surveillance — face recognition as biometric identification
- supports: AI and Privacy — the pleading that model weights and inference-time latents are themselves biometric identifiers under a consent statute
- related: Web Scraping for AI Training — the allegation that public-platform images were the training corpus and that disclosure of the fact was inadequate
- related: Kadrey v. Meta, Hachette et al. v. Meta (and Mark Zuckerberg) — training-data suits against the same defendant pleading copyright rather than biometric privacy
- related: Verified Stockholder Derivative Complaint, Rosen v. Cook et al. — the other 2026 pleading pairing an Illinois BIPA count with training-data allegations
Sources
- Complaint (Source: storage.courtlistener.com)
- WIRED — "Meta Sued Over Training Data for Its AI and Face-Recognition Systems", 2026-09-11 (Source: wired.com)