💸 The Damage
$1.4 billion. The biggest privacy settlement ever won by a single state.
Meta (Facebook) scanned every face in every photo for over a decade. Without asking. Without telling. Just stealing your face geometry and building an AI empire.[1]
Texas sued. Texas won. Your state is probably next.
🎯 What Meta Did (And Why It Cost Them)
2011: Facebook launches "Tag Suggestions." Sounds helpful, right?[2]
Here's what it actually did:
- Scanned every face in every uploaded photo
- Created "face templates" - mathematical maps of your face
- Stored your biometric data permanently
- Turned on by default for all users
- No explanation of how it worked
- No consent requested
For 10 years, Meta built the world's largest facial recognition database. Using your family photos.
⚖️ How Texas Made Them Pay
The Law That Bit Back: CUBI Act
Texas passed the Capture or Use of Biometric Identifier Act in 2009. Nobody enforced it. Until 2022.[3]
CUBI makes it illegal to:
- Capture biometric identifiers without consent
- Sell biometric data
- Keep biometric data indefinitely
Penalty: $25,000 per violation[4]
Meta's violations: Millions of Texans over 10 years
Do the math.
The Settlement Breakdown
July 30, 2024: Court approves the deal[5]
Payment schedule:
- 2024: $500 million (paid within 30 days)
- 2025: $225 million
- 2026: $225 million
- 2027: $225 million
- 2028: $225 million
Meta admits no wrongdoing. Of course.
💰 Who Gets the Money (Spoiler: Not You)
The Catch With CUBI
Unlike Illinois's BIPA law, Texas CUBI has no "private right of action."[6]
Translation: You can't sue. Only the Texas Attorney General can.
The $1.4 billion goes to the state of Texas. Not to victims.
Where the money actually goes:
- Texas General Revenue Fund
- AG's office enforcement budget
- Future privacy enforcement (maybe)
- Your pocket: $0
🗺️ Which States Can Sue Next
States With Strong Laws
Illinois (BIPA):
- Private right to sue
- $1,000-$5,000 per violation
- Already got $650M from Meta in 2021[7]
Washington:
- Biometric law since 2017
- AG can enforce
- No major suits yet
States Passing New Laws (2024-2025)
Colorado: Amendment takes effect July 1, 2025[8]
New York: Considering BIPA-style bill
Massachusetts: Bill pending
Missouri: Bill pending
21 states now classify biometric data as "sensitive"[9]
Cities Taking Action
New York City:
- Law since 2021
- Must post notice at entrance
- Can't sell biometric data
- Private right to sue[10]
Portland: Strictest facial recognition ban
San Francisco: Government use banned
📊 The Scoreboard: Who's Winning Against Meta
Settlements So Far
- Texas: $1.4 billion (2024)
- Illinois: $650 million (2021)
- Total: $2.05 billion
Still Using Your Face
- Instagram filters
- WhatsApp profile matching
- Messenger effects
- Meta Ray-Ban glasses
What They "Deleted"
November 2021: Meta claims to delete 1 billion face templates[11]
But kept:
- DeepFace AI models
- Research data
- Aggregated insights
🔍 How to Check If You're Owed Money
Illinois Residents (BIPA)
You might have gotten paid already:
- 2021 settlement: $650 million to Illinois Facebook users[12]
- Payments: $200-400 per person
- Deadline passed, but check unclaimed property
Texas Residents (CUBI)
Bad news: You get nothing directly. The state keeps it all.
Good news: Your AG might sue other companies next.
Other States
Watch for class actions if your state has biometric laws:
- Washington state residents
- New York City residents (for businesses)
- Check your state AG's website for investigations
🎭 The Other Companies Getting Sued
Texas AG Ken Paxton isn't stopping with Meta:[13]
Google: Another Record Settlement (2025)
Texas secured a similar massive settlement from Google in May 2025 for biometric violations.[14]
Details still sealed but sources indicate comparable to Meta's $1.4B.
Who's Next on the Hit List
- Amazon: Ring doorbell facial recognition
- Apple: Face ID data handling questions
- TikTok: Face filters and age estimation
- Snapchat: Lenses scanning faces
- Clearview AI: Multiple state investigations
💀 Why Biometric Data Is Different
You Can't Change Your Face
Password stolen? Change it.
Credit card compromised? Get a new one.
Social Security number leaked? Tough but possible to change.
Face geometry stolen? You're screwed forever.
What makes biometric data special:
- Permanent: Can't be changed
- Unique: Identifies you specifically
- Valuable: Worth more than SSNs on dark web
- Trackable: Links all your activities
- Involuntary: Captured without action
🛡️ How to Protect Your Biometric Data
Immediate Actions:
- ☐ Turn off Facebook facial recognition (Settings → Privacy → Face Recognition)
- ☐ Disable Instagram face filters data collection
- ☐ Review all app permissions for camera access
- ☐ Check if your state has biometric laws
- ☐ Document any biometric collection (screenshots)
Platform-Specific Settings:
- ☐ Google Photos: Turn off face grouping
- ☐ Apple Photos: Disable People album
- ☐ TikTok: Limit face filter usage
- ☐ Snapchat: Restrict lens data
- ☐ Ring: Disable facial recognition
Legal Preparation:
- ☐ Save all privacy policy versions
- ☐ Document when you joined platforms
- ☐ Screenshot current settings
- ☐ Join class action alerts for your state
📅 What's Coming Next
2025 Legislation
- Colorado biometric amendments (July 1)[15]
- Federal biometric privacy bill (proposed)
- EU AI Act implementation affecting US companies
Pending Lawsuits
- Multiple states investigating TikTok
- Clearview AI facing 20+ suits
- Amazon Ring class actions forming
Tech Response
- More "opt-in" requirements coming
- On-device processing claims
- "Privacy-preserving" AI marketing
🎯 How States Can Win These Cases
The Texas playbook other AGs are copying:
- Document everything: Screenshot default settings showing opt-out buried
- Calculate violations: Every user × every day = massive numbers
- Show harm: Identity theft, stalking, discrimination risks
- Demand documents: Internal emails showing they knew
- Threaten trial: Juries hate Big Tech
- Settle big: $1.4 billion sets the floor
🌍 The Global Picture
This isn't just America:
- EU: €1.2 billion fine to Meta for data transfers (2023)[16]
- UK: Investigating Meta's market dominance
- Australia: Considering facial recognition bans
- Canada: Clearview AI declared illegal
- South Korea: Meta fined for data sharing
✊ What You Can Do
Personal Actions:
- ☐ Demand your state AG investigate Meta/Google/Amazon
- ☐ Support biometric privacy bills in your state
- ☐ Use privacy-focused alternatives when possible
- ☐ Educate others about biometric risks
Political Pressure:
- ☐ Contact state representatives about BIPA-style laws
- ☐ Support federal biometric privacy legislation
- ☐ Push for private right of action (ability to sue)
- ☐ Demand settlement money goes to victims
🎯 The Bottom Line
Meta stole a decade of faces and it only cost them $1.4 billion. That's $140 million per year to build an AI empire on your biometrics.
For Meta, that's 4 days of revenue. Cost of doing business.
But Texas proved they can be held accountable. If your state has biometric laws, pressure your AG. If not, demand them.
Your face has value. Make them pay for it.
📚 References
- Texas AG - $1.4 Billion Settlement with Meta (July 30, 2024)
- Texas Tribune - Meta Tag Suggestions Feature (July 30, 2024)
- Vinson & Elkins - CUBI Act Analysis (2024)
- Zwillgen - CUBI $25,000 per violation (2024)
- Biometric Update - Settlement Approval (July 2024)
- Illinois Business Law Journal - BIPA vs CUBI (August 2024)
- EFF - Illinois $650M Settlement (2024)
- TCW Global - Colorado Amendment July 1, 2025
- Epstein Becker - 21 States Biometric Laws (2024)
- SecureRedact - NYC Biometric Law (2024)
- Malwarebytes - Meta Deletes 1 Billion Templates (2024)
- The Hacker News - Illinois Payments (July 2024)
- Ogletree - Texas AG Future Investigations (2024)
- Biometric Update - Google Settlement (May 2025)
- National Law Review - Colorado July 1, 2025 (2024)
- The Record - EU €1.2B Fine Reference (2024)