Meta Faces Class Action Over "NameTag," the Face-Recognition Code WIRED Found in Its Smart-Glasses App

Two fathers and their children have sued Meta Platforms in federal court in Chicago. They allege that the company used photos from Facebook and Instagram to build biometric faceprints for an unreleased face-recognition feature called NameTag, meant for its Ray-Ban and Oakley smart glasses. The case is Alvarez et al. v. Meta Platforms, Inc., case number 1:2026cv10773 in the U.S. District Court for the Northern District of Illinois, filed on September 4, 2026.

The lawsuit follows a June 4 investigation by WIRED, which reported that working face-recognition code had been shipped inside the Meta AI companion app that pairs with the glasses. Meta says the feature was never released to anyone, that no decision has been made on whether it ever will be, and that the lawsuit is "without merit."

A viral post now circulating on social media sums up the story in one line: two dads are suing Meta, saying your Facebook and Instagram photos were turned into faceprints for glasses that could name strangers on sight, and nobody was supposed to find the code. The core of that post holds up. There is a WIRED report, the code really was called NameTag, and there really is a lawsuit brought by two fathers. But parts of the wording go further than the record. This article sets out what has been confirmed, what is only alleged, and what Meta says in response.

§ 1What WIRED found

On June 4, 2026, WIRED published a report by investigative reporters Dhruv Mehrotra and Dell Cameron under the headline "Meta Silently Added Face-Recognition Code for Its Smart Glasses to Millions of Phones." The report was based on WIRED's own analysis of Meta's software.

According to WIRED, code added to the Meta AI app over several updates in 2026 showed a feature known internally as NameTag. The feature was designed to identify people captured by the glasses' camera and, once switched on, to alert the wearer when it recognized someone. WIRED reported that core parts of the system had been built into software sent to users as early as January.

The feature was not turned on. WIRED was clear about that. But the app it sat inside had been downloaded more than 50 million times, and it is required for key features of Meta's smart glasses, including the Ray-Ban and Oakley models.

WIRED described how the system was built to work. If activated, it would turn faces captured by the glasses into unique biometric signatures, commonly called faceprints. It would then check each one against faceprints stored on the user's own phone. WIRED reported that this on-phone database was set up to receive updates from Meta. Faces the system recognized would trigger a notification. Faces it did not recognize would be cropped, indexed and saved to a folder marked "pending."

WIRED reported that three AI models behind NameTag had already been sent from Meta's servers and were sitting on customers' phones. One model detects faces, one crops them, and a third encodes them into biometric data. Only traces of a user interface were present. A May version of the app rebranded the feature for users as "Connections," inviting them to "remember the people you met."

WIRED did not stop at reading the code. It shared its findings with two outside security researchers, who examined the app separately and reproduced key parts of the analysis. One was Cooper Quintin, a senior public interest technologist with the Electronic Frontier Foundation's Threat Lab. The other was an independent researcher who goes by the pseudonym Buchodi.

Buchodi ran a test of the matching system. The researcher added a single faceprint to the app's gallery, taken from the late French philosopher Michel Foucault, and then triggered NameTag with Foucault's image. The app produced a notification reading "Person recognized." "The main components of a face-recognition feature are already in Meta's companion app," Buchodi told WIRED. "Not many pieces stand between this and a working feature."

Quintin put it this way: "The feature is not yet exposed to consumers but seems nearly ready to go."

One important point from the June report is easy to miss. WIRED said it remained unclear whose faces would be included in the recognition database, how those profiles would be created, or how many people could ultimately be identified through it. In its later coverage of the lawsuit, WIRED repeated that at the time of its June report it could not determine where the underlying faceprint data came from.

§ 2What Meta said in June

Meta pushed back hard on the June report. Spokesperson Ryan Daniels gave WIRED this statement: "Regardless of any sensational reporting, the facts are simple: We've said before we're exploring these types of features, and what you're seeing is just evidence of that exploration. Nothing has shipped to consumers and no final decision has been made on what to do here, if anything. If we do decide to roll something out, we will take a thoughtful approach and do so with full transparency. One decision we can be clear about—we are not building a central face database."

WIRED noted in the same report that its code review showed NameTag was designed to pull faceprints from Meta's servers and store them on user devices. Meta did not answer WIRED's questions about which users might be identifiable, whether data from the system would ever be sent back to its servers, or whether people would have to opt in.

WIRED later reported that Meta removed the NameTag code from its app the day after the June 4 story. Meta's chief technology officer, Andrew Bosworth, called WIRED's reporting "incredibly misleading" and "absolutely dishonest," according to WIRED. Weeks later, WIRED reported, Bosworth described a version of the feature that could recognize people a glasses wearer had previously met and had asked the device to remember, and said he thought it "would be a great feature." Meta has continued to describe NameTag as something it is exploring, not a product.

Before the code was found, Meta had already been asked about face recognition on its glasses. In April 2026, more than 70 advocacy groups, including the American Civil Liberties Union, the Electronic Privacy Information Center and Fight for the Future, warned that such a feature would let stalkers and abusers silently identify strangers in public. At the time, a Meta spokesperson told WIRED, "Our competitors offer this type of face-recognition product, we do not. If we were to release such a feature, we would take a very thoughtful approach before rolling anything out."

§ 3The lawsuit

The lawsuit was filed on September 4, 2026, in the Northern District of Illinois, the federal court that sits in Chicago. According to the court docket and WIRED, the plaintiffs are Francisco Alvarez and his son, both Illinois residents, and Jeremy Wahl, a California resident, and his 10-year-old daughter. The children are identified in court papers only by their initials. So the viral post's phrase "two dads" is accurate, though the suit is brought on behalf of their children as well.

The plaintiffs are represented by the firm Wexler Boley and Elgersma. "People shouldn't have to worry if their biometric information will be misused simply because their photographs appear on a social media platform," Justin Boley, a partner at the firm, said in a statement reported by WIRED.

Everything in the complaint is an allegation. No court has ruled on any of it, and the claims have not been tested.

The complaint, which Biometric Update describes as 66 pages long, alleges that Meta collected images of people's faces uploaded to Facebook or Instagram and used them in three ways. First, to train the AI model that powers NameTag. Second, to generate the biometric identifiers NameTag would use to recognize people. And third, to train Meta's image-generating AI models, including one called Emu and a newer one called Muse Image.

How do the plaintiffs connect NameTag to Facebook and Instagram photos? The complaint leans on three pieces of evidence. The first is WIRED's June report on the code itself. The second is a February 2026 New York Times report on internal Meta material, which the complaint quotes as saying that possible options included "recognizing people a user knows because they are connected on a Meta platform, and identifying people whom the user may not know but who have a public account on a Meta site like Instagram." The third is a Meta patent application published on May 21, 2026, titled "User Identity Verification without Sharing Biometric Data With Platforms." The complaint says the application describes devices, including smart glasses, that capture faces and compare them against biometric data drawn from profile photos and other images a platform already holds.

Biometric Update, which covers the biometrics industry, noted a limit on that last point. A patent application on its own, it wrote, does not establish that Meta actually built the system the way the patent describes.

The complaint is also candid about what the plaintiffs do not know. According to WIRED, it acknowledges that Meta has not disclosed which images, if any, were used to generate biometric data, and says that information remains solely in Meta's possession. WIRED summarized the complaint's position as alleging the faceprints were "possibly derived" from Facebook and Instagram images.

§ 4The legal claims

The case is built mainly on the Illinois Biometric Information Privacy Act, known as BIPA. BIPA is among the strictest biometric privacy laws in the country. It requires companies to tell people in writing before collecting biometric data such as a scan of face geometry, to explain the purpose and how long the data will be kept, and to get written consent. It also requires a public policy on keeping and destroying that data, and it lets private individuals sue.

According to Biometric Update, the Illinois plaintiffs allege that Meta broke two parts of the law: Section 15(a), by failing to keep a publicly available retention and destruction policy, and Section 15(b), by collecting biometric data without written notice and informed written consent.

The California plaintiffs bring three claims, according to the complaint's table of contents: misappropriation of likeness under California common law, a violation of California Civil Code section 3344, which covers commercial use of a person's name or likeness without consent, and a violation of the right to privacy in the California Constitution.

The suit seeks to represent three groups. According to WIRED and Biometric Update, the proposed national class would include people across the United States whose images were uploaded to Facebook or Instagram, or submitted to Meta's generative AI systems through prompts, going back to September 4, 2021. Separate classes would cover Illinois and California residents. The complaint estimates the national class could number in the millions. None of the classes has been certified, which means a judge has not yet agreed that the case can go forward on behalf of anyone beyond the named plaintiffs.

Under BIPA, the plaintiffs are asking for $5,000 for each intentional or reckless violation, or actual damages if greater, and $1,000 for each negligent violation, or actual damages if greater. They also want a court order stopping the practices they describe. The California claims seek further damages.

One part of the case may matter well beyond smart glasses. The plaintiffs argue that when an image-generating AI model is trained on photos of faces, the model itself can end up holding identity-specific facial information in its internal math, and that this should count as biometric data under the law. Biometric Update was careful to note that this is a legal and technical theory put forward by the plaintiffs, not an established finding. If a court accepts it, the question of what counts as biometric data in the age of generative AI could look quite different.

§ 5Meta's response to the lawsuit

Meta rejects the suit. "This lawsuit is without merit and misrepresents our work," a Meta spokesperson said in a statement to WIRED. "We've been transparent about how we use people's information to build and improve our AI products. As for NameTags, nothing has shipped to consumers and no final decision has been made on what to do here, if anything. If we do decide to roll something out, we will take a thoughtful approach and do so with full transparency. One decision we can be clear about—we are not building a universal face database."

That statement carries several distinct points. Meta says the feature never reached consumers. It says it has been open about using people's information to build AI products, and the company has in fact said publicly that it trained Emu on images from its platforms. Chief product officer Chris Cox has described Facebook and Instagram as a "data advantage" for Meta's AI work, according to WIRED and Biometric Update. And Meta says it is not building a universal face database, which goes to the heart of the viral claim that everyone's photos were turned into faceprints.

As of Biometric Update's report on the case, Meta had not yet filed a formal response in court. Under normal federal procedure, a company in Meta's position would typically respond with an answer or a motion to dismiss, and the court would then decide whether the claims can proceed. No such ruling has been reported.

§ 6Weighing the viral wording

The viral post contains three phrases worth looking at closely.

The first is "your Facebook and Instagram photos were turned into faceprints." That is the plaintiffs' allegation, not an established fact. Meta has not said which images, if any, it used, and it denies building a universal face database. WIRED, which found the code, said it could not determine where the faceprint data came from. The complaint itself admits the plaintiffs do not know which images were used. So the honest version is that the lawsuit alleges this, and Meta denies it.

The second is "glasses that could name strangers on sight." The code WIRED analyzed was designed to recognize faces and alert the wearer, and outside testing showed the matching system could work. But the feature was never turned on for users, and Meta says no decision has been made to release it. The material quoted from The New York Times does mention identifying people a user may not know who have public Instagram accounts, but it was described as one possible option. Meta has not confirmed any plan to identify strangers.

The third is "nobody was supposed to find the code." No source reviewed for this article shows that Meta intended to hide the code from discovery. WIRED did use the word "silently" in its headline and described the code as "discreetly added," and the lawsuit says it was "secretly embedded." It is also true that Meta publicly described face recognition as something it was still thinking through while the code was already on phones, and that it removed the code the day after WIRED's story. But code shipped in a public app can be examined by anyone with the right tools, which is exactly how it was found. What anyone at Meta expected or intended is not on the record.

§ 7A long history with face recognition

This is not Meta's first legal fight over faces. In 2010, Facebook launched a system that analyzed photos and suggested who to tag. WIRED reported that it grew to more than a billion users and became one of the largest consumer face-recognition systems ever deployed.

That system drew legal challenges. In Illinois, a class of Facebook users sued under BIPA over the photo-tagging feature. Facebook agreed in 2020 to settle for $650 million, and a federal judge approved the settlement in 2021, according to The Associated Press and WIRED. Separately, WIRED reports that in 2019 Meta paid $5 billion to the Federal Trade Commission and the Justice Department to settle a wider privacy case that included face-recognition concerns.

In November 2021, Meta announced it was shutting down the face-recognition system on Facebook. In a company post, it said it would delete more than a billion people's individual facial-recognition templates, and that more than a third of Facebook's daily active users had opted in to the feature. Meta said it needed "to weigh the positive use cases for facial recognition against growing societal concerns, especially as regulators have yet to provide clear rules." The same post said the company still saw face recognition as "a powerful tool" for things like identity verification and fraud prevention, and that it would keep working on those uses.

Joseph Jerome, a former Meta Reality Labs policy official, told WIRED that the 2021 shutdown was never understood internally as a permanent retreat. "There was always this tension of, well, when do we roll back out face recognition?" he said.

Then came Texas. In February 2022, Texas Attorney General Ken Paxton sued Meta under the state's Capture or Use of Biometric Identifier Act and its Deceptive Trade Practices Act. The state alleged that Meta had run face recognition on virtually every face in photos uploaded to Facebook for more than a decade without the consent Texas law requires. On July 30, 2024, Paxton announced a $1.4 billion settlement, to be paid over five years. His office called it the largest settlement ever obtained from an action brought by a single state. As is typical, the settlement did not include an admission of wrongdoing by Meta.

§ 8The road to face recognition on glasses

Talk of face recognition on Meta's glasses goes back years. The complaint cites a 2021 CNBC report in which Bosworth said the company was "looking at" the idea and called it "a debate we need to have with the public."

In October 2024, two Harvard students showed how close the technology already was. AnhPhu Nguyen and Caine Ardayfio built a demonstration they called I-XRAY. As The Verge and 404 Media reported, it used the livestreaming ability of off-the-shelf Ray-Ban Meta glasses. A computer program watched the stream, used AI to spot faces, and ran them through public face-search tools such as PimEyes and other public databases to find names, addresses, phone numbers and relatives. The students used it to identify classmates and to approach strangers on public transit as if they knew them. They said they built the tool to raise awareness and were not releasing it. I-XRAY was not a Meta product, and it did not use NameTag. Its point was that the pieces already existed.

According to WIRED, internal Meta documents reviewed by The New York Times showed that in 2025 the company planned to debut face recognition on its glasses to attendees of a conference for the blind before making it available more widely. That launch never happened. WIRED also reported that internal documents published by The Times in February 2026 showed Meta had planned to roll out the feature during what it called a "dynamic political environment," when it believed its biggest critics would be busy elsewhere.

§ 9The case for the feature

There is a real case for face recognition in glasses, and it deserves fair space. WIRED noted that existing assistive devices already let blind users identify faces they have personally enrolled. A study by researchers at Cornell Tech and Facebook found that every participant called recognizing people an important daily task. Meta itself, when it shut down its Facebook system in 2021, said the change would remove the ability of its Automatic Alt Text tool to tell blind and visually impaired users which friends appeared in photos, and called that one of the difficult tradeoffs of its decision.

The design WIRED described, with faceprints stored on the user's phone rather than checked against a central server, also fits Meta's stated position that it is not building a central face database. Meta's patent application, by its title, is about verifying identity "without sharing biometric data with platforms." Whether that design actually protects people who never agreed to be recognized is one of the questions the court may eventually have to weigh.

§ 10The case against

Privacy advocates see it very differently. "Despite the billions of reasons not to, Meta seems to have created the capacity to turn their customers into a distributed surveillance machine," Quintin of the Electronic Frontier Foundation told WIRED.

Woodrow Hartzog, a privacy law professor at Boston University, told WIRED that even an opt-in system would offer thin protection, because consent is often tied to a job, a benefit or access to a service. He also warned that the more these systems are deployed, the more people come to see them as routine. Jerome, the former Meta policy official, said, "I don't know how Meta can responsibly deploy a technology like this."

The central worry is about the people on the other side of the lens. A wearer can choose to buy the glasses and turn on a feature. A stranger walking past them on the street makes no such choice.

§ 11What comes next

For now, Alvarez v. Meta is at its earliest stage. Meta is expected to respond in court, and a judge will decide whether the claims can go forward and, later, whether the case can proceed as a class action. BIPA cases have a long track record in the Northern District of Illinois, including the earlier Facebook photo-tagging case, but every case turns on its own facts.

Several basic questions remain open. Meta has not said publicly whose faces, if anyone's, NameTag would recognize, or where the faceprints in its design were meant to come from. The plaintiffs have alleged answers, but they acknowledge they do not have Meta's records. Discovery, the stage of a lawsuit where each side can demand documents from the other, would be the first time those records could be examined, if the case gets that far.

What is confirmed today is narrower than the viral post suggests, but it is still significant. WIRED, backed by two independent researchers, found functional face-recognition code inside an app on tens of millions of phones. Meta says the code was exploration, never switched on, and has since been removed. And two families have asked a federal court to decide whether Meta broke the law in building it.