Illinois Put a $5,000-a-Head Price on Face Scans. Two Grok Suits Show Why Consumer AI Now Has to Price That In

• Oct 7, 2026 — Padilla v. SpaceXAI Corp. et al., Northern District of Illinois: Illinois residents who uploaded a photo of their own face to Grok and asked it to analyze, rate, edit or transform that photo allege Grok captured a scan of face geometry without written notice or a written release.
• Oct 12, 2026 — Wilson v. SpaceAI Corp. and SpaceXAI LLC, same court: this complaint targets the model's outputs, arguing that facial measurements and edits that keep a person recognizable prove Grok derived, stored and retained a biometric representation.
• Relief sought in both: up to $5,000 per person for each intentional or reckless violation, $1,000 per negligent one, plus disgorgement and an injunction requiring deletion of biometric data and publication of a compliant retention policy.
• The allegations are not exotic. The complaint cites \"Project Skippy,\" a 2025 internal effort in which employees signed releases before their faces were recorded to train Grok, and asks why a consumer feature needs the same paperwork.
• A third Illinois class action over the same conduct was reported the following week. Reuters framed the pair on Oct 13, 2026 as the clearest test yet of how far Illinois law reaches into generative AI.

• Jan 14, 2026 — California opened an investigation into xAI over Grok's sexualized images of real people, noting that more than half of the 20,000 images generated over the Christmas-to-New-Year week showed people in minimal clothing, some apparently children.
• Jan 16, 2026 — California's attorney general followed with a cease-and-desist letter; on Jan 23, 2026 a bipartisan group of 35 attorneys general led by Illinois demanded action and cited an analysis putting Grok's output at roughly 6,700 sexually suggestive images an hour.
• Aug 1, 2026 — Minnesota's first-in-the-nation law banning AI nudification took effect with civil penalties of up to $500,000 per violation; xAI's challenge was denied in September, leaving both the statute and the fight intact.
• Oct 23, 2026 — Texas sued OpenAI and Sam Altman under the Deceptive Trade Practices Act over ChatGPT safety marketing, giving every state attorney general a template that needs no new AI statute.
• Jan 1, 2027 — Illinois' frontier AI safety law and its chatbot and companion-model statutes take effect, layering audit, notice and safety duties on top of the biometric statute.
• Meanwhile the federal government is litigating against state AI law from the other side: the Justice Department moved in October to intervene for xAI in its challenge to Colorado's AI Act, so Washington is a source of legal risk for AI companies rather than a safety net.

The ability to create nonconsensual intimate images appears to be a feature, not a bug.

• Mississippi's environmental regulator issued notice to MZX Tech, the SpaceXAI affiliate building in Southaven, after construction began without the correct permits, and is seeking civil penalties of up to $25,000 per day.
• The preliminary exposure reported on Oct 23 and Oct 24, 2026 was about $6.1 million and still accruing, so the clock is the cost: every day of unpermitted construction adds to the bill.
• Separately, the NAACP sued in April 2026 alleging xAI is running 27 gas turbines in Southaven without an air permit; the Justice Department has since moved to intervene against the plaintiffs.
• The stakes are local: Mississippi's governor announced in January 2026 that xAI will invest more than $20 billion in Southaven to push the site's computing power toward nearly 2 gigawatts, so the state controls the permits the build-out needs.

• Meta's $9.89B charge in the September quarter consumed 76% of the company's operating income of $12.99B, and management raised full-year 2026 expense guidance to $175–179 billion.
• Scale is why the arithmetic bites at platform level: Meta averaged 3.64 billion daily active people in September 2026, so the same per-person rule that is a rounding error for one app becomes a line item at Meta's scale.
• Meta's settlement also plants a competitive trigger: if Snapchat, TikTok and YouTube adopt comparable limits, Meta's daily caps tighten to 60 minutes for ten years — a pricing decision for every peer, not just Meta.
• Apple's exposure is the opposite problem: damages are affordable against $109.4 billion of quarterly revenue, but injunctive relief touching Face ID or iCloud face matching would reach the product itself.
• Serve Robotics shows the tail: a $241 million market cap, $7.8 million of trailing revenue and a $193.0 million trailing operating loss cannot absorb a $5.0 million class, let alone a larger one.

• Upstream: NVIDIA's Hopper and Spectrum-X systems form the fabric of Colossus, the Memphis–Southaven cluster SpaceXAI operates, and NVIDIA's trailing revenue reached $303.0 billion with $96.2 billion in the quarter ended July 26, 2026.
• Upstream: Microsoft Foundry hosts Grok models for enterprise customers, so the same Illinois theory reaches Microsoft's resellers as a contract and indemnity question.
• Downstream: Meta's smart glasses, Apple's Face ID and Photos, Snap's filters and Spectacles, and Serve Robotics' sidewalk robots are where derived face geometry actually meets consumers.
• Value follows liability: platforms that can fund consent flows, retention schedules and on-device processing keep the feature, while everyone else either pays a settlement or removes the capability.

• Days to quarters: the two Grok cases will turn on one question — whether a model's measured output is a \"scan of face geometry\" — and a dismissal would drain most of the risk premium in a single ruling.
• Days to quarters: Mississippi's penalties accrue at up to $25,000 per day from the August 2026 notice, so the claim compounds until permits are resolved.
• Days to quarters: SpaceX's fiscal 2026 annual report, due in early 2027, is where Grok's legal exposure gets quantified for equity holders after the Oct 22, 2026 quarterly filing.
• Days to quarters: Illinois' chatbot and companion-model statutes take effect Jan 1, 2027, while Meta reports a fourth-quarter revenue guide of $73–76 billion against full-year expenses of $175–179 billion.

• One to three years: per-person damages plus class certification is the real price tag, and it gets paid in product decisions — consent gates, published retention schedules, on-device processing, or withdrawal of face-touching features.
• One to three years: the patchwork pushes consumer AI features toward a handful of balance sheets, concentrating both the winners and the compliance cost.
• One to three years: state statutes with independent audits, starting in Illinois on Jan 1, 2027 and extending through California's chatbot laws signed in October 2026, add fixed overhead that scales with state count rather than users.
• One to three years: if a court rules that generative outputs are not biometric scans, the per-person arithmetic collapses and the cost of face-touching AI returns to near zero.