AI Regulation Tracker  /  Enforcement settlement

Texas Turned a 2009 Biometric Statute Into a 1.4 Billion Dollar Meta Settlement, and It Still Binds AI Today

On July 30, 2024, the Texas Attorney General announced a 1.4 billion dollar settlement with Meta for capturing the facial geometry of millions of Texans through Facebook’s Tag Suggestions feature without consent. It was the first enforcement action under the state’s Capture or Use of Biometric Identifier Act (CUBI) and, in the state’s own words, the largest settlement ever obtained from an action brought by a single state. The instrument is from 2024. The reason it belongs in an AI compliance file in 2026 is that CUBI is a live liability regime for any facial-recognition or photo-tagging AI run on Texans, and it sits well beyond Illinois BIPA.

By Anthony Guerriero  ·  The Leveraged Years Regulatory Research  ·  Published July 20, 2026  ·  Last updated July 20, 2026

Let me be honest about the date up front, because it changes how you should read this. The settlement was announced on July 30, 2024. This is not breaking news. It is included here because the operative law behind it, CUBI, is still on the books, still enforced, and still almost invisible in most AI vendor diligence outside Illinois. The dollar figure got the headlines in 2024. What deserves attention in 2026 is that Texas built the second serious biometric consent regime in the country, and it enforced it against the largest facial-recognition deployment on earth.

According to the Attorney General’s own release, the state secured the settlement with Meta to stop the company’s practice of “capturing and using the personal biometric data of millions of Texans without the authorization required by law.” That single line is the whole compliance theory. It is not about whether the technology works. It is about whether you got consent before you ran it.

What Meta actually did

In February 2022, Texas sued Meta for capturing the biometric data of millions of Texans without informed consent, alleging violations of CUBI and the Deceptive Trade Practices Act. The feature at the center was Tag Suggestions, which Meta rolled out in 2011. It scanned photos and videos users uploaded, mapped the facial geometry of the people in them, and used those face templates to suggest name tags. Texas alleged Meta turned the feature on for Texans by default and did not properly explain how it worked or obtain the consent the statute requires. Facial geometry is a biometric identifier under CUBI, which is why an ordinary-sounding product feature became a billion-dollar liability.

Why the CUBI regime matters more than the number

CUBI has been Texas law since 2009, but until this case no one had brought and settled an enforcement action under it. That is the real signal. The statute forbids capturing a person’s biometric identifier, a fingerprint, voiceprint, retina or iris scan, or the geometry of the face or hand, for a commercial purpose unless you first inform the person and get consent. It also constrains how you sell, disclose, store, and destroy that data. What changed in 2024 is that Texas proved it will enforce the law directly and at scale. The Attorney General framed the outcome as the largest privacy settlement an attorney general has ever obtained, dwarfing the roughly 390 million dollars a coalition of 40 states secured from Google in 2022.

For AI teams, the important contrast is with Illinois. Most privacy counsel know BIPA, the Illinois Biometric Information Privacy Act, because its private right of action has driven a decade of class litigation. CUBI works differently. It is enforced by the Texas Attorney General rather than by private plaintiffs, and this settlement shows that state enforcement can produce a far larger single number than a class settlement typically would. If your compliance map treats biometric risk as an Illinois-only line item, Texas is the second regime you are missing, and it is the one that just wrote the record check.

The enforcement posture is the takeaway

The Attorney General was direct about intent. In the release, Paxton said, “This historic settlement demonstrates our commitment to standing up to the world’s biggest technology companies and holding them accountable for breaking the law and violating Texans’ privacy rights,” and added that “any abuse of Texans’ sensitive data will be met with the full force of the law.” Read that as a standing enforcement policy, not a one-time press line. The office that brought this case is the same office you answer to if your facial-recognition or voice AI touches Texas residents.

What this means for professionals

If you build, buy, or deploy any AI that processes a biometric identifier on Texans, treat CUBI as a named regime in your compliance stack alongside Illinois BIPA and the newer state privacy laws. The practical work is specific. Inventory every product surface that captures a face, a voice, or another biometric, including security cameras with recognition, retail analytics, HR and identity-verification tools, and consumer photo features. Confirm you obtain informed consent before capture, not after. Check your retention and destruction terms against the statute. Push the same questions to vendors, because a face template your vendor collected without consent is still your exposure once it runs on your customers. The Meta number is what makes this worth doing now. The reason it is durable is that CUBI did not expire when the check cleared, and the Attorney General has said plainly he intends to keep using it.

Browse the full AI Regulation News tracker

Informational analysis for working professionals, not legal or compliance advice. Confirm how the Texas Capture or Use of Biometric Identifier Act applies to your systems with qualified counsel and the Office of the Texas Attorney General.