Meta paid $1.4 billion to the state of Texas in July 2024 to settle claims that it illegally captured and used the biometric data of millions of residents without their consent — no federal law required, no class-action plaintiff needed. Just one state attorney general, a decade-old state statute, and enough political will to go after the world’s largest social network. As Calcalist Tech reported, the settlement is the largest privacy-related payout ever secured by a single state, and it signals something bigger than the dollar figure suggests. For anyone watching AI security and data-rights policy converge, this is the moment state-level enforcement stopped being a secondary concern for platform giants.
Texas Attorney General Ken Paxton brought the case under the Texas Capture or Use of Biometric Identifier Act, a 2009 law that predates the smartphone camera era but has teeth sharp enough to draw real blood. Meta’s facial recognition features — including the now-discontinued Tag Suggestions tool on Facebook — were found to have collected biometric identifiers from Texas users without the explicit informed consent the law demands. The $1.4 billion figure dwarfs the $650 million Meta paid in 2022 to settle a similar Illinois biometric privacy class action, itself a record at the time.
Why $1.4 Billion Is Both a Win and a Warning Sign for Meta
For a company that generated roughly $134 billion in revenue in 2023 alone, $1.4 billion is painful but survivable — closer to a rounding error than an existential threat. Meta admitted no wrongdoing as part of the deal. It also didn’t have to change any current product behavior, since the facial recognition feature at the center of the case had already been killed off in 2021. Critics will rightly point out that the settlement lets Meta write a check and walk away from conduct that affected tens of millions of people.
But that framing misses the structural shift the settlement represents. Paxton’s office pursued this case entirely under state law, requiring no federal legislation, no Congressional action, and no cooperation from a gridlocked Washington. The Texas statute allows fines of up to $25,000 per violation — and with millions of affected users, the theoretical liability ceiling was astronomical, giving the state genuine leverage at the negotiating table. The $1.4 billion outcome validates that playbook completely.
The Template Other States Are Already Studying
The Texas settlement lands at a moment when at least a dozen other states have passed or are actively advancing biometric privacy laws modeled on Illinois’s BIPA framework. States including Washington, Maryland, and New York have versions of biometric data rules on the books or moving through legislatures. Each one now has a very concrete proof point: a determined state AG can extract ten-figure settlements from Big Tech without waiting for Washington to act. That is not a minor development — it is a reorientation of where privacy enforcement power actually lives in the United States.
For platforms that rely on facial recognition, voice data, or behavioral biometrics — categories that increasingly overlap with AI training pipelines — the calculus just changed. A company operating in all 50 states now has to model potential liability under 50 different legal regimes, each capable of pursuing nine or ten-figure recoveries. The cost of non-compliance is no longer theoretical. Meta got off relatively easy here given the scale of the conduct alleged. The next company in the crosshairs may not be so fortunate — and that, more than the dollar figure, is what makes this settlement worth watching closely.
