Texas Sues Google Over AI Surveillance Data—And It’s Not the Only One

A Nest Hub Max sits on a kitchen counter somewhere in the Houston or Dallas suburbs, its camera facing the room and its microphone waiting for the wake word. The family who owns it most likely doesn’t give much thought to what happens to the data those sensors gather—the faces it has identified, the sounds it has processed, the geometry it has mapped and cataloged in ways that the typical home couldn’t explain in technical terms if questioned. Through a lawsuit brought in 2022 by then-Attorney General Ken Paxton, the state of Texas determined that it was no longer acceptable to leave unanswered the gap between what the technology performs and what the user perceives it to do. The $1.375 billion deal that was reached in May 2025 was the biggest privacy payout ever obtained by a U.S. state against a tech business.

According to the Texas lawsuit, Google has been gathering biometric identifiers from millions of Texans, including voiceprints and facial geometry, without getting their informed consent as required by state law. The products at the center of the case were well-known ones: Nest Hub Max, the smart display with an integrated camera that can identify household members; Google Photos, which automatically sorts photos into people-based albums using facial recognition; and Google Assistant, the voice-activated AI that processes spoken commands and records voice data that can be used to create and improve speaker identification profiles. The collection, storage, and disclosure of this type of data are governed by the Texas Capture or Use of Biometric Identifier Act. The main contention of the lawsuit was that Google had not complied with those criteria, and that millions of Texans had submitted their biometric data without knowing what they were consenting to or, in many cases, without consenting to anything at all.

Key Reference & Legal Information

Before the deal was reached, Google fought the accusations for years. For a company whose yearly revenues are measured in the hundreds of billions, the $1.375 billion figure, which was paid without any admission of wrongdoing as is customary in these resolutions, represented a significant financial consequence. However, it also acknowledged that fighting the case to judgment carried risks that made a settlement preferable. Regardless of the legal nuances of how it was obtained, the number itself conveyed a signal that could be heard throughout the IT sector.

The Texas action wasn’t isolated. It is a part of a nationwide trend of state-level enforcement that has been quickening as individual states have filled the void with their own legal frameworks while federal privacy legislation has remained stagnant. The $1.4 billion settlement between Texas and Meta over biometric data collection, which was reached independently and set a record at the time, showed that the CUBI Act had real teeth and that Texas was prepared to use them against the biggest tech companies in the world, regardless of their market capitalization or lobbying budgets. A group of forty state attorneys general had previously joined a multi-state lawsuit against Google for location tracking deception; this case involved a different method and a different kind of data, but the fundamental issue was that the company was gathering user data without the users’ meaningful consent.

The scope and tenacity of these initiatives demonstrate a real change in the way state governments are handling their interactions with the main tech companies. The predominant approach for the most of the 2010s was cautious observation combined with sporadic harsh correspondence. The political calculus for attorneys general who wished to show relevance on a matter that their constituents cared about was altered by a number of factors, including the GDPR’s implementation in Europe creating a template for meaningful enforcement, the Cambridge Analytica revelations making data collection politically salient in ways it hadn’t been before, and the progressive accumulation of biometric data in consumer products to the point where the practice could no longer be described as niche or hypothetical.

Location monitoring and browser history collecting don’t fully match the biometric component of these scenarios. a face. A voice. The geometry of your appearance, recorded by a camera on your kitchen counter without your conscious knowledge. These are not impersonal facts about preferences or conduct. Unlike passwords or email addresses, they are measurements of bodily identity—information that, once gathered, cannot be altered if it is misused. The $1.375 billion settlement feels like more than an accounting entry on a quarterly earnings call because of this irreversibility, which also contributes to the Texas framing of the Google case resonating outside of the legal profession.

It’s still unclear if settlements of this size will result in the behavioral shifts that state attorneys general are ostensibly looking for, or if they will just turn into an ongoing expense that tech corporations incorporate into their financial plans. In these cases, the latter is more common than the former, at least until the enforcement pressure is strong enough and the settlement sums are high enough that it is less expensive to reform the data gathering procedures than to defend them. The next few years of state-level enforcement will start to address whether that threshold has been crossed with the Texas and Meta settlements.