Meta Silently Added Face-Recognition Code for Its Smart Glasses to Millions of Phones

Meta's Hidden Face-Recognition System: What You Need to Know

In a disclosure that has sent shockwaves through the privacy and tech communities, Meta has been found to have silently embedded face-recognition code within the platform that powers its smart glasses — and the software has already made its way onto millions of smartphones worldwide. Code reviewed by WIRED uncovered an unreleased biometric identification system built directly into Meta's smart glasses infrastructure, designed to identify people using biometric data stored locally on users' devices. This revelation raises urgent questions about consent, transparency, and the future of wearable surveillance technology.

What Was Actually Discovered?

Investigators reviewing Meta's codebase found that the company had quietly embedded a facial recognition engine into the mobile application that supports its smart glasses line — most notably the Ray-Ban Meta smart glasses. The system is engineered to capture facial data through the glasses' built-in cameras and cross-reference it against biometric information already stored on the user's phone, potentially allowing the device to identify individuals in real time without their knowledge or consent.

What makes this discovery particularly alarming is how it was done: silently, without a public announcement, a press release, or any form of user notification. The code existed in a deployed state across millions of devices before anyone outside Meta's internal teams was even aware of its presence. This is not a feature that was accidentally included in a beta build — it appears to be a deliberately engineered system that was simply never disclosed to the public.

How the Face-Recognition System Works

Based on the code analysis, the system functions through a multi-step identification pipeline. Here is a simplified breakdown of how the technology appears to operate:

• Camera Capture: The smart glasses use their onboard cameras to capture video or still images of people within the wearer's field of view during normal use.
• Biometric Extraction: Facial geometry data — including the spacing between eyes, nose shape, jawline measurements, and other unique biometric markers — is extracted from the captured imagery using machine learning models.
• Local Data Matching: The extracted biometric profile is then compared against a database of facial data stored on the user's smartphone, which may include photos saved in the device's gallery, contacts with profile pictures, or other linked identity data from Meta's ecosystem of apps.
• Identification Output: If a match is found, the system can potentially surface identifying information about the person being observed — all without that person's awareness or consent.

This architecture means the system does not necessarily require a connection to a central server to function, making it harder to detect through conventional network traffic analysis and even more difficult for regulatory bodies to monitor or intercept.

Why This Matters: The Privacy Implications Are Enormous

Face recognition technology has been one of the most contentious battlegrounds in privacy law and digital rights advocacy for years. The ability to identify a stranger simply by looking at them — without any interaction, without their knowledge, and without their consent — represents a fundamental shift in the social contract around anonymity in public spaces.

Until now, that kind of identification required either law enforcement resources or the sophisticated infrastructure of a major surveillance operation. Meta's embedded system, if fully activated and deployed, would place that power in the hands of any consumer wearing a pair of stylish, inconspicuous glasses. The Ray-Ban Meta glasses, in particular, are designed to look nearly identical to ordinary eyewear, giving bystanders no reasonable way to know they are being scanned.

Privacy advocates have long warned about exactly this scenario. The concern is not merely theoretical: a person walking down the street, attending a protest, visiting a medical facility, or simply going about their daily life could be identified, tracked, and profiled by anyone wearing a pair of Meta's glasses — and they would have no way of knowing it was happening.

Meta's History with Facial Recognition

This is not Meta's first brush with facial recognition controversy. The company previously operated a facial recognition system on Facebook that automatically tagged users in uploaded photos. Following years of regulatory pressure, class-action lawsuits, and a landmark $650 million settlement in Illinois over violations of the state's Biometric Information Privacy Act (BIPA), Meta announced in 2021 that it was shutting down that system and deleting the facial data of over one billion users.

That announcement was widely interpreted as a retreat from facial recognition technology. The discovery of this newly embedded code suggests that retreat may have been temporary — or that development continued in parallel under a different product strategy, shielded from public scrutiny by the novelty of the smart glasses form factor.

Regulatory and Legal Exposure

The legal risks Meta faces from this discovery are substantial. In the United States alone, several states have enacted or are in the process of enacting biometric privacy laws modeled on Illinois's BIPA, which mandates informed written consent before any company can collect, store, or use biometric identifiers such as facial geometry. Deploying such a system — even in an unreleased or dormant state — on millions of devices without disclosure could expose Meta to significant regulatory and civil liability.

In the European Union, the situation is even more fraught. The General Data Protection Regulation (GDPR) classifies biometric data as a special category of sensitive personal data, subject to the highest tier of legal protection. Embedding face-recognition infrastructure in a consumer product and distributing it across EU member states without explicit user consent and a lawful processing basis would almost certainly constitute a serious violation of GDPR provisions, potentially triggering fines of up to four percent of Meta's global annual revenue.

What Should Consumers Do Right Now?

While Meta has not yet commented publicly on the specific code discovered by WIRED, there are steps users can take to reduce their exposure:

• Review app permissions: Check what permissions the Meta View app — which controls the Ray-Ban Meta glasses — has been granted on your smartphone, including access to your photo library, contacts, and camera.
• Audit your photo storage: If your phone's photo library contains images of friends, family members, or colleagues, consider whether you are comfortable with those images potentially being used as a biometric reference database.
• Monitor for updates: Watch for any Meta software updates that reference camera functionality, identification features, or privacy policy changes related to biometric data.
• Contact your representatives: Advocate for stronger federal biometric privacy legislation, which would create a uniform national standard for the collection and use of facial recognition data.

The Bigger Picture: Wearable Tech and the End of Anonymity

Meta's embedded face-recognition code is not an isolated incident — it is a preview of where consumer technology is heading. As smart glasses, augmented reality headsets, and AI-powered wearables become more capable and more mainstream, the technical barriers to real-time, passive facial identification will continue to fall. The question society must answer is not whether this technology is possible, but what rules, norms, and laws we want to govern its use before it becomes ubiquitous.

The discovery of this hidden system underscores one critical point: in the absence of strong, proactive regulation, companies will continue to push the boundaries of what is technically permissible. Transparency, informed consent, and meaningful user control are not features that the market consistently rewards — they are protections that must be demanded, legislated, and enforced. For now, millions of people are walking around with face-recognition code on their phones, and most of them have no idea.