This is a research prototype. The data and analyses are preliminary and not yet validated — we'd welcome your .
PimEyes is a subscription-based facial recognition search engine that allows users to upload a photo and find other images of that person across the internet. Critics and researchers argue the tool lacks sufficient safeguards, enabling stalking, harassment, and the creation of non-consensual dossiers on individuals. Despite the company's claims that it is intended for self-monitoring, the lack of effective oversight has led to widespread misuse by anonymous users on forums like 4chan.
PimEyes offered its subscription-based AI service to anyone in the public to search for matching facial images across the internet, which critics said lacked public oversight and government rules to prevent itself from misuse such as stalking women.
Domain classification, causal taxonomy, severity scores, and national security assessments were LLM-classified and may contain errors.
AI systems that memorize and leak sensitive personal data or infer private information about individuals without their consent. Unexpected or unauthorized sharing of data and information can compromise user expectation of privacy, assist identity theft, or cause loss of confidential intellectual property.
Also classified as
The tool is actively exploited by malicious actors on forums like 4chan to stalk, dox, and compile humiliating dossiers on targeted female victims.
PimEyes allows users to upload a photo of any individual and correctly infer their identity and online presence across 900 million indexed images without their consent.
Human
Due to a decision or action made by humans
Intentional
Due to an expected outcome from pursuing a goal
Post-deployment
Occurring after the AI model has been trained and deployed
The primary risks and harms arise from the intentional deployment of the tool without safeguards by its developers and the intentional misuse of the tool by stalkers and anonymous users.
Added categories peak at 3: Substantial (Psychological Harm, Inferred)
PimEyes represents a significant advancement in democratized mass biometric surveillance, allowing anonymous users to deanonymize individuals globally. While its primary impacts are societal, affecting privacy and human rights through stalking and doxxing, its capability to track individuals poses long-term concerns for information security and personal privacy.
PimEyes operates as a tool that performs a specific, well-defined function of matching an uploaded face image against a database of indexed web images, producing deterministic outputs based on direct input.
High Risk: The system is a facial recognition application available to the general public, which falls under biometric identification and law enforcement-adjacent surveillance technologies.
The primary function of PimEyes is to perform facial recognition on uploaded photos to search for matching faces across the internet.
The report provides detailed, first-hand accounts, security researcher testimonies, and specific examples of how the PimEyes tool is used and abused. The mechanics of the tool and its societal impacts are clearly documented.
The company claims the tool is a boon for privacy by allowing self-monitoring, though evidence strongly points to its primary use as a surveillance and stalking tool.
Technology
Highly Accurate Matching Algorithm
Enables precise matching across different ages and head positions.
Off-the-Shelf Open Source AI
Freely available tools like FaceNet lower barriers to build facial search.
Web Scraping Bots
Spiders crawl the web, scanning and indexing faces as numerical code.
Data Inputs
Unconsented Image Scraping
Scrapes 900 million images from across the web without user consent.
Indexing of Sensitive Sites
Catalogues images on pornographic websites and social media.
Lack of Data Verification
No verification of the source or ownership of indexed photos.
Human Factors
Stalking and Harassment
Users utilize the tool to stalk women and compile personal details.
Vigilante Investigations
Sedition hunters use the tool for crowdsourced policing without training.
Circumvention of Terms
Users easily bypass terms of service to search for other people.
Process and Methods
Flawed Self-Search Verification
Enforces self-search rule with just a single, easily bypassed checkbox.
Pay-to-Block Model
Requires users to pay a monthly fee to block their photos from searches.
One-at-a-Time Removal
Allows manual removal of only one image at a time unless paying.
Management
Prioritizing Profit Over Safety
Monetized advanced search and opt-out features despite abuse risks.
Extreme Corporate Anonymity
Owners hide identities and corporate details in offshore havens.
Lack of User Accountability
Management shifts blame for abuse entirely onto the end-users.
Regulatory Environment
Absence of National Regulation
No federal laws regulate public facial recognition use in the US.
Jurisdictional Obscurity
Company registered in Seychelles to evade strict EU GDPR regulations.
Lack of Public Oversight
No government rules control public access to powerful surveillance tools.
AI system involved
Identified by automated extraction; can differ from the alleged developers above.
