This is a research prototype. The data and analyses are preliminary and not yet validated — we'd welcome your .
Everalbum, a photo storage app, deceived millions of users by using their uploaded photos to train facial recognition models without informed consent. The company then marketed this technology to enterprise clients, including law enforcement and military agencies. Following an FTC investigation, the company was ordered to delete the illegally trained models and algorithms and to obtain express consent for future biometric data usage.
Ever AI, now Paravision AI, allegedly failed to inform customers about the development and use of facial recognition that facilitates the sale of customers’ data to various businesses, a business model that critics said was an egregious violation of privacy.
Domain classification, causal taxonomy, severity scores, and national security assessments were LLM-classified and may contain errors.
AI systems that memorize and leak sensitive personal data or infer private information about individuals without their consent. Unexpected or unauthorized sharing of data and information can compromise user expectation of privacy, assist identity theft, or cause loss of confidential intellectual property.
Also classified as
The harvested data was used to develop and train facial recognition models marketed to law enforcement and military for surveillance purposes.
The company extracted biometric face embeddings and trained facial recognition models using private, non-public photos uploaded by users to a cloud storage app without their consent.
Human
Due to a decision or action made by humans
Intentional
Due to an expected outcome from pursuing a goal
Post-deployment
Occurring after the AI model has been trained and deployed
The privacy violations and unauthorized data harvesting were caused by intentional human decisions to train facial recognition models using deployed consumer app data.
Added categories peak at 2: Minor (Psychological Harm, Direct)
Everalbum covertly used billions of user photos to train facial recognition models, which it then marketed to law enforcement and military agencies. The FTC intervened, ordering the deletion of the illegally trained models. This incident highlights substantial risks to societal stability and privacy rights, demonstrating how consumer data can be weaponized for mass surveillance without user consent.
The AI system is described as a facial recognition tool used to group photos by faces and allow users to tag people. It operates on direct inputs (uploaded images) to perform specific, well-defined matching and classification functions without autonomous planning or agency.
High Risk: The report describes facial recognition technology intended for law enforcement and biometric identification, which falls under High Risk applications. The FTC complaint specifically notes the creation of face embeddings and biometric data from photos.
The primary purpose of the Ever AI system was to perform facial recognition and matching, which was also used in the consumer app for grouping and tagging photos.
The reports provide consistent, detailed accounts of Everalbum's actions, the FTC investigation, and the subsequent settlement. The facts regarding the unauthorized use of photos, the scale of the dataset, and the regulatory outcomes are well-documented across multiple reputable sources.
None
Technology
Default-on Facial Recognition
Facial recognition was automatically enabled for most users.
Undisclosed AI Model Training
Billions of private photos were used to train facial recognition algorithms.
Data Deletion Failure
System failed to delete photos from deactivated accounts, retaining them.
Data Inputs
Non-Consensual Personal Photos
Private family photos were harvested for AI training without consent.
Unconsented Biometric Extraction
Biometric face embeddings were derived from users' uploaded images.
Combined Datasets
Private images were mixed with public datasets to train enterprise models.
Human Factors
User Lack of Awareness
Users were unaware their private photos trained surveillance technology.
Deceptive Privacy Explanations
Users were misled by warm branding and unclear privacy policy terms.
Overlooking User Consent
Company assumed passive consent through unread terms of service.
Process and Methods
Inadequate Disclosure Processes
AI training practices were buried in a long privacy policy.
Flawed Deactivation Workflows
Processes failed to delete user data after account deactivation.
Geographically Inconsistent Controls
Opt-out controls were restricted to specific regions with strict laws.
Management
Prioritizing Profit Over Privacy
Pivoted to B2B AI business model to achieve venture-scale growth.
Deceptive Consumer Representation
Misrepresented data practices to maintain consumer trust and downloads.
Lack of Ethical AI Oversight
No AI ethics advisor or principles existed during initial development.
Regulatory Environment
Absence of Federal AI Laws
Lack of federal facial recognition laws enabled invasive practices.
Weak Initial Enforcement
Regulatory bodies historically allowed companies to keep ill-gotten models.
Lack of Biometric Regulations
Inadequate legal frameworks to protect biometric data nationally.
AI system involved
Identified by automated extraction; can differ from the alleged developers above.
