This is a research prototype. The data and analyses are preliminary and not yet validated — we'd welcome your .
A class action lawsuit was filed in Madison County, Illinois, against Pimeyes and several associated entities, alleging that their facial recognition search engine violates the Illinois Biometric Information Privacy Act (BIPA). The plaintiffs claim the service collects and stores biometric data from millions of individuals without obtaining the required informed written consent. The lawsuit seeks damages and an injunction to force the company to comply with BIPA regulations.
A class action lawsuit was filed against several facial recognition technology companies for allegedly violating the Illinois Biometric Information Privacy Act (BIPA). The defendants are accused of offering a facial recognition search engine called Pimeyes, which collects images from databases across the internet and scans them into their database seemingly without consent. This action is claimed to invade the privacy of millions of Americans. The lawsuit argues that Pimeyes lacks publicly available policies regarding data storage and deletion, in contravention of BIPA's requirements for informed written consent before collecting biometric data.
Domain classification, causal taxonomy, severity scores, and national security assessments were LLM-classified and may contain errors.
AI systems that memorize and leak sensitive personal data or infer private information about individuals without their consent. Unexpected or unauthorized sharing of data and information can compromise user expectation of privacy, assist identity theft, or cause loss of confidential intellectual property.
The incident involves the unauthorized collection, scanning, and storage of biometric facial templates of millions of individuals, directly compromising their privacy.
Human
Due to a decision or action made by humans
Intentional
Due to an expected outcome from pursuing a goal
Post-deployment
Occurring after the AI model has been trained and deployed
The privacy violations occurred because humans intentionally designed, built, and deployed the Pimeyes facial recognition search engine to scrape and process biometric data.
The class action lawsuit against Pimeyes highlights substantial privacy and civil rights concerns regarding the unauthorized scraping and scanning of biometric data of millions of Americans. While it poses minor long-term risks to intelligence security through open-source tracking, the primary impact is on societal stability and human rights due to the erosion of privacy protections at scale.
The report describes Pimeyes as a facial search engine that performs a specific, well-defined function: searching the internet for photos that contain a given face based on direct user input.
Unacceptable Risk: The AI system involves the untargeted scraping of facial images from the internet to create a facial recognition database, which is a prohibited practice under the EU AI Act.
The system is explicitly described as a facial recognition search engine that scans and searches for faces across the internet.
The report clearly outlines the legal allegations, the specific AI technology (facial recognition search engine), the parties involved, and the nature of the privacy violations under BIPA. There is little ambiguity regarding the facts of the lawsuit.
None
Technology
AI Facial Recognition Scanning
AI extracts biometric faceprints from internet photos without authorization.
Unrestricted Search Engine
Allows anyone to search for and download photos of any person.
Data Inputs
Unconsented Web Scraping
Harvesting millions of photos from online databases without consent.
Continuous Database Ingestion
Automatically updating the database with newly scraped internet photos.
Human Factors
User Misuse Potential
Customers can search for individuals without their knowledge or consent.
Process and Methods
Lack of Consent Process
No process to inform users or get written release before harvesting data.
Absent Data Retention Policy
No written, public policy on biometric data storage and destruction.
Management
Negligent Risk Management
Prioritized growth and scraping over privacy laws and user rights.
Lack of Operational Transparency
Management failed to publish clear policies on data handling practices.
Regulatory Environment
BIPA Violations
Failure to comply with Illinois Biometric Information Privacy Act rules.
AI system involved
Identified by automated extraction; can differ from the alleged developers above.
