This is a research prototype. The data and analyses are preliminary and not yet validated — we'd welcome your .
The Dutch data protection authority (DPA) fined Clearview AI €30.5 million for building an illegal facial recognition database by scraping billions of images from the internet without user consent. The DPA stated that the company's actions violate GDPR and privacy laws, noting that the database is used to provide facial recognition services to law enforcement agencies. Despite multiple fines across Europe, the company continues to operate its database, which reportedly contains up to 50 billion images.
Clearview AI was fined $33.7 million by the Dutch data protection authority for allegedly creating an illegal facial recognition database by scraping billions of images from the Internet without consent. The company used AI to convert these images into biometric data and sold the service to law enforcement. This act was in violation of privacy laws and the GDPR.
Domain classification, causal taxonomy, severity scores, and national security assessments were LLM-classified and may contain errors.
AI systems that memorize and leak sensitive personal data or infer private information about individuals without their consent. Unexpected or unauthorized sharing of data and information can compromise user expectation of privacy, assist identity theft, or cause loss of confidential intellectual property.
Also classified as
The database is sold to law enforcement and intelligence agencies, enabling large-scale, automated surveillance and tracking of the global population.
The incident centers on Clearview AI obtaining and processing sensitive biometric data from billions of individuals without their consent, violating fundamental privacy regulations.
Human
Due to a decision or action made by humans
Intentional
Due to an expected outcome from pursuing a goal
Post-deployment
Occurring after the AI model has been trained and deployed
The privacy risks and regulatory violations were caused by the intentional decisions of Clearview AI's management to scrape public images and build a commercial biometric database.
Clearview AI built an illegal facial recognition database of 30 to 50 billion images without consent, used by global law enforcement. Despite multiple millions in EU fines, the company refuses to comply, posing significant long-term risks to global privacy, human rights, and state regulatory sovereignty.
The AI system operates as a tool for law enforcement, performing the specific function of matching input images against a database to identify individuals, requiring direct human input and oversight to execute searches.
High Risk: The report describes a facial recognition system used for law enforcement applications, which is explicitly classified as High Risk under the EU AI Act definitions.
The primary function of the Clearview AI system is to perform facial recognition by converting images into biometric codes and matching them to identify individuals.
The reports provide clear, consistent details about the Dutch DPA's regulatory action, the scale of Clearview AI's database, and the company's response. There is no significant ambiguity regarding the nature of the AI system or the privacy violations.
None
Technology
Automated Photo Scraping
Software automatically harvested billions of images from the internet.
Biometric Code Generation
Converts scraped photos into unique biometric templates without consent.
Mass Facial Recognition Database
Built a massive database of 30-50 billion images for search matching.
Data Inputs
Unconsented Data Harvesting
Images were scraped from social media without user knowledge or consent.
Lack of Biometric Opt-In
No mechanism for individuals to opt-in or prevent their data collection.
Public Internet Data Exploitation
Leveraged publicly available social media photos for commercial tracking.
Human Factors
User Unawareness of Scraping
General public is unaware their uploaded photos are scraped into databases.
Law Enforcement Overreliance
Agencies embrace intrusive tech to bypass local bans or constraints.
Process and Methods
Insufficient Transparency
Company operates without clear disclosures on database inclusion.
Unregulated Sales to Police
Selling highly intrusive tracking software directly to law enforcement.
Management
Prioritizing Growth Over Compliance
Management expanded database to 50 billion faces despite EU sanctions.
Disregard for GDPR Compliance
Leadership claims GDPR does not apply to their offshore operations.
Failure to Object to Rulings
Management failed to formally object, losing Dutch appeal rights.
Regulatory Environment
Jurisdictional Loopholes
Non-EU companies exploit lack of physical presence to evade GDPR.
Inconsistent Global Regulation
Differences in international privacy laws allow regulatory evasion.
Difficult Enforcement Mechanisms
Regulators struggle to enforce fines on foreign, non-established firms.
AI system involved
Identified by automated extraction; can differ from the alleged developers above.
