Clearview AI faces massive fines and bans across Europe for illegal biometric surveillance

Clearview AI received fines and bans in multiple European countries for building a facial recognition database from billions of scraped images. The company collected photos from public social media sites without user permission and sold access to law enforcement agencies. This enforcement action proves the EU AI Act is now a working enforcement tool rather than just a guideline.

The mechanism

Clearview AI scraped billions of images from public websites and social media platforms. They did not ask for consent. They built a massive database of faces and sold access to this database to police departments and other government bodies. The system works by comparing a live photo against the database to find a match.

The governance failure

The company treated a high-risk biometric system as a standard database. They failed to establish a lawful basis for processing the data under GDPR. They did not conduct a fundamental rights impact assessment. They ignored the specific restrictions placed on biometric identification systems in the EU AI Act Annex III. This led to a system that operates in public spaces without proper oversight or legal grounding.

The law in plain words

The EU AI Act classifies real-time remote biometric identification in public spaces as high-risk. Annex III §1 explicitly prohibits these systems for law enforcement purposes. The Act requires providers to conduct a thorough risk assessment and establish strict legal grounds for processing. The Act also restricts the use of biometric data for non-analytical purposes in sensitive environments.

What this means

Clearview is now restricted from operating in the public sector in several nations. This sets a clear precedent for other vendors. Companies cannot rely on the fact that data is public to justify scraping it. They must treat biometric data with the highest level of protection. The Act’s high-risk rules apply from 2 December 2027, but enforcement actions like this show regulators will act on the spirit of the law sooner.

What to do

• Map all vendors that handle biometric data to Annex III of the EU AI Act. - Conduct a fundamental rights impact assessment for any system that matches faces. - Audit your data collection sources to ensure you have a lawful basis for processing. - Establish retention policies that delete biometric data as soon as it is no longer needed.

More from our platforms

These sister platforms cover the parts of this problem that sit outside governance.

• Argus (argus.threatclaw.ai) records every trace an AI application produces and scans it for prompt injection, jailbreaks and data leaks, including the attacks hidden inside retrieved documents and tool results rather than in what the user typed. Governance decides what an AI agent is allowed to do. Argus shows what it actually did.
• ThreatClaw (www.threatclaw.ai) tracks the threat side of the same systems: 22 live intelligence feeds, exploitation predicted before it is officially confirmed, threat actor profiles, and detection rules you can deploy straight away. A control is only as good as the threat it is sized against.