Facial recognition software company Clearview AI has agreed to limit U.S. sales of its identity database to businesses and other private actors as part of a lawsuit settlement. The case, brought by the American Civil Liberties Union (ACLU) and other groups, was filed in state court in Illinois, where the Biometric Information Privacy Act (BIPA) is considered the nation’s strongest data privacy law. The lawsuit alleged that Clearview routinely scraped images of state residents from the Internet without obtaining their permission or making them aware of the practice.

Clearview is said to have a worldwide database containing over 20 billion facial images. Under the settlement, Clearview “can largely still sell that database to federal and state agencies” in the U.S., reports The New York Times, noting the company makes its products available “to local police departments and government agencies, including the FBI and Immigration and Customs Enforcement.”

In parts of Europe as well as Canada and Australia, Clearview’s business model has been determined to violate privacy laws.

The settlement is described by NYT as “the latest blow to the New York-based startup, which built its facial recognition software by scraping photos from the web and popular sites such as Facebook, LinkedIn and Instagram.” In the UK, Clearview “faces a provisional $22.6 million fine” and the company has been hit with a 20 million-euro fine in Italy as well, NYT reports.

“Clearview can no longer treat people’s unique biometric identifiers as an unrestricted source of profits,” ACLU Speech, Privacy and Technology Project deputy director Nathan Freed Wessler said in NYT. “Other companies would be wise to take note, and other states should follow Illinois’s lead in enacting strong biometric privacy laws.”

A Clearview attorney, First Amendment expert Floyd Abrams, says it’s within the company’s rights to collect publicly available material and make it searchable, but that the agreement to settle was made “to avoid a protracted, costly and distracting legal dispute with the ACLU and others,” NYT reports.

As part of the settlement, Clearview will be banned from providing data to “law enforcement or government agencies within Illinois for the next five years” and Illinois residents can “block their faces from appearing in Clearview search results,” The Hill reports.

The ACLU lawsuit was filed in May 2020, the year the company declared “it would stop working with private companies, cutting off a list that at one point apparently included Bank of America, Macy’s, and Walmart,” write The Verge. Since then, the company has focused on its businesses involving “thousands of local law enforcement departments and federal agencies like the Justice Department, which have controversially used it for both general-purpose police work and unusual events like the January 6th, 2021 Capitol riot.”

In February, Clearview told  investors it is on track to have 100 million photos — equivalent to 14 photos for each of the earth’s 7 billion people — in its database by the end of 2022.

Related:
ICE Uses Data Brokers to Bypass Surveillance Restrictions, Report Finds, The Verge, 5/10/22