The American Civil Liberties Union (ACLU) filed a suit in Illinois against facial recognition startup Clearview AI over privacy and safety violations. It accused the company of breaking “the 2008 Illinois Biometric Information Privacy Act, that bans companies from using a resident’s fingerprints or face scans without consent” and allows a resident to sue such companies for $5,000 per violation. The New Jersey and Vermont state attorneys general ordered Clearview to cease collecting their residents’ photos, and people in New York and Vermont also filed suits.

The New York Times reports that, “the company had amassed a database of more than three billion photos across the Internet, including from Facebook, YouTube, Twitter and Venmo.” “The bottom line is that, if left unchecked, Clearview’s product is going to end privacy as we know it,” said ACLU lawyer Nathan Freed Wessler.

The ACLU’s complaint states that Clearview’s mass database includes “millions of Illinoisans, entirely unbeknownst to those people, and offers paid access to that database to private and governmental actors worldwide.” Clearview AI attorney Tor Ekeland responded that, “Clearview AI is a search engine that uses only publicly available images accessible on the Internet.”

ACLU clarified that its lawsuit “challenges the secret, nonconsensual and unlawful capture of individuals’ biometric identifiers from those images.”

The lawsuit, prepared by the ACLU, the ACLU of Illinois and law firm Edelson PC, includes the support of multiple special interest groups. A federal study released last December “found that most commercial facial recognition systems exhibited bias, falsely identifying African-American and Asian faces 10 to 100 times more than Caucasian faces.”

CNN reports that Clearview AI founder Hoan Ton-That stressed that its service “is not for public use, but instead is an investigative tool sold to law enforcement used to help identify suspects and solve crimes.” The company stated that 600+ law enforcement agencies in the U.S. and Canada use its database.

But privacy advocates warn that “many people may not realize when posting a photo of themselves — even if they’re posting it publicly — that it could be swept up into a massive database and used by law enforcement.” Even if the person deletes the photo, it will “still show up in Clearview’s database.”

CNN adds that, “Twitter, Google, Facebook and other tech companies have sent Clearview cease and desist letters, saying the tool violates their terms of service,” but Clearview insisted that, “there is a First Amendment right to public information.” The ACLU countered that the company’s “capture and storage of biometric identifiers” is not “conduct” protected by the First Amendment.

A hacker gained access to Clearview’s “entire client list, which includes police forces, law enforcement agencies and banks” in February, said the company. New Jersey has put in place “a statewide ban on law enforcement using Clearview while it looks into the software.” Meanwhile, Ton-That said the company wants “to work with the government to create something that is safe,” adding that they have met with lawmakers.

The ACLU press release can be found here.