In most places, running a facial recognition search is legal. The law regulates a narrower act, turning a face into a biometric template, along with who does it, for what purpose and with whose consent. So the answer differs for a person checking one photo and for a company running the engine. This is a plain map of the main rules. It is not legal advice, and a decision with real consequences needs advice for your own jurisdiction.
Europe regulates the template
The GDPR defines biometric data in Article 4(14) as personal data from specific technical processing of a person’s physical characteristics “which allow or confirm the unique identification of that natural person, such as facial images”. Recital 51 draws the line that matters for face search: photographs are not automatically special-category data, and count as biometric only “when processed through a specific technical means allowing the unique identification or authentication of a natural person”.
Together, those passages leave a photo as ordinary personal data, and computing a face template to match it is what moves the processing into Article 9. Article 9(1) prohibits processing “biometric data for the purpose of uniquely identifying a natural person”. Article 9(2) lists the exceptions, and the first is explicit consent for specified purposes. Under Article 83(5), breaching Article 9 can cost up to EUR 20 million or 4% of worldwide annual turnover, whichever is higher.
That structure is hard on any engine that indexes faces from the open web, because it has no practical way to collect explicit consent from everyone in its index. In the Clearview decision below, the Dutch regulator found that none of the statutory exceptions applied.
The AI Act bans one way of building the index
Article 5(1)(e) of the EU AI Act prohibits “the placing on the market, the putting into service for this specific purpose, or the use of AI systems that create or expand facial recognition databases through the untargeted scraping of facial images from the internet or CCTV footage”. The prohibitions have applied since 2 February 2025, and breaching them can cost up to EUR 35 million or 7% of worldwide annual turnover. The word “use” sits in the prohibition next to placing on the market and putting into service, which matters to companies buying such a service as much as to those building one.
Clearview AI shows how regulators apply it
On 3 September 2024 the Dutch Data Protection Authority announced a EUR 30.5 million fine on Clearview AI, plus orders carrying penalties of up to EUR 5.1 million if the violations continued. The authority said Clearview had scraped more than 30 billion photos from the internet and converted each face into a unique biometric code, without the people’s knowledge or consent. It said the company “should never have built the database”, that it gave people too little information, and that it did not answer access requests. Clearview did not object to the decision and so could not appeal the fine.
The Dutch authority also addressed customers: “using the services of Clearview is also prohibited”, and Dutch organisations that use it “may therefore expect hefty fines”. It said it would investigate whether Clearview’s directors could be held personally liable. For a business buyer, that means a vendor’s unlawful database can turn into the buyer’s own fine.
The UK case shows how long enforcement can take. On 18 May 2022 the Information Commissioner’s Office issued Clearview, a Delaware company with no UK corporate presence, an enforcement notice and a fine of £7,552,800. The ICO found infringements of Articles 5, 6, 9, 14, 15 to 17, 21 and 22 of the GDPR and UK GDPR, and a failure to carry out a data protection impact assessment. A First-tier Tribunal decided on 17 October 2023 that the ICO lacked jurisdiction. The Upper Tribunal set that decision aside in a judgment authorised for issue on 6 October 2025, held that the ICO did have jurisdiction to issue both notices, and sent the substantive appeal back to a new First-tier Tribunal. The ICO’s view that scraping UK residents’ faces falls under UK data protection law has survived the jurisdiction fight, and the merits are still to be decided.
Three US states, three enforcement models
In the United States, three state statutes show how far apart the rules sit.
Illinois has the Biometric Information Privacy Act. It counts a “scan of hand or face geometry” as a biometric identifier and expressly excludes photographs, the same template-versus-photo split as the GDPR. A private entity must tell the person in writing what it is collecting, why and for how long, and obtain a written release before collecting. It must publish a retention schedule, may not sell or profit from the data, and faces private lawsuits with liquidated damages of $1,000 per negligent violation and $5,000 per intentional or reckless one. A 2024 amendment, in force from 2 August 2024, makes repeated collection of the same identifier from the same person by the same method a single violation with at most one recovery.
Texas enforces through its attorney general. Under the Capture or Use of Biometric Identifier Act, the Texas Attorney General sued Meta in February 2022 and announced a $1.4 billion settlement on 30 July 2024, the first lawsuit and first settlement under that law. The office said Meta’s Tag Suggestions feature, launched in 2011, ran facial recognition on virtually every face in photos uploaded to Facebook without the informed consent Texas law requires.
Washington’s biometric identifiers law, RCW 19.375, takes a third route. It bars enrolling a biometric identifier in a database for a commercial purpose without notice, consent or a way to prevent later commercial use, it also excludes photographs from its definition, and it “may be enforced solely by the attorney general”.
An individual checking a photo, and a company running face search
The GDPR does not apply to processing “by a natural person in the course of a purely personal or household activity”. Recital 18 counts “social networking and online activity” among those activities, then adds that the Regulation still “applies to controllers or processors which provide the means for processing personal data for such personal or household activities”. A person checking whether a new online contact’s photos belong to someone else may sit inside that exemption. The service that performs the search never does. Purpose still matters for the individual, because recital 18 limits the exemption to activity “with no connection to a professional or commercial activity”, so a search run for a business reason falls outside it.
FaceSearch’s page on is face search legal frames it the same way. It says the search itself and the use of the result are regulated separately, and that verifying someone you are already dealing with is treated very differently from profiling a stranger. A face search shows the public pages where a similar face appears. It cannot see private accounts, and it cannot confirm who a person is.
For a company deploying or buying face search, the map turns into a short list:
- Work out where the people in your images live. The EU, the UK, Illinois, Texas and Washington each change the answer.
- Name your Article 9 exception before processing any face in Europe. For most private uses that means explicit consent.
- In Illinois, give written notice of purpose and term and get a written release before collecting face geometry.
- Publish a retention schedule. BIPA requires destruction once the purpose is met or within 3 years of the person’s last interaction, whichever comes first.
- Ask each vendor in writing how its face database was built. Untargeted scraping is prohibited in the EU, and the Dutch regulator treats using a non-compliant service as unlawful too.
- Never sell or otherwise profit from biometric identifiers.
If your own face is in a database you never agreed to and you live in the EU, start with a written access request to the company. If it does not answer, Article 77 of the GDPR gives you the right to complain to a data protection authority, in particular in the country where you live or work.
