As part of the settlement in ACLU v. Clearview AI, the company is now permanently banned, nationwide, from making its faceprint database available to most businesses and other private actors.
CHICAGO – Under a legal settlement filed in court today, Clearview AI — a secretive face surveillance company claiming to have captured more than 10 billion faceprints from peoples’ online photos across the globe — has agreed to a new set of restrictions that ensure the company is in alignment with the Illinois Biometric Information Privacy Act (BIPA), a groundbreaking Illinois privacy law.
The central provision of the settlement restricts Clearview from selling its faceprint database not just in Illinois, but across the United States. Among the provisions in the binding settlement, which will become final when approved by the court, Clearview is permanently banned, nationwide, from making its faceprint database available to most businesses and other private entities. The company will also cease selling access to its database to any entity in Illinois, including state and local police, for five years.
“By requiring Clearview to comply with Illinois’ pathbreaking biometric privacy law not just in the state, but across the country, this settlement demonstrates that strong privacy laws can provide real protections against abuse,” said Nathan Freed Wessler, a deputy director of the ACLU Speech, Privacy, and Technology Project. “Clearview can no longer treat people’s unique biometric identifiers as an unrestricted source of profit. Other companies would be wise to take note, and other states should follow Illinois’ lead in enacting strong biometric privacy laws.”
“There is a battle being fought in courtrooms and statehouses across the country about who is going to control biometrics—Big Tech or the people being tracked by them—and this represents one of the biggest victories for consumers to date,” said J. Eli Wade-Scott from Edelson PC, a nationally recognized-leader in consumer privacy litigation that recently obtained a $650 million settlement in a BIPA case with Facebook, which has also announced that it will curtail its facial recognition practices nationwide.
The restrictions are detailed in an agreement resolving a lawsuit filed against Clearview in May 2020 on behalf of groups representing survivors of domestic violence and sexual assault, undocumented immigrants, current and former sex workers, and other vulnerable communities uniquely harmed by face recognition surveillance. The lawsuit alleged that Clearview repeatedly violated the Illinois Biometric Information Privacy Act (BIPA), a law adopted in 2008 to ensure that Illinois residents would not have their biometric identifiers – including faceprints – captured and used without their knowledge and permission.
“This settlement is a big win for the most vulnerable people in Illinois,” said Linda Xóchitl Tortolero, president and CEO of Mujeres Latinas en Acción, a Chicago-based non-profit. “Much of our work centers on protecting privacy and ensuring the safety of survivors of domestic violence and sexual assault. Before this agreement, Clearview ignored the fact that biometric information can be misused to create dangerous situations and threats to their lives. Today that’s no longer the case.”
Under the settlement agreement filed in Illinois state court today:
- Clearview will be permanently banned from granting paid or free access to its gargantuan face recognition database to private entities (including both private companies and private individuals) nationwide, subject to narrow exceptions contained in BIPA;
- Clearview will be banned from granting access to its database to any state or local government entity in Illinois (including law enforcement) for a period of five years. This means that within Illinois, Clearview cannot take advantage of BIPA’s exception for government contractors during that time;
- Clearview will be banned from granting access to its database to any private entity in Illinois for five years, meaning Clearview cannot take advantage of any of BIPA’s exceptions allowing sales to certain types of businesses during that time;
- Clearview will maintain an opt-out request form on its website, allowing Illinois residents to upload a photo and fill out a form to ensure their faceprints will be blocked from appearing in Clearview’s search results, including for Clearview’s law enforcement users. The company will also commit $50,000 to pay for internet ads publicizing the opt-out mechanism. Clearview is prohibited from using the photos people upload as part of this opt-out process for any purpose other than effectuating the opt-out program;
- Clearview will end its practice of offering free trial accounts to individual police officers, without the knowledge or approval of their employers; and
- Over the next five years, Clearview will continue its current measures to attempt to filter out photographs that were taken in or uploaded from Illinois.
Recently, Clearview announced that it was on track to have 100 billion face prints in its database within a year, enough to ensure “almost everyone in the world will be identifiable.” These images — equivalent to 14 photos for each of the 7 billion people on Earth — would enable covert and remote surveillance of Americans on a scale unlike anything seen before. Reports suggest that neither the U.S. government nor any American company has ever compiled such a massive trove of biometrics.
BIPA requires companies that collect, capture, or obtain an Illinois resident’s biometric identifier — such as a fingerprint, faceprint, or iris scan — to first notify that individual and obtain their written consent. This is because the involuntary and surreptitious capture of biometric identifiers — which cannot be changed — can pose greater risks to an individual’s security, privacy, and safety than the capture of other identifiers, such as names and addresses.
“Fourteen years ago, the ACLU of Illinois led the effort to enact BIPA – a groundbreaking statute to deal with the growing use of sensitive biometric information without any notice and without meaningful consent,” said Rebecca Glenberg, staff attorney for the ACLU of Illinois. “BIPA was intended to curb exactly the kind of broad-based surveillance that Clearview’s app enables. Today’s agreement begins to ensure that Clearview complies with the law. This should be a strong signal to other state legislatures to adopt similar statutes.”
The plaintiffs in the lawsuit are the Chicago Alliance Against Sexual Exploitation, the Sex Workers Outreach Project Chicago, the Illinois State Public Interest Research Group, Mujeres Latinas en Acción, the ACLU, and the ACLU of Illinois. They are represented by the ACLU, the ACLU of Illinois and Edelson PC.