Fine2024 · EU🏛️ Public sector & government suppliers

Clearview AI — EUR 90 million-plus in GDPR fines across Europe

What happened

Clearview AI scraped billions of face photos from the open web without consent, converted them into biometric templates and sold search access, mainly to law-enforcement customers. European regulators found this unlawful one after another: Italy's Garante fined it EUR 20 million (decision February 2022), Greece's HDPA EUR 20 million (July 2022), France's CNIL EUR 20 million (October 2022) plus a EUR 5.2 million overdue penalty (May 2023), and on 3 September 2024 the Dutch Autoriteit Persoonsgegevens imposed EUR 30.5 million with penalty payments of up to EUR 5.1 million for continued non-compliance.

The rule

GDPR: no lawful basis for scraping and processing biometric (special-category) data, no transparency to the people concerned, failure to honour access and erasure requests, and failure to appoint an EU representative. The Dutch DPA also declared Clearview's services illegal for Dutch organisations and said it is examining whether directors can be held personally liable.

Outcome

Fines totalling more than EUR 95 million across four countries (plus a UK ICO fine on separate grounds). Clearview has no EU establishment and is reported as having neither paid nor changed its practices, which is why the Dutch DPA is pursuing directors and warning customers that using the service is itself unlawful.

What this means for you

'Publicly available' does not mean free to use: scraping people's photos or profiles for AI is still processing personal data, and biometric data needs explicit consent or a narrow legal basis. If you buy face-matching or identity tools, you inherit the risk — regulators are now targeting customers and directors, not just the vendor.

Laws involved

GDPRIn forceEU
EU AI ActIn forceEU
PIPEDA (Canada)In forceCA-federal
Texas TRAIGAIn forceUS-TX

Sources

Last reviewed Sep 25, 2026.