Investigations

Clearview AI Scraped Billions of Photos Without Anyone's Consent to Build a Facial Recognition Database. Its Legal Defense Is That the First Amendment Gave It the Right.

In January 2020, Kashmir Hill of The New York Times published a story about a company almost no one had heard of: a small startup called Clearview AI that had built a facial recognition app capable of identifying a stranger from a single photo, then surfacing every other picture of that person's face it could find on the open internet. The company had been quietly selling access to more than 600 law enforcement agencies for over a year. Almost none of them would say, on the record, that they were using it.

The app worked by comparing an uploaded photo against a database Clearview had built by scraping more than three billion images — later revised upward, repeatedly, until the company's own regulators put the number above thirty billion — from Facebook, Instagram, Twitter, YouTube, Venmo, LinkedIn, and millions of other public websites. None of those platforms had given permission. None of the people in the photos had either.

A Search Engine Built From Everyone Else's Photos

Clearview AI was founded in 2017 by Hoan Ton-That, an Australian entrepreneur and former model, and Richard Schwartz, a former aide to New York mayor Rudy Giuliani. The two met through the Manhattan Institute, a conservative think tank, and initially registered the company under the name Smartcheckr. Early funding of roughly $8.4 million came from investors including Kirenaga Partners and Peter Thiel, the venture capitalist and early Facebook investor.

The pitch was simple: instead of relying on a limited, government-controlled mugshot database — the way facial recognition had worked for two decades — Clearview would index the entire public internet. A scraper harvested photos and their surrounding metadata from any site it could reach; a proprietary algorithm converted each face into a numerical "vector"; the vectors went into a searchable index. Upload a photo of a stranger, and Clearview would return a grid of that stranger's other photos, with links to where each one was posted — a person's name, their friends, their workplace, sometimes their home address, assembled automatically from a single frame of their face.

A Company That Answered No Questions

Before Hill's story ran, Clearview operated almost entirely without a public footprint — no working phone number, a nearly content-free website, and police officers who described using it while declining to say who had given them access or where the underlying photos came from. Hill's reporting, and a follow-up investigation the next month by BuzzFeed News reporters Ryan Mac, Caroline Haskins, and Logan McDonald, forced that into the open.

Facebook, Twitter, YouTube, LinkedIn, and Venmo all sent Clearview cease-and-desist letters in February 2020, arguing the scraping violated their terms of service.
Clearview's response, delivered through its lawyers, was that it had a First Amendment right to access and use publicly available information — the same argument it would later make in court.
New Jersey's attorney general barred state law enforcement from using the app days after the Times story ran.

The Client List Clearview Said Was Limited to Law Enforcement

BuzzFeed News obtained internal Clearview data showing that by February 2020, more than 2,200 law enforcement agencies, companies, and institutions in at least 26 countries had used the app, running roughly 500,000 searches between them. The client list undercut the company's own public description of itself as a tool exclusively for police.

The NYPD ran more than 11,000 searches, more than any other agency; the FBI logged about 5,700 across more than twenty field offices.
ICE ran over 8,000 searches from roughly 60 accounts; Customs and Border Protection registered nearly 280 accounts and ran about 7,500 searches; the U.S. Secret Service ran roughly 5,600.
Paying private customers included Macy's, Walmart, Best Buy, Kohl's, the NBA, Eventbrite, and the security firm Gavin de Becker and Associates; Wells Fargo and Bank of America appeared in internal logs as well.
Two U.S. high schools were listed as having accessed the app, along with more than fifty other educational institutions.

Four Twenty-Million-Euro Fines, and a Fifth Country

European data protection authorities, working independently, arrived at nearly identical conclusions and, in several cases, nearly identical numbers.

Italy's Garante fined Clearview €20 million in February 2022 — the maximum penalty then available under the GDPR — for unlawful processing of biometric data and ordered deletion of Italian residents' data.
France's CNIL fined Clearview €20 million in October 2022 for violating GDPR's legal-basis and data-access provisions, then imposed a further €5.2 million penalty in May 2023 after the company failed to comply with the original order.
Greece's Hellenic Data Protection Authority fined Clearview €20 million in July 2022 for the same category of violations.
The Netherlands' Autoriteit Persoonsgegevens fined Clearview €30.5 million in September 2024 — its largest fine to date — and said it was exploring whether to hold Clearview's directors personally liable for continued noncompliance.
The UK's Information Commissioner's Office fined Clearview £7,552,800 in May 2022 and ordered it to stop collecting UK residents' data and delete what it already had.

Clearview has not paid any of the fines and does not have a business presence in the EU or UK for regulators to enforce against directly. The UK case took its own detour: in October 2023, the First-tier Tribunal overturned the ICO's fine, ruling the regulator lacked jurisdiction because Clearview's customers were exclusively foreign law enforcement, which falls outside UK GDPR's reach. The ICO appealed, and on October 7, 2025, the Upper Tribunal reversed that decision, finding Clearview's monitoring of UK residents' behavior did bring it within scope after all — sending the case back to the First-tier Tribunal to reconsider the rest of Clearview's appeal, which the company has said it may challenge further.

Illinois Had a Law for Exactly This

The Illinois Biometric Information Privacy Act, passed in 2008, requires written consent before a company collects someone's biometric identifiers, including a face scan. In May 2020, the ACLU, the ACLU of Illinois, and the law firm Edelson PC sued Clearview under the statute. The suit settled in May 2022: Clearview agreed to a nationwide, permanent ban on selling or granting free access to its database to private companies and individuals, a five-year ban on access by any Illinois state or local government agency including police, an end to free trial accounts for individual officers, deletion of facial vectors collected before the settlement, and payment of $250,000 in attorneys' fees plus $50,000 to publicize an opt-out program.

A separate, consolidated set of BIPA class actions took a different path entirely. In June 2024, Clearview — with limited cash on hand — agreed to give the plaintiff class a 23% equity stake in the company instead of a cash payment. U.S. District Judge Sharon Johnson Coleman approved the deal on March 20, 2025, with the stake valued at roughly $51.75 million against Clearview's January 2024 valuation of $225 million. Class members' payout is triggered by whichever comes first: an IPO, a sale of the company, a share of Clearview's revenue through September 2027, or the class voting to sell its stake outright.

A First Amendment Right to Your Face

Clearview's core legal defense, run across the BIPA litigation and its public statements alike, is that scraping publicly posted photographs and analyzing them is speech, protected the same way a search engine indexing the web is protected. The company retained Floyd Abrams, one of the country's most prominent First Amendment litigators, to make the argument. Courts have not settled the question, though the BIPA settlements suggest Clearview's lawyers found it more persuasive to negotiate around than to test all the way to a final judgment.

Hoan Ton-That resigned as CEO in February 2025, telling TechCrunch it was "time for the next chapter" while initially remaining on the board. Two months later, in April 2025, Forbes reported he had been removed from the board entirely. His replacements as co-CEOs are Richard Schwartz, the company's co-founder, and Hal Lambert, a Republican fundraiser and Clearview investor who said he joined specifically to pursue "opportunities" with the incoming Trump administration, including contracts with the Pentagon and the Department of Homeland Security. As of early 2025, secondary-market transactions valued Clearview between $1.2 billion and $1.6 billion, on reported annual recurring revenue of about $16 million.

The plaintiffs who sued Clearview for scraping their faces without consent are now, by order of a federal court, entitled to nearly a quarter of the company that scraped them — paid out of whatever revenue or sale price a facial recognition database built from their own photos eventually generates.

Filed from public reporting:

Clearview AI Scraped Billions of Photos Without Anyone's Consent to Build a Facial Recognition Database. Its Legal Defense Is That the First Amendment Gave It the Right.

A Search Engine Built From Everyone Else's Photos

A Company That Answered No Questions

The Client List Clearview Said Was Limited to Law Enforcement

Four Twenty-Million-Euro Fines, and a Fifth Country

Illinois Had a Law for Exactly This

A First Amendment Right to Your Face

Read more

A Hand-Tightened Blind Flange and a Botched Shift Handover Killed 167 Men on Occidental Petroleum's Piper Alpha Platform in 22 Minutes. No One at the Company Was Ever Criminally Charged.

Netflix Spent Six Years Telling Customers Love Is Sharing a Password. Once It Started Charging $7.99 a Month Per Shared Password Instead, Subscriber Growth Hit Its Best Year Since the Pandemic.

New York Paused Congestion Pricing for 'Affordability' Weeks Before a 2024 Election, Then Relaunched It at a Lower Price Once Voting Was Over. A Year Later, Traffic Was Down 11 Percent and the Federal Government Was Still in Court Trying to Kill It.

Twitter Cut Off the Third-Party Apps That Built Its Developer Ecosystem in January 2023 With No Warning. One of Those Apps Coined the Word Tweet and Designed Twitter's Bird Logo Before Twitter Had Either.