# Face Recognition Laws in 2026: What Regulators Actually Did, and What It Means for You > Source: > Published: 2026-11-12 19:23:17+00:00 ## The scorecard[#](#the-scorecard) | Sources linked in the sections below. Read November 12, 2026. | | | | |---|---|---|---| | When | Who acted | Against | What happened | |---|---|---|---| | Oct 2022 | CNIL (France) | Clearview AI | €20 million fine under GDPR, plus an order to stop and delete French data | | 2022 to 2025 | ICO (UK) | Clearview AI | £7.5 million fine (May 2022); overturned on jurisdiction in 2023; Upper Tribunal sided with the ICO in October 2025; Clearview allowed to appeal to the Court of Appeal (December 2025) | | Jul 2024 | Texas attorney general | Meta | $1.4 billion settlement under Texas' biometric law (CUBI) over face data captured through photo tagging | | Sep 2024 | Dutch DPA | Clearview AI | €30.5 million fine, orders backed by penalties of up to more than €5 million, and a warning that Dutch organizations may not use Clearview | | Feb 2025 | EU AI Act | Everyone | Ban on building face databases by untargeted scraping, and on live police face recognition in public with three narrow exceptions, takes effect | | Mar 2025 | US federal court (Illinois) | Clearview AI | Class settlement over BIPA approved: class members get a 23% stake in Clearview instead of cash | | Oct 2025 | Texas attorney general | | $1.375 billion settlement finalized over privacy claims including biometric data | | Nov 2025 to now | Hamburg DPA, then noyb | PimEyes | Regulator finds PimEyes acted unlawfully but takes no action; noyb sues the regulator in April 2026; case pending | ## Europe: the strictest rules, uneven enforcement[#](#europe-the-strictest-rules-uneven-enforcement) ### The AI Act bans face scraping[#](#the-ai-act-bans-face-scraping) Since February 2, 2025, [Article 5 of the AI Act](https://ai-act-service-desk.ec.europa.eu/en/ai-act/article-5) prohibits AI systems that create or expand facial recognition databases through untargeted scraping of facial images from the internet or CCTV footage (Article 5(1)(e)). It also restricts real-time remote biometric identification in publicly accessible spaces for law enforcement to three narrow exceptions (Article 5(1)(h)). The first rule is the one that matters for consumer face search: it describes how engines like Clearview and PimEyes build their indexes. ### GDPR fines against Clearview[#](#gdpr-fines-against-clearview) Clearview, which sells to law enforcement and not the public, has collected the biggest European fines. The Dutch DPA [fined it €30.5 million in 2024](https://www.autoriteitpersoonsgegevens.nl/en/current/dutch-dpa-imposes-a-fine-on-clearview-because-of-illegal-data-collection-for-facial-recognition) for building an illegal database of billions of faces, including Dutch people's, and said Dutch organizations using Clearview break the law too. France's CNIL [fined it €20 million in 2022](https://www.edpb.europa.eu/news/national-news/2022/french-sa-fines-clearview-ai-eur-20-million_ga) and ordered it to stop collecting and delete French residents' data. ### The UK: a jurisdiction fight[#](#the-uk-a-jurisdiction-fight) The UK's ICO fined Clearview £7.5 million in May 2022. A lower tribunal overturned it, ruling the processing was outside UK data law because Clearview served foreign governments. In October 2025 the Upper Tribunal [sided with the ICO on three of its four grounds](https://ico.org.uk/about-the-ico/media-centre/news-and-blogs/2025/10/uk-upper-tribunal-hands-down-judgment-on-clearview-ai-inc/): Clearview's processing relates to monitoring UK residents' behaviour, and serving foreign agencies does not put it out of reach. The case goes back to the lower tribunal, and in December 2025 Clearview was given permission to appeal to the Court of Appeal. ### PimEyes: illegal, says the regulator, but untouched[#](#pimeyes-illegal-says-the-regulator-but-untouched) This is the clearest picture of where enforcement stands. A complaint against PimEyes was filed with the Hamburg data protection authority in July 2020. Five years later, according to privacy group [noyb](https://noyb.eu/en/no-action-taken-against-pimeyes-noyb-lawsuit-against-hamburg-dpa), the authority concluded that PimEyes acted unlawfully and should have answered the complainant's access and deletion request, but took no concrete action beyond an information letter, because PimEyes appears to be based in Dubai and does not respond. noyb says PimEyes listed addresses in Poland, the Seychelles and Belize during the proceedings. It sued the Hamburg authority on April 30, 2026; the [case is still pending](https://noyb.eu/en/project/biometric-data/c042). PimEyes' own FAQ describes the service as searching only [publicly available websites that permit indexing](https://pimeyes.com/en/faq), and says it does not identify individuals. Regulators and the engine disagree on whether that is enough. ## United States: no federal law, two expensive states[#](#united-states-no-federal-law-two-expensive-states) ### Illinois BIPA[#](#illinois-bipa) Illinois' [Biometric Information Privacy Act](https://www.ilga.gov/legislation/ilcs/ilcs3.asp?ActID=3004&ChapterID=57) requires a company to tell people in writing and get a written release before it collects a face geometry scan, and to publish a retention and destruction schedule. Unusually, it lets individuals sue: $1,000 per negligent violation and $5,000 per intentional or reckless one. That private right of action is why so much US face-recognition litigation runs through Illinois, including the Clearview class action, settled in March 2025 with [a 23% stake in the company](https://www.reuters.com/legal/litigation/us-judge-approves-novel-clearview-ai-class-action-settlement-2025-03-21/) for class members instead of cash. ### Texas CUBI[#](#texas-cubi) Texas' biometric law has no private right of action, but its attorney general has used it for two very large privacy settlements. Meta agreed to pay [$1.4 billion in July 2024](https://www.texasattorneygeneral.gov/news/releases/attorney-general-ken-paxton-secures-14-billion-settlement-meta-over-its-unauthorized-capture), which the attorney general calls the largest settlement ever obtained by a single state: according to the Texas attorney general, its photo-tagging feature ran facial recognition on almost every face in photos uploaded to Facebook for more than a decade. Google finalized a [$1.375 billion settlement in October 2025](https://www.texasattorneygeneral.gov/news/releases/attorney-general-ken-paxton-finalizes-historic-settlement-google-and-secures-1375-billion-big-tech) covering several privacy claims, including biometric data. Enjoying this? Get one like it in your inbox each morning. one email a day · unsubscribe in two clicks · no third-party tracking ## What this means if you use face search[#](#what-this-means-if-you-use-face-search) - Searching your own face, or checking a profile that contacted you, is not what these laws target. They target companies that collect and store face data. - The engines' legal footing is contested. That is a reason to use their opt-outs; our [step-by-step opt-out guide](https://stork.ai/blog/remove-your-face-from-face-search-engines-2026) covers PimEyes, FaceCheck.ID, Lenso, FaceSeek, Search4faces and Clearview. - Your upload is biometric data in the hands of a company that may sit outside your country's reach. Read the engine's retention terms first: PimEyes says 48 hours, FaceCheck says 24 hours for search history. - Do not use a match to accuse anyone. Engines describe their results as similarity scores, not identity. Our [comparison of face search engines](https://stork.ai/blog/best-face-search-engines-2026) covers what each one indexes and costs. ## What this means if you build with face recognition[#](#what-this-means-if-you-build-with-face-recognition) - **Never build your own face database from scraped images if you have EU users.** That is exactly what Article 5(1)(e) bans. - **Illinois users: get written consent before you create a face template** , publish a retention schedule, and do not sell the data. Statutory damages are per person, which is what turns a product feature into a class action. - **Using a vendor API does not make the obligation disappear.** You still collect the face that you send to it. Read the vendor's own terms; Microsoft, for example, gates face identification behind a Limited Access application. - **Offshore does not mean safe for you.** Regulators struggle to reach an engine in Dubai; they have no such trouble reaching a US or EU company with a bank account. ## Frequently asked questions[#](#frequently-asked-questions) ### Is facial recognition legal in 2026?[#](#is-facial-recognition-legal-in-2026) It depends who is doing what. Using a face search engine to find your own photos is legal in most places. Building a face database by scraping the internet is banned in the EU under the AI Act since February 2025. In the US there is no federal law, but Illinois (BIPA) and Texas (CUBI) require consent before companies collect face data. ### Is PimEyes legal?[#](#is-pimeyes-legal) Contested. The Hamburg data protection authority concluded that PimEyes acted unlawfully in a GDPR complaint but took no action, saying the company appears to be based in Dubai. Privacy group noyb sued the authority in April 2026, and the case is pending. PimEyes says it only searches publicly available websites that permit indexing. ### Why was Clearview AI fined?[#](#why-was-clearview-ai-fined) For building a database of billions of faces scraped from the web without consent. The Dutch DPA fined it 30.5 million euros in 2024 and France's CNIL 20 million euros in 2022. The UK fine of 7.5 million pounds is still in the courts, and a US class action under Illinois' BIPA settled in 2025 for a 23% stake in the company. ### What does BIPA require?[#](#what-does-bipa-require) Illinois' Biometric Information Privacy Act requires written notice and a written release before a company collects biometric identifiers such as a face geometry scan, plus a public retention and destruction policy. Individuals can sue for $1,000 per negligent violation and $5,000 per intentional or reckless one. ### Does the EU AI Act ban face search engines?[#](#does-the-eu-ai-act-ban-face-search-engines) It bans AI systems that create or expand facial recognition databases through untargeted scraping of facial images from the internet or CCTV, which describes how most face search engines build their indexes. The ban has applied since February 2, 2025. Searching with a tool is not itself named in that article.