Clearview AI’s facial recognition products have been a matter of controversy for some time now; the company ostensibly only provides them to law enforcement agencies, but leaks have indicated that they have also done business with repressive foreign governments and even American retail chains.
The company is now facing a serious challenge to its core business model. The American Civil Liberties Union (ACLU) has filed a lawsuit in Illinois, claiming that the company’s facial recognition tools violate the state’s privacy laws. The 2008 Illinois Biometric Information Privacy Act (BIPA) requires that consent be gathered from Illinois residents to collect biometric identifiers, something that the company did not do in trawling public sources to vacuum up pictures of millions of people.
“Faceprints” and facial recognition
The lawsuit centers on the concept of a “faceprint” as a unique biometric identifier. The Illinois privacy act does not mention this by name, but does define a ” … scan of hand or face geometry” and ” … physical descriptions such as … hair color, or eye color” as qualifying identifiers.
The ACLU’s complaint accuses Clearview AI of “unlawful surreptitious capture and storage” of this biometric data. Several other activist organizations, such as the Chicago Alliance Against Sexual Exploitation, have joined the suit. These groups represent populations who are disproportionately impacted by mass surveillance. The issue of facial recognition is particularly sensitive at the moment, with police brutality demonstrations in the United States expanding to cities all over the world. One of the main criticisms of Clearview AI’s software is that it could potentially be used to quickly identify everyone at a protest.
The crux of the lawsuit is Clearview AI’s practice of scraping social media sites and other public repositories for facial images, something that has landed the company in trouble before. In a statement on the issue to CNN, Clearview AI founder Hoan Ton-That claimed that the company was supplying a “search engine for faces” and characterized the ACLU’s lawsuit as an attempted violation of its First Amendment rights.
The ACLU’s argument is that consent has not properly been collected from all of these Illinois residents according to the laws of the state. When someone uploads an image of themselves to Facebook or Instagram, they are not necessarily aware of or consenting to the use of it in facial recognition databases maintained by private companies. They are also now subject to additional risk of data breaches should they opt to make these pictures private at some point.
The case is likely to hinge on whether a court recognizes the ACLU’s assertion of a faceprint being a unique identifier. The complaint cites characteristics that can be taken from any standard picture of a person’s face such as cheekbone shape, the distance between eyes and patterns of freckles. The ACLU’s response to the assertion that First Amendment rights are in play is that Clearview AI is as free as anyone to look at these public pictures, but does not have the right to extract biometric identifiers such as these from them for their private use. Additionally, BIPA specifically states that companies collecting this information are not to sell it or otherwise profit from it.
Tech companies campaign against Clearview AI
The ACLU’s effort builds on an ongoing campaign by the major tech companies to have Clearview AI remove images scraped from their platforms from its facial recognition system.
The likes of Facebook, Google, Twitter and LinkedIn have been issuing statements and sending cease-and-desist letters to Clearview AI for several months now, informing the company that their scraping of the platform violates the terms of service. All of this followed in the wake of a New York Times investigative report in January that revealed the practice and that Clearview AI is able to monitor what images its law enforcement clients are searching for.
Clearview AI formally ended all contracts with entities outside of law enforcement in early May, after leaks revealed the company had been having some dealings with major retail and bank chains. That does not preclude the possibility of it selling facial recognition technology to repressive foreign governments, however, something that the company is currently facing a Congressional probe for.
At the same time, the company cancelled all contracts with any parties in the state of Illinois; it had at least 105 clients making use of its facial recognition services there including the Chicago Police Department. However, that does not get it out of any of the legal hot water it is presently in. Clearview AI has stated that it is screening out Illinois residents and providing an opt-out system for them, but this is a voluntary move by the company rather than a lawsuit settlement term. It could be viewed by a court as a tacit admission that the company was violating state law.
The company may soon face this same battle in more states: the attorney generals of California, Vermont, New York and New Jersey have either launched inquiries or initiated lawsuits.
