Clearview AI Inc. agreed to prohibit most businesses and other private entities from accessing its facial recognition database as part of a legal settlement with the American Civil Liberties Union over privacy concerns.
The settlement, proposed Monday in Illinois state court, would also ban Clearview from giving data access to state or local government agencies in Illinois, including police, for five years.
The agreement, subject to court approval, is poised to resolve a lawsuit from the ACLU that alleged Clearview captures and stores faceprints of Illinois residents without permission, in violation of that state’s Biometric Information Privacy Act, known as BIPA.
It shows how the company’s facial recognition business has come under pressure from privacy advocates and privacy regulators, with a consumer class action still pending and potential enforcement actions piling up from the U.K. and elsewhere.
The company has faced controversy for scraping billions of images from social media and other online sources to build a searchable database for facial recognition. Privacy regulators in Australia, Canada, and Europe have scrutinized Clearview as law enforcement and government agencies use its technology.
“Clearview AI is pleased to put this litigation behind it,” Clearview’s lawyer Floyd Abrams, senior counsel at Cahill Gordon & Reindel LLP, said in a statement.
The proposed settlement doesn’t limit Clearview’s ability to work with the federal government, other state or local governments, or contractors to these governments.
The company currently doesn’t offer its services to law enforcement agencies in Illinois. In the past, it has given database access to businesses, including Macy’s Inc. Macy’s didn’t immediately respond to a request for comment.
“Clearview AI’s posture regarding sales to private entities remains unchanged,” Clearview CEO Hoan Ton-That, said in a statement. “We would only sell to private entities in a manner that complies with BIPA.”
The company intends to launch a new consent-based product that would let commercial customers use its facial recognition algorithm to verify a person’s identity, without searching its database.
The settlement highlights a lack of transparency into who Clearview’s customers are, said Albert Fox Cahn, founder and executive director of the nonprofit Surveillance Technology Oversight Project.
The company is “selling technology to watch us” but doesn’t provide “meaningful transparency on who has access to that information,” Cahn said.
The ACLU sued Clearview in state court in May 2020. The nonprofit was joined in the suit by groups representing survivors of domestic violence and sexual assault, undocumented immigrants, and other individuals with concerns about being identified and tracked.
“By requiring Clearview to comply with Illinois’ pathbreaking biometric privacy law not just in the state, but across the country, this settlement demonstrates that strong privacy laws can provide real protections against abuse,” Nathan Freed Wessler, a deputy director of the ACLU’s Speech, Privacy, and Technology Project, said in a statement.
The case could spur a push for other states to adopt laws similar to BIPA in Illinois, according to Susan Hintze, managing partner at Hintze Law PLLC.
Washington and Texas already have similar laws in place. New York has proposed its own version too.
“This may make similar laws more likely to pass,” Hintze said.
The settlement comes after the judge overseeing the ACLU’s case rejected Clearview’s bid for dismissal. The company has defended its ability to gather publicly posted photos and likened its services to a search engine.
Clearview also faces a consumer privacy class action over collecting photos of people posted online.
In response to legal pressure, Clearview is allowing Illinois residents to opt out from appearing in its facial recognition search results. Individuals must fill out an online form and upload a photo of themselves.
The company is committing $50,000 to pay for online ads publicizing the opt-out mechanism.
“The settlement is an important win for privacy,” said Jeramie Scott, senior counsel at the nonprofit Electronic Privacy Information Center. Scott added that the agreement would prevent potential harms that could result from letting Clearview provide access to its facial recognition database to private companies and individuals.
The case is American Civil Liberties Union v. Clearview AI Inc., Ill. Cir. Ct., No. 2020-CH-04353, settlement proposed 5/9/22.