A privacy law in Illinois is causing headaches for some major tech firms that want to use facial recognition technology. And a controversial New York startup is the latest company to find itself on the wrong side of a court ruling involving the law.
Clearview AI has agreed to stop selling its services to private businesses following an ACLU lawsuit that claimed the startup was running afoul of Illinois' Biometric Information Privacy Act (BIPA). The suit, filed in 2020, argued Clearview AI did not properly obtain user consent for its "faceprint database," which scrapes images from Facebook and other social media sites to create a searchable dataset of faces.
Clearview AI is now permanently banned from providing its facial recognition database to private companies, and it can't give its tech to any state or local government entity in Illinois for five years. Clearview AI also has an opt-out form that Illinois residents can access to keep their images out of the startup's search results.
The ruling, filed Monday in federal court in Illinois, comes after the startup previously announced plans to stop selling to companies. In 2020, Clearview AI said it would stop offering the facial recognition database to private firms, which in the past have reportedly included Bank of America, Macy’s and Walmart. Instead, Clearview AI sells primarily to law enforcement agencies.
The company has come under fire from privacy advocates, who fear Clearview AI could end privacy as we know it. More than 600 law enforcement agencies have used Clearview, according to the New York Times.
“By requiring Clearview to comply with Illinois’ pathbreaking biometric privacy law not just in the state, but across the country, this settlement demonstrates that strong privacy laws can provide real protections against abuse,” said Nathan Freed Wessler, a deputy director of the ACLU Speech, Privacy and Technology Project, in a statement. “Clearview can no longer treat people’s unique biometric identifiers as an unrestricted source of profit."
The news is just the latest example of a tech company running up against Illinois' biometric privacy law. Facebook agreed to pay $650 million last year as a result of a BIPA settlement. And last month Google agreed to a $100 million settlement in a similar case that violated the state's law.
BIPA, adopted in 2008, was created to ensure that Illinois residents would not have their biometric identifiers, such as faceprints, captured and used without their knowledge and consent. Illinois was the first state to enact such a law, and there has since been similar legislation from states like Arkansas, California, Texas and Washington. Privacy experts believe it's a model that could potentially be used across the country in states looking to prevent tech companies from using facial recognition tech.
