In Big Win, Settlement Ensures Clearview AI Complies With Groundbreaking Illinois Biometric Privacy Law
As part of the settlement in ACLU v. Clearview AI, the company is now permanently banned, nationwide, from making its faceprint database available to most businesses and other private actors.
CHICAGO – Under a legal settlement filed in court today, Clearview AI — a secretive face surveillance company claiming to have captured more than 10 billion faceprints from peoples’ online photos across the globe — has agreed to a new set of restrictions that ensure the company is in alignment with the Illinois Biometric Information Privacy Act (BIPA), a groundbreaking Illinois privacy law.
The central provision of the settlement restricts Clearview from selling its faceprint database not just in Illinois, but across the United States. Among the provisions in the binding settlement, which will become final when approved by the court, Clearview is permanently banned, nationwide, from making its faceprint database available to most businesses and other private entities. The company will also cease selling access to its database to any entity in Illinois, including state and local police, for five years.
“By requiring Clearview to comply with Illinois’ pathbreaking biometric privacy law not just in the state, but across the country, this settlement demonstrates that strong privacy laws can provide real protections against abuse,” said Nathan Freed Wessler, a deputy director of the ACLU Speech, Privacy, and Technology Project. “Clearview can no longer treat people’s unique biometric identifiers as an unrestricted source of profit. Other companies would be wise to take note, and other states should follow Illinois’ lead in enacting strong biometric privacy laws.”
“There is a battle being fought in courtrooms and statehouses across the country about who is going to control biometrics—Big Tech or the people being tracked by them—and this represents one of the biggest victories for consumers to date,” said J. Eli Wade-Scott from Edelson PC, a nationally recognized-leader in consumer privacy litigation that recently obtained a $650 million settlement in a BIPA case with Facebook, which has also announced that it will curtail its facial recognition practices nationwide.
The restrictions are detailed in an agreement resolving a lawsuit filed against Clearview in May 2020 on behalf of groups representing survivors of domestic violence and sexual assault, undocumented immigrants, current and former sex workers, and other vulnerable communities uniquely harmed by face recognition surveillance. The lawsuit alleged that Clearview repeatedly violated the Illinois Biometric Information Privacy Act (BIPA), a law adopted in 2008 to ensure that Illinois residents would not have their biometric identifiers – including faceprints – captured and used without their knowledge and permission.
“This settlement is a big win for the most vulnerable people in Illinois,” said Linda Xóchitl Tortolero, president and CEO of Mujeres Latinas en Acción, a Chicago-based non-profit. “Much of our work centers on protecting privacy and ensuring the safety of survivors of domestic violence and sexual assault. Before this agreement, Clearview ignored the fact that biometric information can be misused to create dangerous situations and threats to their lives. Today that’s no longer the case.”
Under the settlement agreement filed in Illinois state court today:
- Clearview will be permanently banned from granting paid or free access to its gargantuan face recognition database to private entities (including both private companies and private individuals) nationwide, subject to narrow exceptions contained in BIPA;
- Clearview will be banned from granting access to its database to any state or local government entity in Illinois (including law enforcement) for a period of five years. This means that within Illinois, Clearview cannot take advantage of BIPA’s exception for government contractors during that time;
- Clearview will be banned from granting access to its database to any private entity in Illinois for five years, meaning Clearview cannot take advantage of any of BIPA’s exceptions allowing sales to certain types of businesses during that time;
- Clearview will maintain an on its website, allowing Illinois residents to upload a photo and fill out a form to ensure their faceprints will be blocked from appearing in Clearview’s search results, including for Clearview’s law enforcement users. The company will also commit $50,000 to pay for internet ads publicizing the opt-out mechanism. Clearview is prohibited from using the photos people upload as part of this opt-out process for any purpose other than effectuating the opt-out program;
- Clearview will end its practice of offering free trial accounts to individual police officers, without the knowledge or approval of their employers; and
- Over the next five years, Clearview will continue its current measures to attempt to filter out photographs that were taken in or uploaded from Illinois.
Recently, Clearview announced that it was on track to have 100 billion face prints in its database within a year, enough to ensure “almost everyone in the world will be identifiable.” These images — equivalent to 14 photos for each of the 7 billion people on Earth — would enable covert and remote surveillance of Americans on a scale unlike anything seen before. Reports suggest that neither the U.S. government nor any American company has ever compiled such a massive trove of biometrics.
BIPA requires companies that collect, capture, or obtain an Illinois resident’s biometric identifier — such as a fingerprint, faceprint, or iris scan — to first notify that individual and obtain their written consent. This is because the involuntary and surreptitious capture of biometric identifiers — which cannot be changed — can pose greater risks to an individual’s security, privacy, and safety than the capture of other identifiers, such as names and addresses.
“Fourteen years ago, the ACLU of Illinois led the effort to enact BIPA – a groundbreaking statute to deal with the growing use of sensitive biometric information without any notice and without meaningful consent,” said Rebecca Glenberg, staff attorney for the ACLU of Illinois. “BIPA was intended to curb exactly the kind of broad-based surveillance that Clearview’s app enables. Today’s agreement begins to ensure that Clearview complies with the law. This should be a strong signal to other state legislatures to adopt similar statutes.”
The plaintiffs in the lawsuit are the Chicago Alliance Against Sexual Exploitation, the Sex Workers Outreach Project Chicago, the Illinois State Public Interest Research Group, Mujeres Latinas en AcciĂłn, the ACLU, and the ACLU of Illinois. They are represented by the ACLU, the ACLU of Illinois and Edelson PC.
Privacy & Technology
ACLU v. Clearview AI
Privacy & Technology
ACLU v. Clearview AI
Learn More About the Issues in This Press Release
-
Press ReleaseDec 2024
Privacy & Technology
ACLU Applauds Arizona Supreme Court Historic Decision That Police Need a Warrant to Access DNAACLU Applauds Arizona Supreme Court Historic Decision That Police Need a Warrant to Access DNA
PHOENIX — In a 7-0 decision, the Arizona Supreme Court ruled that a warrant is required to extract and analyze people’s DNA, saying that a person’s limited consent to a search of biological material for a specific purpose—in this case, a blood alcohol test for a DUI arrest—does not overcome that requirement. The ACLU and the ACLU of Arizona filed a friend-of-the-court brief in State v. Mitcham, arguing the government cannot genetically test biological material it already has in its possession—whether that’s blood taken from newborns to test for diseases or swabs collected from sexual assault survivors—to investigate the donors for a crime without first obtaining a warrant. In the decision, the court wrote that “in reaching this conclusion, we emphatically reject the State’s position that it was free to analyze Mitcham’s blood in any way it pleased simply because the State lawfully possessed the blood vials.” “Government analysis of our DNA can expose detailed information about our identity, appearance, family relationships, medical conditions, and more. We don’t consent to sharing all of that information each time we involuntarily shed our DNA or consent to a blood draw. The government’s argument in this case was a privacy nightmare,” said Vera Eidelman, staff attorney with the ACLU’s Speech, Privacy, and Technology Project. “We are greatly heartened by the Arizona Supreme Court’s decision to preserve the privacy of our sensitive genetic information.” In 2015, during a DUI arrest, the defendant in this case consented to the government collecting a sample of his blood solely to test it for blood-alcohol content, and was advised that the sample would be destroyed after 90 days. Instead, law enforcement held on to this sample for three years, at which point it used it for a completely different purpose—to extract and analyze his DNA, without a warrant or consent—while investigating another crime. Had the court accepted the government’s rationale here, all of us who consent to a biological sample collection, at any point in time, for any purpose, to any government entity, could have been subject to a warrantless DNA search after the fact. “Our DNA can reveal so much about us that our genetic privacy must be protected,” said Jared Keenan, legal director of ACLU of Arizona. “The Court’s decision is vital to protecting the strong constitutional rights that keep all Arizonans’ information safe from warrantless searches and unconstitutional intrusion.” -
News & CommentaryDec 2024
Privacy & Technology
Face Recognition Threatens to Replace Tickets, ID at Sports Events – and BeyondFace Recognition Threatens to Replace Tickets, ID at Sports Events – and Beyond
You shouldn't participate in face recognition ticketing schemes. -
MississippiJul 2024
Free Speech
Privacy & Technology
NetChoice v. FitchNetChoice v. Fitch
Whether a law that mandates age verification for all users of social media services violates the First Amendment. -
News & CommentaryDec 2024
Privacy & Technology
AI Generated Police Reports Raise Concerns Around Transparency, BiasAI Generated Police Reports Raise Concerns Around Transparency, Bias
AI-generated police reports threaten to exacerbate existing problems in law enforcement, and to create new ones.