Is face search legal?

A face search engine compares the face in your photo with faces found on public web pages and returns the pages where a similar face appears. Two separate legal questions sit behind that sentence. First, may a company build an index of faces from the public web at all, and under what conditions? Second, what may you, the person searching, do with what you find? Most news coverage mixes the two. This page keeps them apart, region by region, as of November 2026.

What law applies to a face search?

Three kinds of law touch face search. Biometric and data-protection law governs whether an engine may turn a face into a searchable template and what rights the person in the photo has: consent, access, deletion, objection. Platform and content law governs what the websites hosting the photos must do when someone asks for a removal. Conduct law governs the searcher: stalking, harassment, doxxing, discrimination and the rules on using personal data for hiring, renting, lending or insuring. An engine can be fully compliant while a particular user breaks the law with it, and the reverse is also true.

Is it legal to search for your own face?

Yes, everywhere FaceSearch operates. You are the data subject, so no third party's consent is at issue, and finding out where your own image appears is exactly the kind of transparency data-protection law is designed to give you. The right of access under GDPR Article 15 and similar provisions elsewhere is built on the idea that you may find out who holds your data. A self-search is the use FaceSearch is built around; see find my photos online.

Is it legal to search for someone else's face?

In most places, searching for another adult's face for an ordinary purpose is not itself an offence. Checking that the person you are about to meet, rent from, buy from or send money to is who they say they are is treated as a legitimate interest in the places we operate, which is why catfish checks and verification searches are common uses. What the law does restrict is what you do next: contacting or tracking someone against their wishes, publishing what you found, using a face search to make hiring, housing, credit or insurance decisions, or searching for a child. Our own rules are stricter than the law in several places; they are on the acceptable use page.

What are the rules in the United States?

There is no federal biometric privacy law. A patchwork of state laws applies instead, and the strictest of them apply to the engine rather than to the searcher.

• Illinois BIPA (2008). The Biometric Information Privacy Act requires informed written consent before a private company collects a biometric identifier such as a scan of face geometry, and it gives individuals a private right to sue for $1,000 per negligent violation or $5,000 per intentional or reckless one. Senate Bill 2979, signed in August 2024, changed damages from per scan to per person, so one person recovers once however many times their face was scanned. BIPA remains the law under which most US face-recognition litigation is brought.
• Texas CUBI (2009). The Capture or Use of Biometric Identifier Act requires notice and consent before capturing a biometric identifier for a commercial purpose. Only the Attorney General can enforce it, with civil penalties of up to $25,000 per violation. Texas used it to reach a $1.4 billion settlement with Meta in 2024 over face recognition in photo tagging, and a $1.375 billion settlement with Google in 2025 that covered biometric, location and incognito data.
• Washington. RCW 19.375 (2017) requires notice and consent before a company enrols a biometric identifier in a database for a commercial purpose and is enforced by the Attorney General. The My Health My Data Act (2023) goes further by treating biometric data as consumer health data, with a private right of action.
• California CCPA / CPRA. Biometric information processed to identify a person is sensitive personal information. Californians can ask a business to limit its use, to disclose it and to delete it.
• FCRA. The Fair Credit Reporting Act governs consumer reports used for employment, tenant, credit and insurance decisions. A face search is not a consumer report and must not be used as one; that is why every reputable engine, including FaceSearch, prohibits those uses.
• Conduct laws. Every state criminalises stalking and harassment, and a growing number address doxxing and the non-consensual sharing of intimate images. The federal Take It Down Act (2025) adds a 48-hour removal duty on platforms for such images, enforced by the FTC since May 2026.

What are the rules in the European Union?

The GDPR defines biometric data as personal data resulting from specific technical processing of a person's physical characteristics which allow or confirm their unique identification (Article 4(14)). Processing biometric data for the purpose of uniquely identifying a person is prohibited by Article 9 unless an exception applies, the most relevant being explicit consent. An engine that builds face templates from scraped photos of EU residents without a lawful basis is therefore the main target of European enforcement, and that enforcement has been slow and contested.

• PimEyes in Germany. The Baden-Württemberg data protection authority opened proceedings against PimEyes in May 2021 and a fine procedure in December 2022, while the company moved its seat from Poland to the Seychelles and later Dubai. The Hamburg authority, handling a complaint filed by noyb in 2020, concluded on 7 November 2025 that PimEyes acted unlawfully and should have answered the complainant's access and deletion requests, but sent only an information letter, citing a lack of jurisdiction over a company with no EU establishment. On 30 April 2026 noyb sued the Hamburg authority over that inaction. No ruling had been reported when this page was reviewed.
• Clearview AI. The US company that scraped faces for a law-enforcement product has been fined by data protection authorities in Italy, Greece, France and the Netherlands and ordered to delete data on their residents. The cases established that scraping public photos to build face templates is Article 9 processing that needs a lawful basis, and that being based outside the EU does not remove the GDPR's reach when EU residents are monitored.
• AI Act. Since 2 February 2025 the EU AI Act prohibits AI systems that create or expand facial recognition databases through untargeted scraping of facial images from the internet or CCTV footage (Article 5(1)(e)). How this applies to consumer face search engines is not yet settled by a court, and it is the provision privacy groups cite most often.
• Your rights as a data subject. Access (Article 15), erasure (Article 17) and objection (Article 21) apply to any engine processing your face, wherever the engine is based, if it offers services to people in the EU or monitors their behaviour.

What are the rules in the United Kingdom?

The UK GDPR and the Data Protection Act 2018 mirror the EU rules on biometric data, and the Information Commissioner's Office (ICO) is the regulator. The live question has been whether the ICO can reach a foreign engine at all. In May 2022 the ICO fined Clearview AI £7.5 million and ordered it to delete UK residents' data. The First-tier Tribunal set that aside in October 2023, holding that the ICO lacked jurisdiction because Clearview served only foreign law enforcement. In October 2025 the Upper Tribunal reversed that on three of four grounds, finding the ICO did have jurisdiction and that Clearview's processing amounted to behavioural monitoring of UK residents, and sent the case back to the First-tier Tribunal. Clearview was granted permission to appeal to the Court of Appeal in December 2025, and the appeal was heard in 2026. The outcome was pending when this page was reviewed. The ICO's published guidance treats facial recognition templates as special category data that needs an Article 9 condition.

What are the rules in India?

The Digital Personal Data Protection Act 2023 is India's first comprehensive data-protection statute. The DPDP Rules were notified on 13 November 2025 together with the constitution of the Data Protection Board, and the obligations phase in: a few rules took effect immediately, the consent-manager rule follows on 13 November 2026, and the remaining duties on data fiduciaries, including notice, consent, erasure and breach reporting within 72 hours, apply from May 2027. The Act does not create a separate special category for biometric data in the way the GDPR does; all personal data needs consent or another lawful ground, and individuals get rights of access, correction and erasure once the relevant rules are in force. Separately, the IT (Intermediary Guidelines) Rules 2021 require platforms to remove content that impersonates a person or shows them in a morphed or intimate way within 24 hours of a complaint, and the national cybercrime portal at cybercrime.gov.in takes reports of fake profiles and matrimonial fraud.

What about Canada and Australia?

Both countries ruled on Clearview AI early. In February 2021 the federal Privacy Commissioner of Canada and the commissioners of Quebec, British Columbia and Alberta jointly found that Clearview's scraping of Canadians' photos breached PIPEDA and provincial law, called facial recognition data particularly sensitive, and asked the company to stop collecting and to delete what it held. In November 2021 the Office of the Australian Information Commissioner found that Clearview had collected sensitive information without consent and by unfair means, in breach of the Privacy Act, and ordered it to stop and to destroy the images and templates of people in Australia. In August 2024 the OAIC decided not to pursue a further investigation but stated that the 2021 determination still stands. The principle in both countries is the same as in Europe: public availability of a photo is not consent to turning it into a biometric template.

Which uses are restricted everywhere?

How does this apply to FaceSearch?

FaceSearch indexes only publicly accessible pages, never content behind a login, and it does not identify people: a result is a public page where a similar face appears, not a name. The photo you upload is stripped of metadata, used for your search and never used to build a face database for anyone else, which keeps your own biometric data out of any index. Anyone can ask to be excluded from results for free by email; the steps are on remove my photos. Our acceptable use rules prohibit the uses in the table above whether or not local law does, and the privacy by design page sets out what we store and for how long. Where the law is still moving, as it is for the EU AI Act and the UK Clearview appeal, we update this page.