Is face search legal in Australia?

Australian privacy law is built around the Australian Privacy Principles (APPs) in the Privacy Act 1988. Biometric information used for automated identification, and biometric templates, are 'sensitive information' under the Act, which means an organisation generally needs the person's consent to collect them and may only collect them when reasonably necessary for its functions. The Act binds most private organisations with an annual turnover above $3 million and any organisation trading in personal information. Alongside it sits the Online Safety Act 2021 for intimate images and harmful content, and, since 2024, a statutory privacy tort and criminal doxxing offences.

Does the Privacy Act allow a company to index faces from the web?

Not without consent. APP 3 says an organisation must not collect sensitive information about an individual unless the individual consents and the information is reasonably necessary for one of the organisation's functions. A face template derived from a photo is biometric information, so the consent requirement applies regardless of whether the photo was public. APP 1 (open and transparent management) and APP 5 (notification of collection) add duties to tell people what is collected and why, and APP 11 requires the data to be protected and destroyed when no longer needed. The OAIC applied exactly this reasoning to Clearview AI.

What did the OAIC decide about Clearview AI?

On 14 October 2021 the Australian Information Commissioner determined that Clearview AI had breached the Privacy Act by collecting Australians' facial images and biometric templates from the web without consent, by unfair means, and without taking reasonable steps to notify people or to ensure the information was accurate. The Commissioner ordered it to stop collecting images of people in Australia and to destroy what it held. Clearview appealed to the Administrative Appeals Tribunal, which upheld that certain APPs had been breached; Clearview then withdrew from the proceedings. On 21 August 2024 Commissioner Carly Kind announced that the OAIC would not take further enforcement action, citing the resources that further litigation would need and Clearview's other legal exposure, while stating that the 2021 determination still stands. A separate 2021 determination found that the Australian Federal Police had breached the Act by trialling the tool without a privacy impact assessment.

The takeaway for face search engines is the same as in Canada and the EU: a public photo is not consent to be turned into a searchable biometric template. For a person running a search, the determination says nothing against searching your own face or checking someone you are dealing with.

What changed in the 2024 privacy reforms?

What does the eSafety Commissioner do about images of me?

Under the Online Safety Act 2021 the eSafety Commissioner runs an image-based abuse scheme for intimate images shared, or threatened to be shared, without consent, including digitally altered and AI-generated images. You report at esafety.gov.au; eSafety can issue removal notices to the platform, the host or the person who posted, with 24 hours to comply, and can pursue civil penalties against individuals and services. The same Act covers cyber abuse of adults and cyberbullying of children. Non-consensual sharing of intimate images is also a criminal offence in every state and territory and under Commonwealth law for aggravated cases. A face search can help you find every public copy to include in a report; it cannot see private or members-only sites.

Is it legal to search for my own face?

Yes. Looking for where your own photo appears is you handling your own personal information. The Privacy Act does not restrict it, and the results give you the URLs you need to ask a site to take a photo down, to lodge an eSafety report, or to make an access or correction request to an organisation under APP 12 and APP 13.

Is it legal to search for someone else's face?

For a personal check of someone you are dealing with, yes. The Privacy Act does not apply to individuals acting in a personal capacity, and a one-off lookup of a dating match or a seller is not a collection by an organisation. The limits arrive with what you do next. Publishing a person's details in a menacing or harassing way is doxxing under the Commonwealth Criminal Code. Repeated unwanted contact or surveillance is stalking under state law. A serious, intentional intrusion into someone's private affairs can now be sued on under the privacy tort. Using a match to decide on a job, a tenancy, credit or insurance engages anti-discrimination law and is against FaceSearch's rules.

Where do I report misuse, scams or image-based abuse in Australia?

• Intimate images, cyber abuse, impersonation accounts: report to eSafety at esafety.gov.au/report. For images of anyone under 18, eSafety and the Australian Centre to Counter Child Exploitation (ACCCE).
• Romance, marketplace and investment scams: ReportCyber (cyber.gov.au) and Scamwatch (scamwatch.gov.au), run by the National Anti-Scam Centre, plus your bank the same day if money moved.
• A company holding your face without consent: complain to the organisation first, then to the OAIC.
• Immediate danger or stalking: state or territory police on 000.

How this applies to FaceSearch

FaceSearch compares the face in your upload with faces on publicly accessible pages and returns those pages. Your upload is used for the search and not kept to build a face database, you can delete scans and your account, and removal of your face from results is free by email, which is how we honour a withdrawal of consent. We make no identity claims and ban the uses above. If you are in Australia and want your face excluded from results, see remove my photos; for how uploads are handled, see privacy by design.