Is face search legal in the European Union?

Under EU law, a face search engine is a controller processing biometric data: it extracts a template from every face it indexes and compares your upload against that index. The General Data Protection Regulation treats that as processing of a special category of data, the AI Act now prohibits one way of building such an index, and the Digital Services Act gives you a route against the platforms hosting the photos themselves. What EU law does not do is make your own search unlawful. This page sets out the rules as they stood in November 2026 and extends the overview on is face search legal.

Which GDPR rules apply to a face search engine?

• Article 4(14) defines biometric data as personal data resulting from specific technical processing of a person's physical characteristics which allows or confirms their unique identification. A face template is the textbook example; an ordinary photo is not biometric data until it is processed that way.
• Article 9(1) prohibits processing biometric data for the purpose of uniquely identifying a person. Article 9(2) lists the exceptions. For a commercial engine the only realistic one is explicit consent from the person in the photo, which an engine that scrapes the web does not have. The fact that a photo was public does not help: Article 9(2)(e) covers data the person manifestly made public, but regulators have held that posting a photo is not making your biometric template public.
• Article 3(2) extends the GDPR to companies outside the EU that offer services to people in the EU or monitor their behaviour. This is why fines have been issued against Clearview AI, a US company with no EU office.
• Article 22 limits decisions based solely on automated processing that produce legal or similarly significant effects. A face search result shown to a user is not such a decision, but using one to reject a job or tenancy applicant automatically would be.
• Articles 15, 17 and 21 give every data subject the rights of access, erasure and objection, and Article 77 the right to complain to a data protection authority.

Does the household exemption cover my own searches?

Article 2(2)(c) says the GDPR does not apply to processing by a natural person in the course of a purely personal or household activity. Checking the person you are about to meet, or looking for your own photos, is personal activity, so you carry no GDPR duties as a searcher. The exemption has limits the Court of Justice set as early as 2003 in Lindqvist: once you publish personal data to an indefinite number of people, for example by posting what a search found about someone, you are no longer within household activity and become a controller yourself. The exemption also never covers the engine, which processes faces as a business.

What happened to PimEyes in Germany?

PimEyes, the best-known consumer face search engine, has been under German scrutiny since 2021 without a final outcome. The Baden-Württemberg data protection authority announced proceedings on 26 May 2021 and opened a fine procedure in December 2022, while the company moved its registered seat from Poland to the Seychelles and later to Dubai. The Hamburg authority, which received a complaint from the privacy group noyb in July 2020, took until 7 November 2025 to decide: it found that PimEyes acted unlawfully and should have answered the complainant's access and deletion requests, but issued only an information letter, saying it could not enforce against a company with no EU establishment. On 30 April 2026 noyb sued the Hamburg authority over that inaction, arguing that the GDPR allows action against third-country controllers. No judgment had been reported when this page was reviewed, and the Baden-Württemberg procedure had produced no published result. Our compare PimEyes page covers the product itself.

What did the Clearview AI fines decide?

The principle the four decisions share is the one that matters for every engine: scraping public photos to build face templates is Article 9 processing that needs a lawful basis, public availability is not consent, and being based outside the EU does not remove the GDPR's reach when EU residents are monitored.

Does the AI Act ban face search engines?

Article 5(1)(e) of the AI Act prohibits placing on the market or using AI systems that create or expand facial recognition databases through the untargeted scraping of facial images from the internet or CCTV footage. The prohibition has applied since 2 February 2025, and fines for breaching it, up to EUR 35 million or 7 percent of worldwide turnover, have been available since 2 August 2025. The Commission's guidelines on the prohibited practices, published in February 2025, say the ban covers untargeted collection whatever the stated purpose, but not targeted scraping of a specific person or group, and not systems that gather faces to generate images of fictional people. Privacy groups argue the wording describes a consumer face search engine exactly. No court or regulator had applied the provision to one when this page was reviewed, so the honest answer is that the ban exists, that it probably reaches engines built by scraping, and that the first enforcement case will settle how far.

What rights do you have against an engine?

• Access (Article 15). Ask the engine whether it holds a template of you and which pages it links your face to. It must answer within one month, extendable to three for complex requests.
• Erasure (Article 17). Ask for the template and the links to be deleted. An engine that has no lawful basis for the processing has no ground to refuse.
• Objection (Article 21). Object to processing based on legitimate interests; the engine must stop unless it shows compelling grounds that override yours.
• Complaint (Article 77). Complain to the data protection authority of your member state, which must handle the complaint even when the engine is abroad. The noyb lawsuit in Hamburg is about what the authority must then do.
• Notice and action (DSA Article 16). For the photos themselves, every hosting provider in the EU must offer an easy way to report illegal content and must decide on the report diligently and without undue delay. A precise report also removes the host's liability shield if it fails to act.

Step-by-step requests for the engines we compete with are on remove yourself from PimEyes and remove yourself from FaceCheck.ID. For FaceSearch itself the route is the free email request on remove my photos.

Searching your own face versus someone else's

How does this apply to FaceSearch?

FaceSearch indexes only publicly accessible pages, never content behind a login, and returns pages where a similar face appears rather than names or identities. The photo you upload is stripped of metadata, used only for your search and never used to build a face database, so your own biometric data does not enter any index through us. Anyone, in the EU or elsewhere, can be excluded from results for free by email; the steps are on remove my photos, and the privacy by design page sets out what we store and for how long. Our acceptable use rules prohibit the uses that EU law restricts, including automated decisions about people and searches for anyone under 18. The AI Act question is live for the whole category, and we update this page as the first enforcement cases land.