Is face search legal in the United Kingdom?

The UK kept the GDPR after leaving the EU as the UK GDPR, read together with the Data Protection Act 2018, and the Information Commissioner's Office (ICO) enforces both. For face search that means the same core rule as in Europe: extracting a face template to identify someone is processing special category data, which needs explicit consent or another narrow condition. Around that sit the criminal offences that apply to people who misuse what they find, and a regulator for platforms, Ofcom, that did not exist in this role before 2023. This page extends the overview on is face search legal with the UK detail as of November 2026.

What does UK GDPR say about face templates?

Article 9 of the UK GDPR prohibits processing biometric data for the purpose of uniquely identifying a person unless one of the Article 9(2) conditions applies, and Schedule 1 of the Data Protection Act 2018 adds the UK-specific conditions. The ICO's Biometric data guidance: Biometric recognition, published in final form on 23 February 2024, says that running a biometric recognition system means processing special category data from the moment of collection, that explicit consent will usually be the only workable condition for a commercial deployment, and that a data protection impact assessment is required before the system is used. An engine that builds templates from scraped photos of UK residents has none of that, which is why the ICO's dispute with Clearview AI has run since 2021.

Can the ICO act against an engine based abroad? The Clearview AI case

The case matters beyond Clearview. If the ICO's jurisdiction over a company with no UK office is confirmed, every face search engine that indexes UK residents is within reach of UK GDPR enforcement, wherever it is based.

Is it legal to search for someone else's face in the UK?

Running a search is not an offence. The Protection from Harassment Act 1997, with the stalking offences added by the Protection of Freedoms Act 2012, criminalises a course of conduct that amounts to harassment or stalking, and monitoring a person's online activity is one of the listed examples. Using a face search to locate, follow or repeatedly contact someone who does not want contact is the kind of conduct those offences cover. Publishing what you found can engage the Malicious Communications Act 1988 and, for private information, the civil law of misuse of private information. Using a match to decide whether to employ, house or serve someone engages UK GDPR's fairness rules and, where a protected characteristic is involved, the Equality Act 2010. None of this prevents the ordinary check that someone you are about to meet or pay is who they say they are; see verify someone is real.

Which offences cover intimate images and deepfakes?

• Sharing an intimate image without consent. Section 66B of the Sexual Offences Act 2003, inserted by the Online Safety Act 2023 and in force since 31 January 2024, makes it an offence to share or threaten to share an intimate image without consent. The base offence no longer requires proof of intent to cause distress; aggravated versions cover intent to cause alarm or distress and sexual gratification. It covers deepfakes of real people.
• Creating a sexually explicit deepfake. The Data (Use and Access) Act 2025 added an offence of creating, or requesting the creation of, a purported intimate image of an adult without consent. It came into force on 6 February 2026.
• Cyberflashing. Section 66A of the same Act, also from the Online Safety Act, covers sending unsolicited images of genitals.
• Platform duties. The sharing offence was made a priority offence under the Online Safety Act in 2024, so platforms must assess and reduce the risk of it on their services. Ofcom's illegal content codes, in force since March 2025, require providers to take intimate image abuse down when they become aware of it, and Ofcom added hash-matching measures for non-consensual intimate images in 2026.

If this has happened to you, the intimate image abuse page puts the Revenge Porn Helpline, StopNCII and the police route before any search tool.

Where do you report a fake profile or a scam?

Report the account to the platform first; the fake profile page has each platform's route. For fraud, including romance and investment scams, report to Action Fraud in England, Wales and Northern Ireland, or to Police Scotland on 101. If you think a company is processing your biometric data unlawfully, you can complain to the ICO after raising it with the company, and you can ask the ICO to consider complaints about engines based overseas; the Clearview case will determine how far it can act on them.

Searching your own face versus someone else's

How does this apply to FaceSearch?

FaceSearch searches only publicly accessible pages and returns the pages where a similar face appears, with no names and no identity claims. Your upload is stripped of metadata, used only for your search and never used to build a face database, so your biometric data does not enter any index through us, and UK residents can be excluded from results for free by email through remove my photos. Our acceptable use rules ban the conduct the offences above describe and any employment, housing, credit or insurance use. We follow the ICO's biometric recognition guidance as the standard for how a UK engine should behave, and we update this page when the Court of Appeal rules.