Become a Member

Regulation TrackerLaws, orders and treaties read for their security duties and clocks Standards & FrameworksAttack taxonomies, control catalogues and frontier frameworks AI Incident DatabaseThe security incident record, with mechanism and lesson Research Paper LibraryThe papers that define the field, summarised OSS DirectoryRed teaming, guardrail, supply chain and evaluation tools Case StudiesProgrammes built, with measured outcomes AI Vulnerability TrackerCVEs and advisories for the components AI systems are built from

Latest in the tracker

New York Stop Addictive Feeds Exploitation (SAFE) for Kids Act and implementing rulesNew York's law restricting algorithmic feeds for minors takes effect on 25 January 2027 under final rules published in July 2026, with certified age assurance and $5,000-per-violation penalties.

Knowledge Base Regulation Tracker Standards & Frameworks OSS Directory AI Incident Database Research Paper Library Case Studies Society Articles News Jobs About Charter Become a Member

Home/Regulation Tracker/Enforcement decisions against Clearview AI: Italy, France, Netherlands and the UK

Enforcement decisions against Clearview AI: Italy, France, Netherlands and the UK

Four European regulators fined Clearview AI more than €75 million for building a facial-recognition database from scraped photos, establishing that GDPR reaches foreign AI companies and that web scraping of biometric data is unlawful without a legal basis.

clearviewfacial recognitionscrapinggdpr enforcement

At a glance

Country or region: Italy, France, Netherlands, United Kingdom, European Union
Extraterritorial reach: Yes
Current status: In force
Legally binding: Legally binding
Instrument: Enforcement decision or order
Applies to: Industry: Technology, Law enforcement and justice
Official text: Read the official text

All details 14

Applies to: Type of AI: Facial recognition, Biometric identification and categorisation, Training data and datasets, Surveillance and tracking systems
Who must comply: AI developers and providers, Deployers and operators
Proposed: 27 May 2021
Effective: 9 Mar 2022
Enforced by: Garante (Italy), CNIL (France), Autoriteit Persoonsgegevens (Netherlands), ICO (UK)
Penalty type: Administrative fine, Injunction or order, Product recall or ban
Penalties: Fines totalling over €75 million across the four regulators, plus bans on processing residents' data and deletion orders; largely unpaid, with the UK case restored on appeal in 2025.

Required actions

Scraping facial images from the web to build a biometric search database without a legal basis breaches the GDPR regardless of where the company is established - Regulators may fine, order deletion of data on their residents and pursue directors personally

Sources

autoriteitpersoonsgegevens.nlhttps://www.autoriteitpersoonsgegevens.nl/en/current/dutch-dpa-imposes-a-fine-on-clearvi…

Contribute

Spot an error, or know a record we should add? Members can propose additions and submit corrections.

Add regulation Report a correction or request removal