How PimEyes and Other Face Search Engines Work, and What It Takes to Build One (2026)

How a face search engine works#

The engines that publish anything about their technology describe some version of these four stages. PimEyes' privacy policy names its crawler (PimEyesBot) and says it indexes "fingerprints" of faces; Clearview's FAQ calls its product a combination of web crawling and facial recognition.

1. Collect images#

A crawler visits public web pages, downloads images and remembers where each one came from. That source URL is what a search result eventually shows you. Engines differ mostly in where they crawl: PimEyes says it does not index social media (about page), while FaceCheck.ID says its crawler takes images from social profiles, news sites, blogs and mugshot databases (FaceCheck.ID). Search4faces did not crawl the open web at all; it built databases of avatars from VK, Odnoklassniki, TikTok and Clubhouse (homepage).

2. Detect faces#

A face detector finds each face in an image, draws a box around it and locates landmarks such as the eyes and mouth so the face can be cropped and aligned. RetinaFace and SCRFD are two widely used open-source detectors, both published in the InsightFace repository.

3. Turn each face into an embedding#

A recognition model converts the aligned face into an embedding: a fixed-length vector of numbers, typically a few hundred long, trained so that photos of the same person land close together and photos of different people land far apart. ArcFace, also from InsightFace, is the best-known training method for this kind of model. The engine stores the vector and the source URL, not necessarily the photo.

4. Search the vector index#

When you upload a photo, the engine runs the same detector and model on it, then asks a vector index for the nearest stored vectors. Comparing against a billion vectors one by one is too slow, so engines use approximate nearest-neighbour search: libraries such as Meta's FAISS and graph methods such as HNSW trade a little accuracy for answers in milliseconds. Results above a similarity threshold come back as thumbnails with their source links.

Who actually runs their own face index#

Brand names suggest dozens of independent engines. Vendors' own terms and site code point to far fewer. The table below is based on what each company says about itself and what its public website code requests.

The engines with their own index#

PimEyes's privacy policy describes its PimEyesBot crawler and its index of face fingerprints, and its terms name the operator as EMEA Robotics LTD in Dubai, which describes itself as the owner of PimEyes. FaceCheck.ID says all its images are indexed from public web pages, and its API returns its own result objects plus a testing mode that "scans only 100,000 faces", which only makes sense with an index of its own; its terms name Tech Solutions of Belize City. Clearview AI told Australia's privacy regulator about an automated image scraper that functions as a web crawler, and its privacy policy lists scraped photos and face vector data.

Search4faces is different: its homepage lists databases rather than a crawl, including 1,109,563,766 VK profile photos collected between November 2019 and November 2020. Its API returns names, ages and cities alongside matches.

The brands that use someone else's engine#

Lenso.ai runs its own general image index, but its terms say its people search is provided by EYEMATCH AI and that facial recognition "is performed by EYEMATCH AI entirely". Its privacy policy names the supplier as EYEMATCH AI PTE. LTD. of Singapore, and EYEMATCH's own terms name Lenso as an intermediary. EYEMATCH does not publish an index size or a crawler name, so its claim to an own index is the company's word.

FaceSeek at faceseek.cc is careful with words: its privacy policy says it "may compare the submitted image with images indexed from publicly accessible online sources", never "our index". Its public JavaScript reads guest results from fields named for Copyseeker, PicDetective and Yandex, which are general reverse-image search services, not face-template indexes (the mapping from field names to products is our reading of the code). Small resellers are often open about it: StableFace says it is powered by FaceCheck.id, and FaceSift says it runs on the FaceCheck.ID engine. Trace AI Face Scan's privacy page says it queries public image search engines and, for roughly half of paid searches, an unnamed commercial face search service.

For results and prices from the user's side, see our face search engine comparison.

Einen Blick wert

ElevenLabs

Realistische KI-Sprecher, Synchronisation und Voice Cloning in Dutzenden Sprachen. Kostenlos starten.

ElevenLabs testen

So you want to build one: what it would take#

Start with the legal risk, because it decides everything else: in the EU, building a face database by scraping the internet is banned outright, and in Illinois each face collected without written consent can cost $1,000 to $5,000 in statutory damages. The sections below explain the technical and commercial parts at the level of architecture. We do not describe how to collect other people's photos.

The model: free, until you read the licence#

Detection and recognition models are the easy part. InsightFace's code is MIT-licensed, but its pretrained model packs such as buffalo_l and antelopev2 are for non-commercial research only, and commercial use needs a separate model licence with no published price. The restriction follows the weights into wrappers: DeepFace's README says the licences of the models it wraps are inherited, and CompreFace's InsightFace-based builds carry InsightFace's terms. Our face recognition API guide compares the licences and prices in detail.

The index: where the money and time go#

The index is the product, and it is slow to build. Search4faces' own homepage dates the collection of its 1.1 billion VK photos to a full year, November 2019 to November 2020. PimEyes lists "900+ million indexed pages" on its about page and promises regular database updates, because faces on the web change constantly.

Our rough estimate, not a vendor figure: one billion faces stored as 512-dimension embeddings in 32-bit floats is 1,000,000,000 x 512 x 4 bytes, about 2 TB of raw vectors before compression, plus the source URLs and thumbnails. Vector compression can shrink that several times, but every new image still has to be downloaded, run through a detector and a model, and re-checked when pages change. The recurring cost is the crawl and the GPU time, not the storage.

The cheaper route: resell an existing engine's API#

This is what most small brands do, and the suppliers' terms decide what is allowed:

• faceseek.online: its developer page prices a search at about $2.29 to $2.90, and its terms allow showing results to "your paying customers". The same terms bar reselling raw API access and make you responsible for "a lawful basis and any required consent for every face you submit".
• FaceCheck.ID: about $0.30 a search (API), paid in crypto with no refunds (buy page). Its terms say the site may not be used for commercial endeavours unless "specifically endorsed or approved", so a paid front end needs written approval first.
• Lenso.ai: its terms prohibit "sublicensing, reselling, or distributing the license", require users to confirm the photo shows only themselves, and exclude Illinois, the UK and the EEA.
• PimEyes: no public API. Its pricing page says PimEyes is available only through its own website, and the OSINT API is "exclusively offered as a Business-to-Business (B2B) product" with company verification and invoices.
• Search4faces: cheap per call (API), but its terms limit use to personal, non-commercial or internal business purposes unless approved.

Payments#

Stripe's restricted businesses list does not name face search, but it bars products that "directly infringe or facilitate infringement upon" the privacy rights of any third party, plus a catch-all for businesses it considers unfair, deceptive or predatory. The large engines do not take cards through Stripe directly: PimEyes' terms name LemonSqueezy and FastSpring as merchants of record, Lenso's pricing page loads Paddle, and FaceCheck.ID takes only cryptocurrency.

The law#

• EU AI Act, Article 5(1)(e): since February 2, 2025 it prohibits AI systems that create or expand facial recognition databases through untargeted scraping of facial images from the internet or CCTV. That describes the index-building step itself.
• Illinois BIPA: collecting a face geometry scan needs written notice and a written release from the person, and the statute lets individuals sue for $1,000 per negligent and $5,000 per intentional or reckless violation. The risk follows the face, not the buyer: the person pictured is the "subject", so blocking Illinois customers does not cover Illinois residents uploaded by someone else. In the Clearview litigation, Macy's, a customer that uploaded photos to Clearview, had most BIPA claims against it survive a motion to dismiss. PimEyes' privacy policy now says it offers no services in Illinois.
• Texas CUBI: capturing a face geometry record for a commercial purpose needs notice and consent, with civil penalties up to $25,000 per violation. Since January 1, 2026 the statute says an image online does not count as consent unless the person made it public themselves.
• Colorado: since July 1, 2025, anyone collecting biometric identifiers needs a written policy, notice and consent before disclosure, with penalties up to $20,000 per violation (summary).

More rulings, fines and settlements are in our face recognition laws guide.

Why the survivors are offshore#

The engines that run their own index sit far from the regulators most likely to act: PimEyes' operator is in Dubai and FaceCheck.ID's in Belize. A GDPR complaint against PimEyes was filed in Hamburg in 2020. According to noyb, the Hamburg authority concluded PimEyes acted unlawfully but took no concrete action, because the company appears to be based in Dubai; noyb sued the authority in April 2026 and the case is pending. Clearview, which is in the US, was fined EUR 30.5 million by the Dutch regulator in 2024. A new engine starting today would face the same choice: be reachable by regulators, or be offshore and hard for customers and payment providers to trust.

The honest conclusion#

Building a PimEyes-style engine is not mainly a technical problem. The code is open source; the index is expensive to collect, banned to scrape in the EU, and a per-face liability in Illinois and Texas. Two realistic paths remain:

• A narrow self-search product on a licensed API, such as helping people find where their own photos appear, built on a supplier whose terms permit it, with a lawyer reviewing consent flows before launch. Our opt-out guide shows the other side of that market: people removing their faces from these engines.
• Gallery matching on your own users' photos, with consent: photo libraries, event photo delivery, log-in or verification. Amazon Rekognition costs about $1 per 1,000 searches, and open-source libraries are free if you pick a commercially licensed model. That is a different business, and it is legal by design because every face in the index belongs to someone who agreed to be there.