Face Recognition Laws in 2026: What Regulators Actually Did, and What It Means for You

The scorecard#

Europe: the strictest rules, uneven enforcement#

The AI Act bans face scraping#

Since February 2, 2025, Article 5 of the AI Act prohibits AI systems that create or expand facial recognition databases through untargeted scraping of facial images from the internet or CCTV footage (Article 5(1)(e)). It also restricts real-time remote biometric identification in publicly accessible spaces for law enforcement to three narrow exceptions (Article 5(1)(h)). The first rule is the one that matters for consumer face search: it describes how engines like Clearview and PimEyes build their indexes.

GDPR fines against Clearview#

Clearview, which sells to law enforcement and not the public, has collected the biggest European fines. The Dutch DPA fined it €30.5 million in 2024 for building an illegal database of billions of faces, including Dutch people's, and said Dutch organizations using Clearview break the law too. France's CNIL fined it €20 million in 2022 and ordered it to stop collecting and delete French residents' data.

The UK: a jurisdiction fight#

The UK's ICO fined Clearview £7.5 million in May 2022. A lower tribunal overturned it, ruling the processing was outside UK data law because Clearview served foreign governments. In October 2025 the Upper Tribunal sided with the ICO on three of its four grounds: Clearview's processing relates to monitoring UK residents' behaviour, and serving foreign agencies does not put it out of reach. The case goes back to the lower tribunal, and in December 2025 Clearview was given permission to appeal to the Court of Appeal.

PimEyes: illegal, says the regulator, but untouched#

This is the clearest picture of where enforcement stands. A complaint against PimEyes was filed with the Hamburg data protection authority in July 2020. Five years later, according to privacy group noyb, the authority concluded that PimEyes acted unlawfully and should have answered the complainant's access and deletion request, but took no concrete action beyond an information letter, because PimEyes appears to be based in Dubai and does not respond. noyb says PimEyes listed addresses in Poland, the Seychelles and Belize during the proceedings. It sued the Hamburg authority on April 30, 2026; the case is still pending.

PimEyes' own FAQ describes the service as searching only publicly available websites that permit indexing, and says it does not identify individuals. Regulators and the engine disagree on whether that is enough.

United States: no federal law, two expensive states#

Illinois BIPA#

Illinois' Biometric Information Privacy Act requires a company to tell people in writing and get a written release before it collects a face geometry scan, and to publish a retention and destruction schedule. Unusually, it lets individuals sue: $1,000 per negligent violation and $5,000 per intentional or reckless one. That private right of action is why so much US face-recognition litigation runs through Illinois, including the Clearview class action, settled in March 2025 with a 23% stake in the company for class members instead of cash.

Texas CUBI#

Texas' biometric law has no private right of action, but its attorney general has used it for two very large privacy settlements. Meta agreed to pay $1.4 billion in July 2024, which the attorney general calls the largest settlement ever obtained by a single state: according to the Texas attorney general, its photo-tagging feature ran facial recognition on almost every face in photos uploaded to Facebook for more than a decade. Google finalized a $1.375 billion settlement in October 2025 covering several privacy claims, including biometric data.

What this means if you use face search#

• Searching your own face, or checking a profile that contacted you, is not what these laws target. They target companies that collect and store face data.
• The engines' legal footing is contested. That is a reason to use their opt-outs; our step-by-step opt-out guide covers PimEyes, FaceCheck.ID, Lenso, FaceSeek, Search4faces and Clearview.
• Your upload is biometric data in the hands of a company that may sit outside your country's reach. Read the engine's retention terms first: PimEyes says 48 hours, FaceCheck says 24 hours for search history.
• Do not use a match to accuse anyone. Engines describe their results as similarity scores, not identity. Our comparison of face search engines covers what each one indexes and costs.

What this means if you build with face recognition#

• Never build your own face database from scraped images if you have EU users. That is exactly what Article 5(1)(e) bans.
• Illinois users: get written consent before you create a face template, publish a retention schedule, and do not sell the data. Statutory damages are per person, which is what turns a product feature into a class action.
• Using a vendor API does not make the obligation disappear. You still collect the face that you send to it. Read the vendor's own terms; Microsoft, for example, gates face identification behind a Limited Access application.
• Offshore does not mean safe for you. Regulators struggle to reach an engine in Dubai; they have no such trouble reaching a US or EU company with a bank account.