# How PimEyes and Other Face Search Engines Work, and What It Takes to Build One (2026)

> How PimEyes, FaceCheck.ID and other face search engines work (crawler, face detector, embedding model, vector index), which brands run their own face index and which resell one, and what building one would take: model licences, index cost, supplier terms, payments and the law. Read November 12, 2026.

- Source: https://www.stork.ai/blog/how-face-search-engines-work-2026
- Publisher: Stork.AI editorial team
- Published: 2026-11-12
- Updated: 2026-11-12
- Language: en
- Reading time: 11 min

## Key takeaways

- A face search engine is four stages: crawler, face detector, embedding model, vector index.
- The models are open source; the scarce asset is the index of collected faces.
- Own indexes are evidenced for PimEyes, FaceCheck.ID, EYEMATCH (behind Lenso), Search4faces and Clearview; many brands resell.
- Supplier terms limit resale: Lenso forbids it, FaceCheck needs written approval, PimEyes' API is B2B-only.
- The EU AI Act bans building face databases by scraping; Illinois BIPA allows $1,000 to $5,000 per violation.

**Short answer:** a face search engine is a pipeline of four parts: a crawler that collects public images, a detector that finds the faces in them, an embedding model that turns each face into a list of numbers, and a vector index that finds the closest numbers to the face you upload. The models are close to a commodity; the scarce asset is the **index** of billions of collected faces, which is expensive to build and, in Europe, now illegal to build by scraping. Only a handful of companies show signs of running their own: [PimEyes](https://stork.ai/en/pimeyes), [FaceCheck.ID](https://stork.ai/en/facecheck-id), EYEMATCH AI (the engine behind [Lenso.ai](https://stork.ai/en/lenso-ai)'s face search), [Search4faces](https://stork.ai/en/search4faces) and [Clearview AI](https://stork.ai/en/clearview-ai). Many other brands resell one of those engines or merge results from general reverse-image search.

**How we checked:** we read each vendor's own terms, privacy policy, API documentation and public site code, plus regulators' decisions and the statutes themselves, on November 12, 2026. We did not run searches with real faces, sign up for paid plans or contact anyone. Where a conclusion is our reading of code or wording rather than a vendor's own statement, we say so. This is an explainer, not legal advice.

## How a face search engine works

The engines that publish anything about their technology describe some version of these four stages. PimEyes' [privacy policy](https://pimeyes.com/en/privacy-policy) names its crawler (PimEyesBot) and says it indexes "fingerprints" of faces; Clearview's [FAQ](https://www.clearview.ai/faq) calls its product a combination of web crawling and facial recognition.

### 1. Collect images

A crawler visits public web pages, downloads images and remembers where each one came from. That source URL is what a search result eventually shows you. Engines differ mostly in **where** they crawl: PimEyes says it does not index social media ([about page](https://pimeyes.com/en/about-us)), while FaceCheck.ID says its crawler takes images from social profiles, news sites, blogs and mugshot databases ([FaceCheck.ID](https://facecheck.id/en/topics/Facial-Recognition-Technology)). Search4faces did not crawl the open web at all; it built databases of avatars from VK, Odnoklassniki, TikTok and Clubhouse ([homepage](https://search4faces.com/en/)).

### 2. Detect faces

A face detector finds each face in an image, draws a box around it and locates landmarks such as the eyes and mouth so the face can be cropped and aligned. RetinaFace and SCRFD are two widely used open-source detectors, both published in the [InsightFace repository](https://github.com/deepinsight/insightface).

### 3. Turn each face into an embedding

A recognition model converts the aligned face into an embedding: a fixed-length vector of numbers, typically a few hundred long, trained so that photos of the same person land close together and photos of different people land far apart. ArcFace, also from InsightFace, is the best-known training method for this kind of model. The engine stores the vector and the source URL, not necessarily the photo.

### 4. Search the vector index

When you upload a photo, the engine runs the same detector and model on it, then asks a vector index for the nearest stored vectors. Comparing against a billion vectors one by one is too slow, so engines use approximate nearest-neighbour search: libraries such as Meta's [FAISS](https://github.com/facebookresearch/faiss) and graph methods such as [HNSW](https://arxiv.org/abs/1603.09320) trade a little accuracy for answers in milliseconds. Results above a similarity threshold come back as thumbnails with their source links.

> [!FACT] Every stage above exists as free, open-source code. What no repository contains is the index: the billions of collected face vectors and their source links. That is the part that separates a demo from PimEyes.

## Who actually runs their own face index

Brand names suggest dozens of independent engines. Vendors' own terms and site code point to far fewer. The table below is based on what each company says about itself and what its public website code requests.

| Brand | Own face index? | What is behind it | Operator and country (per its own pages) |
| --- | --- | --- | --- |
| PimEyes | Yes | Own crawler (PimEyesBot) and an index of face "fingerprints", per its privacy policy | EMEA Robotics LTD, Dubai, UAE |
| FaceCheck.ID | Yes, by its own statements | Says it indexes public pages; its API has a test mode that searches a 100,000-face sample | Tech Solutions, Belize City, Belize |
| Lenso.ai | Not for faces | Its terms say face search "is performed by EYEMATCH AI entirely" | LENSO AI S.A., Wroclaw, Poland |
| EYEMATCH AI | Says so | Its terms claim ownership of "the index and its contents"; no crawler disclosed | EYEMATCH AI PTE. LTD., Singapore |
| FaceSeek (faceseek.cc) | We found no sign of one | Its public site code reads results from general reverse-image services (Copyseeker, PicDetective, Yandex) | Humanity Founders, Inc., US |
| Search4faces | Yes (social avatars) | Published databases of VK, OK, TikTok and Clubhouse profile photos | Terms give a Kyrgyzstan registration and a Krasnodar, Russia address |
| Clearview AI | Yes | Own crawler and a database it describes as 100+ billion images; sold to agencies, not the public | Clearview AI, Inc., US |
| Small resellers (StableFace, FaceSift) | No | Say on their own sites that they run on FaceCheck.ID | Not stated |

*Sources linked in the sections below; read November 12, 2026. "Own index" means the company says it collects and stores face data itself, or its code shows no outside face engine.*

### The engines with their own index

[PimEyes](https://stork.ai/en/pimeyes)'s [privacy policy](https://pimeyes.com/en/privacy-policy) describes its PimEyesBot crawler and its index of face fingerprints, and its [terms](https://pimeyes.com/en/terms-of-service) name the operator as EMEA Robotics LTD in Dubai, which [describes itself](https://emearobotics.tech/about/) as the owner of PimEyes. [FaceCheck.ID](https://stork.ai/en/facecheck-id) says all its images are indexed from public web pages, and its [API](https://facecheck.id/Face-Search/API) returns its own result objects plus a testing mode that "scans only 100,000 faces", which only makes sense with an index of its own; its [terms](https://facecheck.id/Face-Search/Terms) name Tech Solutions of Belize City. [Clearview AI](https://stork.ai/en/clearview-ai) told [Australia's privacy regulator](https://www.oaic.gov.au/__data/assets/pdf_file/0016/11284/Commissioner-initiated-investigation-into-Clearview-AI%2C-Inc.-Privacy-2021-AICmr-54-14-October-2021.pdf) about an automated image scraper that functions as a web crawler, and its [privacy policy](https://www.clearview.ai/public-privacy-policy) lists scraped photos and face vector data.

[Search4faces](https://stork.ai/en/search4faces) is different: its [homepage](https://search4faces.com/en/) lists databases rather than a crawl, including 1,109,563,766 VK profile photos collected between November 2019 and November 2020. Its [API](https://search4faces.com/en/api.html) returns names, ages and cities alongside matches.

### The brands that use someone else's engine

[Lenso.ai](https://stork.ai/en/lenso-ai) runs its own general image index, but its [terms](https://lenso.ai/legal/terms-and-conditions) say its people search is provided by EYEMATCH AI and that facial recognition "is performed by EYEMATCH AI entirely". Its [privacy policy](https://lenso.ai/legal/privacy-policy) names the supplier as EYEMATCH AI PTE. LTD. of Singapore, and [EYEMATCH's own terms](https://eyematch.ai/terms-and-conditions) name Lenso as an intermediary. EYEMATCH does not publish an index size or a crawler name, so its claim to an own index is the company's word.

FaceSeek at faceseek.cc is careful with words: its [privacy policy](https://faceseek.cc/privacy-policy) says it "may compare the submitted image with images indexed from publicly accessible online sources", never "our index". Its public JavaScript reads guest results from fields named for Copyseeker, PicDetective and Yandex, which are general reverse-image search services, not face-template indexes (the mapping from field names to products is our reading of the code). Small resellers are often open about it: [StableFace](https://stableface.dev/) says it is powered by FaceCheck.id, and [FaceSift](https://facesift.com/blog/best-face-search-engines) says it runs on the FaceCheck.ID engine. Trace AI Face Scan's [privacy page](https://traceaifacescan.app/privacy/) says it queries public image search engines and, for roughly half of paid searches, an unnamed commercial face search service.

For results and prices from the user's side, see our [face search engine comparison](https://stork.ai/blog/best-face-search-engines-2026).

## So you want to build one: what it would take

Start with the legal risk, because it decides everything else: in the EU, building a face database by scraping the internet is banned outright, and in Illinois each face collected without written consent can cost $1,000 to $5,000 in statutory damages. The sections below explain the technical and commercial parts at the level of architecture. We do not describe how to collect other people's photos.

### The model: free, until you read the licence

Detection and recognition models are the easy part. [InsightFace](https://stork.ai/en/insightface)'s code is MIT-licensed, but its [pretrained model packs](https://github.com/deepinsight/insightface#license) such as buffalo_l and antelopev2 are for non-commercial research only, and commercial use needs a separate [model licence](https://www.insightface.ai/solutions/face-recognition-licensing) with no published price. The restriction follows the weights into wrappers: [DeepFace](https://stork.ai/en/deepface)'s [README](https://github.com/serengil/deepface) says the licences of the models it wraps are inherited, and [CompreFace](https://stork.ai/en/compreface)'s InsightFace-based builds carry InsightFace's terms. Our [face recognition API guide](https://stork.ai/blog/face-recognition-api-2026) compares the licences and prices in detail.

### The index: where the money and time go

The index is the product, and it is slow to build. Search4faces' own [homepage](https://search4faces.com/en/) dates the collection of its 1.1 billion VK photos to a full year, November 2019 to November 2020. PimEyes lists "900+ million indexed pages" on its [about page](https://pimeyes.com/en/about-us) and promises regular database updates, because faces on the web change constantly.

**Our rough estimate, not a vendor figure:** one billion faces stored as 512-dimension embeddings in 32-bit floats is 1,000,000,000 x 512 x 4 bytes, about **2 TB** of raw vectors before compression, plus the source URLs and thumbnails. Vector compression can shrink that several times, but every new image still has to be downloaded, run through a detector and a model, and re-checked when pages change. The recurring cost is the crawl and the GPU time, not the storage.

### The cheaper route: resell an existing engine's API

This is what most small brands do, and the suppliers' terms decide what is allowed:

- **faceseek.online:** its [developer page](https://www.faceseek.online/developers) prices a search at about $2.29 to $2.90, and its [terms](https://www.faceseek.online/terms) allow showing results to "your paying customers". The same terms bar reselling raw API access and make you responsible for "a lawful basis and any required consent for every face you submit".
- **FaceCheck.ID:** about $0.30 a search ([API](https://facecheck.id/Face-Search/API)), paid in crypto with no refunds ([buy page](https://facecheck.id/en/buy)). Its [terms](https://facecheck.id/Face-Search/Terms) say the site may not be used for commercial endeavours unless "specifically endorsed or approved", so a paid front end needs written approval first.
- **Lenso.ai:** its [terms](https://lenso.ai/legal/terms-and-conditions) prohibit "sublicensing, reselling, or distributing the license", require users to confirm the photo shows only themselves, and exclude Illinois, the UK and the EEA.
- **PimEyes:** no public API. Its [pricing page](https://pimeyes.com/en/pricing) says PimEyes is available only through its own website, and the [OSINT API](https://osint.pimeyes.com/terms-of-service) is "exclusively offered as a Business-to-Business (B2B) product" with company verification and invoices.
- **Search4faces:** cheap per call ([API](https://search4faces.com/en/api.html)), but its [terms](https://search4faces.com/termsofuse.html) limit use to personal, non-commercial or internal business purposes unless approved.

### Payments

[Stripe's restricted businesses list](https://stripe.com/legal/restricted-businesses) does not name face search, but it bars products that "directly infringe or facilitate infringement upon" the privacy rights of any third party, plus a catch-all for businesses it considers unfair, deceptive or predatory. The large engines do not take cards through Stripe directly: PimEyes' [terms](https://pimeyes.com/en/terms-of-service) name LemonSqueezy and FastSpring as merchants of record, Lenso's pricing page loads Paddle, and FaceCheck.ID takes only cryptocurrency.

### The law

- **EU AI Act, Article 5(1)(e):** since February 2, 2025 it [prohibits](https://ai-act-service-desk.ec.europa.eu/en/ai-act/article-5) AI systems that create or expand facial recognition databases through untargeted scraping of facial images from the internet or CCTV. That describes the index-building step itself.
- **Illinois BIPA:** collecting a face geometry scan needs written notice and a written release from the person, and the [statute](https://www.ilga.gov/legislation/ilcs/ilcs3.asp?ActID=3004&ChapterID=57) lets individuals sue for $1,000 per negligent and $5,000 per intentional or reckless violation. The risk follows the face, not the buyer: the person pictured is the "subject", so blocking Illinois customers does not cover Illinois residents uploaded by someone else. In the Clearview litigation, Macy's, a customer that uploaded photos to Clearview, [had most BIPA claims against it survive](https://law.justia.com/cases/federal/district-courts/illinois/ilndce/1:2021cv00135/395030/272/) a motion to dismiss. PimEyes' [privacy policy](https://pimeyes.com/en/privacy-policy) now says it offers no services in Illinois.
- **Texas CUBI:** capturing a face geometry record for a commercial purpose needs notice and consent, with civil penalties up to $25,000 per violation. Since January 1, 2026 the [statute](https://statutes.capitol.texas.gov/Docs/BC/htm/BC.503.htm) says an image online does not count as consent unless the person made it public themselves.
- **Colorado:** since July 1, 2025, anyone collecting biometric identifiers needs a written policy, notice and consent before disclosure, with penalties up to $20,000 per violation ([summary](https://www.paulhastings.com/thought-leadership/colorado-imposes-new-privacy-requirements-on-organizations-collecting-biometric-identifiers-and-data)).

More rulings, fines and settlements are in our [face recognition laws guide](https://stork.ai/blog/face-recognition-laws-2026).

### Why the survivors are offshore

The engines that run their own index sit far from the regulators most likely to act: PimEyes' operator is in Dubai and FaceCheck.ID's in Belize. A GDPR complaint against PimEyes was filed in Hamburg in 2020. According to [noyb](https://noyb.eu/en/no-action-taken-against-pimeyes-noyb-lawsuit-against-hamburg-dpa), the Hamburg authority concluded PimEyes acted unlawfully but took no concrete action, because the company appears to be based in Dubai; noyb sued the authority in April 2026 and the [case is pending](https://noyb.eu/en/project/biometric-data/c042). Clearview, which is in the US, was [fined EUR 30.5 million](https://www.autoriteitpersoonsgegevens.nl/en/current/dutch-dpa-imposes-a-fine-on-clearview-because-of-illegal-data-collection-for-facial-recognition) by the Dutch regulator in 2024. A new engine starting today would face the same choice: be reachable by regulators, or be offshore and hard for customers and payment providers to trust.

## The honest conclusion

Building a PimEyes-style engine is not mainly a technical problem. The code is open source; the index is expensive to collect, banned to scrape in the EU, and a per-face liability in Illinois and Texas. Two realistic paths remain:

- **A narrow self-search product on a licensed API,** such as helping people find where their own photos appear, built on a supplier whose terms permit it, with a lawyer reviewing consent flows before launch. Our [opt-out guide](https://stork.ai/blog/remove-your-face-from-face-search-engines-2026) shows the other side of that market: people removing their faces from these engines.
- **Gallery matching on your own users' photos, with consent:** photo libraries, event photo delivery, log-in or verification. [Amazon Rekognition](https://stork.ai/en/amazon-rekognition) costs about $1 per 1,000 searches, and open-source libraries are free if you pick a commercially licensed model. That is a different business, and it is legal by design because every face in the index belongs to someone who agreed to be there.

## Frequently asked questions

### How does PimEyes work?

PimEyes says its crawler, PimEyesBot, collects images from public websites and stores a numeric "fingerprint" of each face it finds. When you upload a photo, it computes the same fingerprint and returns indexed pages whose faces are most similar. PimEyes says it does not index social media.

### Does PimEyes have an API?

Not for the public. PimEyes says it is available only through its own website. Its separate OSINT service has an API that is offered only to businesses, such as government agencies and compliance or investigative teams, after company verification and with payment by invoice.

### Can I build my own face search engine?

Technically, the parts are open source: a face detector, an embedding model and a vector search library. The hard parts are the index and the law. Scraping faces to build a recognition database is banned in the EU, Illinois' BIPA allows lawsuits of $1,000 to $5,000 per face collected without written consent, and the popular InsightFace models are licensed for non-commercial research only.

### Is it legal to build a facial recognition database?

It depends on whose faces and how you got them. A database of your own users' faces, collected with notice and consent, can be legal. Building one by untargeted scraping of the internet is prohibited in the EU under Article 5(1)(e) of the AI Act since February 2, 2025, and US states such as Illinois, Texas and Colorado require notice and consent before collecting face geometry.

### What open-source models do face search engines use?

Engines rarely say which models they run. Common open-source building blocks are RetinaFace and SCRFD for face detection and ArcFace-style models for embeddings, all published in the InsightFace repository, plus vector search libraries such as FAISS. InsightFace's code is MIT-licensed, but its pretrained models are for non-commercial research only.