Clearview AI built a facial-recognition product by scraping billions of photos from the public internet, including social media, and using them to let customers identify a person from a single image. In 2020 the American Civil Liberties Union, the ACLU of Illinois and the law firm Edelson PC sued the company under the Illinois Biometric Information Privacy Act (BIPA), the 2008 state law that, in the ACLU’s words, requires “companies that collect, capture, or obtain an Illinois resident’s biometric identifier … to first notify that individual and obtain their written consent.” The suit, ACLU v. Clearview AI, was “filed on May 28, 2020.”
On May 9, 2022, the parties reached a settlement that the ACLU called a major win. Under its terms Clearview is “permanently banned, nationwide, from making its faceprint database available to most businesses and other private actors.” In addition, the company agreed to “cease selling access to its database to any entity in Illinois, including state and local police, for five years.” Clearview also agreed to maintain an opt-out request form letting Illinois residents upload a photo to block their faceprints from search results, and to spend $50,000 on internet ads publicizing it.
The case turned on BIPA’s structure: the statute gives individuals a private right of action and does not require proof of separate harm beyond the violation itself, which made it a powerful tool against biometric data collection done without consent.
Why business readers should care: the settlement showed how a single state biometric-privacy statute could reshape a company’s national business model, even where its data collection happened over the open web. BIPA’s consent requirement and private right of action made it the most consequential US law for facial recognition and biometric AI, and the Clearview outcome - a nationwide private-sector ban negotiated under one state’s law - became a reference point for later enforcement such as the 2023-ftc-rite-aid-facial-recognition-ban.