Clearview AI fined EUR 30.5 million by the Dutch DPA, with up to EUR 5.1 million in non-compliance penalties
Subject: Clearview AI (US facial recognition provider with no establishment in the EU)
What happened
Clearview sells facial recognition services to intelligence and investigative agencies: customers submit camera images to identify the people in them. To do this Clearview automatically scrapes photos from the internet into a database of more than 30 billion images and converts each face into a unique biometric code, without the knowledge or consent of the people concerned.
How it was handled
The Dutch DPA found Clearview seriously infringed the GDPR on several points: it should never have built the database of photos, biometric codes and linked information — biometric codes, like fingerprints, are biometric data whose collection and use is in principle prohibited, and Clearview could not rely on any statutory exception; it informs the people in the database insufficiently; and it does not cooperate with access requests. Clearview did not stop after the investigation, so the authority issued an order to cease the violations.
Outcome
A EUR 30.5 million fine, plus non-compliance penalties totalling up to EUR 5.1 million if the violations continue. The authority also warned that using Clearview’s services is itself unlawful and that Dutch organisations doing so may face heavy fines. Because Clearview has no EU establishment and has not changed its conduct despite earlier fines from other authorities, the Dutch DPA said it is investigating whether the company’s directors can be held personally liable. Clearview did not object to the decision and is therefore unable to appeal the fine.
What it means for Chinese exporters
- · Turning a face into a feature vector is processing biometric data. Many Chinese computer-vision companies market "we only store embeddings, not the original image" as a mitigation — under Art. 9 GDPR that is precisely the category of processing that is prohibited in principle, so you need an Art. 9(2) exception first, and without one you cannot proceed.
- · "We only serve law-enforcement customers outside the EU" does not exclude application. That is exactly what Clearview said, and the authority fined it anyway, treating the absence of an EU establishment as no obstacle; the duties follow the data subject.
- · Not participating in the procedure means waiving your remedy. Clearview did not object and thereby lost its right of appeal. On receiving an EU regulator’s decision, file the objection within the local procedural deadline to preserve rights even if you do not intend to pay.
- · Downstream buyers are named too. When selling facial recognition capability to EU customers, they will ask you to evidence the lawful provenance of training and gallery data; without it the deal dies at the procurement security questionnaire.
- · Personal liability of management is being actively pursued. Directors and responsible officers of overseas subsidiaries should keep a clear record of compliance decisions showing that they acted to stop the risk once aware of it.
Related regulations
Sources (1)
- Dutch DPA fines Clearview AI EUR 30.5 million with additional non-compliance penaltiesDutch Data Protection Authority (Autoriteit Persoonsgegevens) · published 2024-09-03 · retrieved 2026-09-12
Content as of 2026-09-12 · corpus 2026.09|Compiled from public official sources with links and review dates for compliance decision support. Rules change; have licensed professionals review before external disclosure, regulatory filing or contractual commitments.