Information Commissioner's Office (ICO) — Clearview AI Inc.
The ICO fined Clearview AI GBP 7,552,800 and ordered deletion of UK residents' data for unlawfully scraping facial images from the web into its facial-recognition database; in October 2025 the Upper Tribunal restored the ICO's jurisdiction to enforce against the company.
Key takeaway — how to prevent this
Biometric data (faces, iris, fingerprints) needs an explicit lawful basis or consent. Scraping or capturing it without one is unlawful across the EU/UK and many US states (e.g. Illinois BIPA) — and draws the largest fines.
Case brief
Read from the authority's press release on 2026-09-19. Every holding carries a short verbatim quote from that text.
- Decided by
- Upper Tribunal
- Parties
- UK Information Commissioner v. Clearview AI Inc.
- Decision date
- October 8, 2025
- Remedy
- The Upper Tribunal upheld three grounds of appeal and remitted the case back to the First-tier Tribunal on the basis that the Information Commissioner had jurisdiction to issue the penalty and enforcement notice.
- Amount
- £7,500,000
- Appeal
- Appeal pending
Key holdings
Clearview's processing of personal information relates to monitoring the behavior of UK residents.
“Clearview’s processing of personal information is related to monitoring of behaviour of UK residents.”
Clearview's processing remains within the scope of UK data protection law even if it serves foreign law enforcement and government agencies.
“Clearview’s processing does not fall outside the reach of UK data protection law on the basis that it provided its services to foreign law enforcement and government agencies.”
The First-tier Tribunal misapplied the law regarding the material scope of the UK GDPR.
“The FTT applied the law incorrectly in finding that Clearview’s processing of personal information was outside the material scope of the UK GDPR under Article 2(1)(a)*.”
The Upper Tribunal directed the case back to the First-tier Tribunal to determine the appeal on the merits.
“The UT directed that this case should be sent back to the FTT to determine the substantive appeal”
In plain English
In May 2022, the UK Information Commissioner fined US-based company Clearview AI Inc £7.5m and issued an enforcement notice. Clearview had scraped images of UK residents from web pages and social media to create a global database used for facial recognition services. Clearview appealed the decision to the First-tier Tribunal, which ruled in its favor. The Information Commissioner then appealed that decision to the Upper Tribunal. In October 2025, the Upper Tribunal handed down its judgment, upholding three of the Information Commissioner's four grounds of appeal. The Upper Tribunal determined that Clearview's processing relates to monitoring the behavior of UK residents and that providing services to foreign government agencies does not exempt it from UK data protection law. It also found that the lower tribunal applied the law incorrectly regarding the material scope of the UK GDPR. Consequently, the Upper Tribunal remitted the case back to the First-tier Tribunal to determine the substantive appeal on the basis that the Information Commissioner possessed proper jurisdiction. In December 2025, the Upper Tribunal granted Clearview permission to appeal its ruling to the Court of Appeal. The decision confirms that foreign organizations targeting UK residents remain subject to UK data protection oversight.
Inclusion does not imply wrongdoing or liability. Status reflects the latest information we have — always check the official source for current status.