Face recognition settlement highlights lack of federal law

Driving the news: Clearview and various groups, including the ACLU, announced a deal on Monday to settle a suit brought in May 2020 on behalf of sexual assault and domestic violence survivors as well as sex workers and others vulnerable to having their images catalogued.

• The suit was filed in Illinois, which has uniquely strong regulations limiting how facial images, fingerprints, voiceprints and other identifying personal information can be collected, shared and stored.

Terms of the deal:

• Clearview won't sell its full facial recognition database and algorithm to private companies for use in the U.S.
• The company will also cease selling access to its database of faces to any entity in Illinois, including state and local police, for five years.
• Those in Illinois can also opt out of being included in Clearview's database. (Ironically, they will have to submit a photo ID to be removed, though the settlement bars Clearview from using that facial image for anything other than removal.)

Catch up quick: Clearview AI has one of the largest databases of human faces, largely built by scraping photos from online sites including Facebook, LinkedIn and Venmo.

• It sells its technology primarily as a subscription service to law enforcement agencies, though it also has broader commercial ambitions.
• The firm told investors last month that "almost everyone in the world will be identifiable" after it collects its targeted 100 billion facial photos, the Washington Post reported.

Between the lines: Clearview offered three different statements — one from its CEO and two from its lawyers — playing up how little this change will affect the company's operations.

• CEO Hoan Ton-That says Clearview plans to sell a portion of its facial recognition technology to businesses, even if it can't sell its database of faces.
• "We have let the courts know about our intention to provide our bias-free facial recognition algorithm to other commercial customers, without the database, in a consent-based manner," he said in a statement.

The big picture: The suit was only possible because of the Illinois law, showing the power state legislation can have even in the absence of federal rules.

• "It speaks how important it is for states to step in and fill the gap that’s been left by Congress’ inability to pass strong privacy laws," Nathan Freed Wessler, a deputy director of the ACLU Speech, Privacy, and Technology Project, told Axios.

Yes, but: Only Congress can set nationwide rules and only it has the power to address how the federal government makes use of facial recognition.

• A wide swath of interests, from advocacy groups to tech companies such as Microsoft and IBM, have called on the federal government to take action, though they may not agree on the details.
• Federal agencies say they plan to increase their use of facial recognition technology.
• "Surveillance partnerships between private companies and governments are a far-reaching threat to privacy, racial justice, free speech, and information security," said Electronic Frontier Foundation senior staff attorney Adam Schwartz. EFF has called for a federal law banning government use of face recognition technology, including via private contractors such as Clearview.

Be smart: By settling now, Clearview avoided having to share more details on how it used Facebook and other services to build its algorithm.

• "We didn’t get far enough in discovery to learn information about how that alogrithm was developed or trained," Wessler acknowledged.
• Wessler said that the deal was the strongest the plaintiffs could obtain given the limits of the Illinois law.
• The company still faces challenges to the use of its technology in the U.S. and abroad.

WHERE WOULD THIS GO? Last year, TikTok updated its terms of service to say the popular app will automatically collect "faceprints and voiceprints" without details on how they will be used.