Baden-Wurttemberg data protection authority v PimEyes (Germany)

2021-05

Inquiry opened; four-week questionnaire sent

LfDI press release, 26 May 2021

2022-12

Administrative fine proceeding opened

LfDI press release, December 2022

Pending

Status on 6 November 2026

No published decision

What happened?

In 2020 the German outlet netzpolitik.org documented how PimEyes, then a Polish company, let anyone upload a face and find other photos of the same person on the public web. Complaints followed, including one that the Chaos Computer Club member Matthias Marx filed in Hamburg in July 2020. The Baden-Wurttemberg authority, which took the lead under Germany's federal structure, announced an inquiry on 26 May 2021 and sent PimEyes a questionnaire with a four-week deadline. The then commissioner, Stefan Brink, said the service threatened nothing less than the loss of anonymity.

During the inquiry PimEyes moved its registered seat from Poland to the Seychelles, which the authority said made a proceeding against a controller outside the EU harder to conduct. In December 2022 the LfDI announced that it had opened an administrative fine proceeding, stating that PimEyes processes biometric facial data for identification without a valid legal basis or explicit consent under Article 9 of the GDPR.

1. 2020-07

   Press investigation and first complaints

   netzpolitik.org reports; a complaint is filed with the Hamburg authority.

2. 2021-05-26

   LfDI inquiry

   Questionnaire sent to PimEyes with a four-week deadline.

3. 2021

   Move to the Seychelles

   PimEyes relocates its seat outside the EU.

4. 2022-11

   PimEyes responds

   The company submits a statement the authority described as unsatisfactory.

5. 2022-12

   Fine proceeding opened

   LfDI announces an administrative fine proceeding.

6. 2026-11-06

   Reviewed

   No published fine or final decision.

What has the authority decided?

Nothing final has been published. The LfDI's stated position is that a face search engine creates and compares biometric templates of people in Germany, that this is processing of special-category data under Article 9, and that none of the exceptions applies because the people concerned never consented and the photos being public does not change their status. Opening a fine proceeding is not a finding of guilt; the authority itself noted that it does not mean a fine will follow. A change of commissioner in 2023 and the company's non-EU seat are both cited in German coverage as reasons the file has stalled.

Why does it matter for face search?

• It is the first regulatory proceeding against a consumer face search engine in the EU, as opposed to a law-enforcement vendor such as Clearview.
• The legal theory, that creating a searchable biometric index from public photos needs an Article 9 basis, is the same one applied in the Clearview decisions in Italy, France and the Netherlands.
• The lack of an outcome after five years is now itself the subject of litigation; see Hamburg, Belgium and the noyb lawsuit.

What happened next?

PimEyes changed its public positioning, describing the service as a tool for people to find their own images, added an opt-out form that requires an ID scan, and in 2024 announced it would block searches that detect a child's face. None of this closes the proceeding. The Hamburg authority, dealing with the 2020 complaint, issued a decision on 7 November 2025 that found the processing unlawful but took no enforcement step, and noyb sued that authority in April 2026. The Baden-Wurttemberg file remained open with no published result.