Case · Italy
Garante v Clearview AI (Italy)
Italy's data protection authority, the Garante per la protezione dei dati personali, fined Clearview AI EUR 20 million in a decision of 10 February 2022, announced on 9 March 2022, banned further collection of Italian residents' images, ordered deletion of the data it held, and required the company to appoint an EU representative. It was the first fine against Clearview in the European Union.
Updated November 6, 2026 · 3 min read · reviewed November 6, 2026
- EUR 20M
- Fine, decision of 10 February 2022
- First
- EU fine against Clearview AI
- 4
- Complaints plus reports that triggered the inquiry
Garante decision 9751362
Garante press release, 9 March 2022
Garante decision
What happened?
The Garante opened an inquiry in 2021 after complaints from individuals and reports from civil-society groups, and after press reports that Italian police had tested Clearview's service. Clearview argued that it had no Italian customers and no establishment in the EU, so the GDPR did not apply. The Garante disagreed: the company monitored the behaviour of people in Italy by collecting their images and converting them into biometric data, which brings it within Article 3(2).
-
2021-03
Inquiry opened
Complaints and reports received; Garante requests information from Clearview.
-
2022-02-10
Decision
Fine of EUR 20 million; ban; deletion; EU representative required.
-
2022-03-09
Publication
Garante publishes the decision and press release.
What did the Garante decide?
- Clearview processed personal data, including biometric and geolocation data, without a lawful basis; legitimate interest cannot cover building a face index from scraped photos.
- The company breached transparency (Articles 13 and 14), purpose limitation (Article 5) and storage limitation, keeping data indefinitely.
- It failed to respect data-subject rights and had not appointed a representative in the EU as Article 27 requires.
- Orders: stop collecting and processing Italian residents' data, delete what is held, designate an EU representative.
Why does it matter for face search?
The Italian decision was the first to apply the GDPR's full set of obligations to a web-scraping face index and to reject the argument that public photographs are fair game. It also addressed geolocation metadata embedded in photographs, which many engines strip (see EXIF metadata) but which Clearview was found to have retained. Later decisions by the CNIL, the Hellenic DPA and the Dutch DPA cite the same reasoning.
What happened next?
Clearview did not appeal in Italy and has not reported compliance. The Garante has no means of collecting from a company without EU assets, which is the recurring limit of the European Clearview decisions. The case is often cited as the model for regulator action against consumer face search engines, though no comparable Italian decision against a consumer engine had been published by 6 November 2026.
Questions
Was this the first fine against Clearview AI?
In the EU, yes. Canada's commissioners had issued findings in February 2021 and Australia's in October 2021, but neither carried a fine.
Did Clearview have Italian customers?
The company said it did not. The Garante held that the GDPR applies anyway because Clearview monitors the behaviour of people in Italy by indexing their faces.
What is an EU representative?
Under Article 27 of the GDPR, a company outside the EU that processes EU residents' data must designate a representative in the EU as a contact point for regulators and individuals. Clearview had not done so.
Did Clearview pay the Italian fine?
Neither Clearview nor the Garante has reported payment. Clearview did not appeal in Italy, but the authority has no means of collecting from a company with no establishment or assets in the European Union, which is the shared limit of every European Clearview decision.
Can an Italian resident still ask Clearview to delete their data?
Yes. The Garante's decision ordered deletion of Italian residents' data and the appointment of an EU representative, and the GDPR rights of access and erasure apply regardless of the fine. The decision does not say whether Clearview has acted on either order.
Sources
- 1.Garante: Facial recognition: Italian SA fines Clearview AI EUR 20 million (9 March 2022) (checked November 6, 2026)
- 2.European Data Protection Board: Italian SA fines Clearview AI EUR 20 million (checked November 6, 2026)
- 3.Reuters: Italy fines facial recognition firm Clearview AI EUR 20 million (checked November 6, 2026)
Entry reviewed November 6, 2026. Found an error? Tell us.
Related entries
- Engine Clearview AI Clearview AI: the law-enforcement face search built on scraped web images, its 100-billion-image claim, who may use it, and fines and orders from seven countries.
- Law General Data Protection Regulation (GDPR) and biometric data GDPR and face search: Article 9 biometric data, the household exemption, territorial reach under Article 3(2), fines up to 4%, and the Clearview and PimEyes cases.
- Case CNIL v Clearview AI (France) CNIL v Clearview AI: the 2021 formal notice, the EUR 20 million fine of October 2022, the EUR 5.2 million overdue penalty of 2023, and the enforcement gap.
- Case Hellenic DPA v Clearview AI (Greece) Hellenic DPA v Clearview AI: Greece's EUR 20 million fine of July 2022 after a Homo Digitalis complaint, the ban and deletion order, and its place in the EU.
- Term Biometric data Biometric data defined: identifying data from a face, fingerprint, iris or voice, when a photo becomes biometric data, and the GDPR, BIPA and DPDP rules.
- Term EXIF metadata EXIF metadata defined: the camera, time and location data embedded in photo files, what it can reveal, which platforms strip it, and how to remove it before sharing.
Cite this entry
FaceSearch Wiki editors. "Garante v Clearview AI (Italy)". FaceSearch Wiki, updated November 6, 2026. https://facesearch.wiki/cases/garante-v-clearview/