Information Commissioner v Clearview AI (United Kingdom)

GBP 7.55M

Monetary penalty issued 23 May 2022

ICO penalty notice

3 of 4

Commissioner's grounds upheld by the Upper Tribunal

[2025] UKUT 319 (AAC)

Pending

Court of Appeal stage as of 6 November 2026

ICO news page, press reports

What happened?

Clearview AI built a face index from more than 20 billion images scraped from the public web and sold search access to law-enforcement and other clients. The ICO investigated jointly with the Australian regulator (see OAIC v Clearview AI) and in November 2021 announced a provisional intention to fine the company. On 23 May 2022 it issued a monetary penalty notice for GBP 7,552,800 and an enforcement notice requiring Clearview to stop collecting UK residents' data and to delete what it held.

The ICO's findings were that Clearview had no lawful basis for processing, had not met the higher standard for biometric data under the UK GDPR, had kept data indefinitely, had not told people their images were being used, and had asked people who wanted to object for further personal data.

1. 2020-07

   Joint investigation opened

   ICO and the Office of the Australian Information Commissioner announce a joint inquiry.

2. 2021-11-29

   Notice of intent

   ICO announces a provisional fine of just over GBP 17 million.

3. 2022-05-23

   Penalty and enforcement notices

   Fine set at GBP 7,552,800; deletion ordered.

4. 2023-10-17

   First-tier Tribunal

   Tribunal finds the ICO lacked jurisdiction because the processing served foreign law enforcement.

5. 2025-10-08

   Upper Tribunal

   Appeal allowed on three of four grounds; case remitted.

6. 2025-12-19

   Permission to appeal

   Clearview granted permission to appeal to the Court of Appeal.

7. 2026

   Court of Appeal hearing

   Hearing reported; no judgment published as of 6 November 2026.

What did the tribunals decide?

Clearview argued that it only served non-UK law-enforcement bodies, so its processing fell outside the material scope of the UK GDPR. The First-tier Tribunal agreed on 17 October 2023 and set the notices aside. The ICO appealed. On 8 October 2025 the Upper Tribunal, in The Information Commissioner v Clearview AI Inc [2025] UKUT 319 (AAC), upheld three of the Commissioner's four grounds, holding that Clearview's processing was within the UK GDPR's scope because it related to the monitoring of UK residents' behaviour, and sent the case back for the First-tier Tribunal to decide Clearview's substantive appeal.

The Upper Tribunal then granted Clearview permission to appeal to the Court of Appeal on 19 December 2025. Press reports describe a Court of Appeal hearing in 2026. No judgment had been published when this entry was reviewed on 6 November 2026, so the penalty remains unenforced and the question of jurisdiction is not finally settled.

Why does it matter for face search?

• It is the leading UK authority on whether a foreign face search engine with no UK establishment is subject to the UK GDPR when it indexes UK residents' faces.
• The ICO's underlying findings, if restored, set the expectations for any engine indexing faces from the public web: a lawful basis, an Article 9 condition for biometric data, retention limits and transparency.
• The outcome will shape how the ICO approaches consumer face search engines; Big Brother Watch filed a complaint against PimEyes with the ICO in 2022 that has not produced a published decision.

What happened next?

Clearview faced parallel decisions in the Netherlands, France, Italy, Greece, Canada and Australia. In the United States the company settled the Illinois litigation (see ACLU v Clearview). The UK proceedings are the only ones in which a court has so far questioned the regulator's reach.