Glossary · Law
Consent (data protection)
In data-protection law, consent is a freely given, specific, informed and unambiguous indication that a person agrees to a particular use of their personal data. For biometric data it must usually be explicit. Consent is one of several legal bases, not the only one, and it is the basis face search engines most often lack for the faces they index, which is the core of the regulatory cases against them.
Updated November 6, 2026 · 2 min read
What makes consent valid?
- Freely given: no penalty for refusing, no bundling with an unrelated service.
- Specific: for a named purpose; consent to a profile photo is not consent to a face index.
- Informed: the person knows who processes the data, for what, for how long.
- Unambiguous: an action, not silence or a pre-ticked box.
- Explicit for special-category data such as biometric data: a clear statement, not an inference.
- Withdrawable at any time, as easily as it was given; withdrawal is what an opt-out implements.
Is a public photo consent to anything?
No. Publishing a photo on a public page makes it available; it does not consent to its collection into a biometric index. The GDPR has a narrow exception for data the person has "manifestly made public", and regulators have held in the Clearview cases that uploading a photo to social media does not meet it for face templates (see ICO v Clearview and CNIL v Clearview). Illinois' BIPA requires written consent before any collection, public source or not.
Is consent the only legal basis?
| Basis | Applies to | Why it fails for a face index |
|---|---|---|
| Consent | The uploader of a search photo | Available for the searcher, never obtained from the people indexed |
| Legitimate interests | Ordinary personal data | Not available for special-category biometric data under the GDPR |
| Contract | The customer relationship | The indexed person has no contract with the engine |
| Public interest, legal obligation | Authorities, specific duties | Private engines rarely qualify |
How do the regimes differ?
The GDPR and UK GDPR demand explicit consent for biometrics and police its quality. BIPA requires a written release and lets individuals sue. India's DPDP Act makes consent the default basis, with itemised notices and a consent-manager system under the 2025 rules, and limits processing of children's data. The CCPA works the other way: opt-out rights rather than prior consent, with a right to limit use of sensitive data.
What does it mean for someone using a face search engine?
You consent to the processing of your own uploaded photo in the engine's terms. You cannot consent on behalf of the person whose face you search, which is why engines' acceptable-use terms, and several laws, restrict searches to your own face or to lawful purposes. The engines index notes each engine's stated policy.
Questions
I posted the photo publicly. Did I consent to face search engines indexing it?
No. Public availability is not consent, and regulators have said so explicitly in the Clearview decisions. Engines rely on opt-outs and regional restrictions rather than consent for indexed faces.
Can consent be given by ticking a box in long terms?
Not for biometric data under the GDPR, which requires an explicit, specific statement separate from general terms. Courts and regulators have rejected bundled consent.
Sources
- 1.Regulation (EU) 2016/679 (GDPR), Articles 4(11), 6, 7 and 9 (checked November 6, 2026)
- 2.European Data Protection Board, Guidelines 05/2020 on consent (checked November 6, 2026)
Entry reviewed November 6, 2026. Found an error? Tell us.
Related entries
- Term Biometric data Biometric data defined: identifying data from a face, fingerprint, iris or voice, when a photo becomes biometric data, and the GDPR, BIPA and DPDP rules.
- Term Opt-out Opt-out defined for face search engines: a request to one engine to remove your face from its results, what it requires, what it does, and what it does not do.
- Law General Data Protection Regulation (GDPR) and biometric data GDPR and face search: Article 9 biometric data, the household exemption, territorial reach under Article 3(2), fines up to 4%, and the Clearview and PimEyes cases.
- Law India's Digital Personal Data Protection Act, 2023 India's DPDP Act 2023 and Rules 2025: phased commencement to May 2027, consent and notice duties, the Data Protection Board, penalties up to 250 crore rupees.
- Law Illinois Biometric Information Privacy Act (BIPA) Illinois BIPA (740 ILCS 14): consent before collecting face geometry, a private right of action, $1,000 to $5,000 per violation, the 2024 amendment, and face search.
- Case Information Commissioner v Clearview AI (United Kingdom) ICO v Clearview AI: the GBP 7.5 million fine, the 2023 tribunal loss, the October 2025 Upper Tribunal judgment, and the Court of Appeal stage pending in 2026.
Cite this entry
FaceSearch Wiki editors. "Consent (data protection)". FaceSearch Wiki, updated November 6, 2026. https://facesearch.wiki/glossary/consent/