EU Artificial Intelligence Act and the ban on scraping faces

1. 2021-04

   Commission proposal

   The draft lists remote biometric identification as high-risk but has no scraping ban.

2. 2023-06

   Parliament adds the scraping ban

   Amendments add a prohibition on untargeted scraping of facial images, citing Clearview AI.

3. 2024-03

   Parliament adopts the final text

   Trilogue agreement keeps the ban as Article 5(1)(e).

4. 2024-08-01

   In force

   Published in the Official Journal on 12 July 2024.

5. 2025-02-02

   Prohibitions apply

   Article 5 practices, including the scraping ban, become enforceable.

6. 2026-08-02

   Most remaining obligations

   High-risk requirements and the penalty regime fully in place (some high-risk deadlines were pushed to 2027 by the 2025 omnibus).

What does Article 5(1)(e) prohibit?

The placing on the market, putting into service or use of AI systems that create or expand facial recognition databases through the untargeted scraping of facial images from the internet or CCTV footage. Recital 43 explains the reasoning: such practices add to a feeling of mass surveillance and can lead to gross violations of fundamental rights including privacy. The ban has no exception for research, law enforcement or consent collected afterwards.

Three words carry the weight. Untargeted means indiscriminate collection rather than searching for a specific person. Facial recognition database means a collection built to recognise faces, which a web-scale face index is. Scraping means automated collection from publicly accessible sources. The Commission's February 2025 guidelines on prohibited practices confirm that the ban covers both building and expanding such a database and applies regardless of the later use.

What else in the Act touches faces?

Who enforces it?

Member states designate market surveillance authorities; several have named their data protection authority for biometric matters. The European AI Office coordinates and handles general-purpose models. Fines for a prohibited practice are the highest in the Act: up to EUR 35 million or 7% of worldwide turnover. Natural persons can complain to a market surveillance authority, and the GDPR remedies continue to apply in parallel.

What does it mean for face search?

Before 2025 the case against face search engines in Europe ran through the GDPR and needed a finding that no Article 9 exception applied. Since 2 February 2025 the question is simpler: an engine that builds or expands a face recognition database by scraping faces from the open web, and offers it in the EU, is operating a prohibited AI practice. That describes the business model of Clearview AI, PimEyes, FaceCheck.ID, FaceSearch and every other web-scale face engine as far as EU users are concerned. Whether an engine that excludes EU residents from its index, or geo-blocks EU users, is outside the ban is one of the arguments to watch; Lenso.ai's regional limit on face search and the EU-focused positioning of smaller engines are responses to this provision.

What is pending or unsettled?

• No published enforcement decision under Article 5(1)(e) against a face search engine by November 2026; data protection authorities have continued to use the GDPR.
• Whether 'placing on the market' covers an offshore engine accessible from the EU without targeting it.
• Whether a database built before February 2025 is covered when it is merely queried rather than 'expanded'; the Commission guidelines say that continued scraping to keep it current is expansion.
• The 2025 digital omnibus delayed some high-risk deadlines; the prohibitions were not changed.