Law · European Union and European Economic Area
General Data Protection Regulation (GDPR) and biometric data
The GDPR is the European Union's data protection law, applicable since 25 May 2018 in every member state and to companies anywhere that target or monitor people in the EU. Article 9 classifies biometric data processed to uniquely identify a person as a special category that is prohibited unless an exception applies. It is the legal basis for the fines and orders against Clearview AI and PimEyes.
Updated November 6, 2026 · 4 min read · reviewed November 6, 2026
- 25 May 2018
- Applicable in all member states
- 4%
- Maximum fine as a share of worldwide turnover
- EUR 90m+
- Fines against Clearview AI by four EU authorities, 2022 to 2024
Article 99
Article 83(5)
CNIL, Garante, HDPA, AP decisions
What does the GDPR say about faces?
Article 4(14) defines biometric data as personal data resulting from specific technical processing of a person's physical characteristics that allows or confirms their unique identification, such as facial images. A plain photograph is personal data but, per Recital 51, becomes biometric data only when processed through a specific technical means allowing unique identification. A face template computed by a search engine is exactly that.
Article 9(1) prohibits processing biometric data for the purpose of uniquely identifying a natural person unless one of the Article 9(2) exceptions applies: explicit consent, data manifestly made public by the data subject, substantial public interest under law, and a short list of others. Regulators have held that posting a photo online does not make the biometric template derived from it "manifestly public", and that an engine cannot rely on consent it never obtained.
Does it reach engines outside the EU?
Article 3(2) applies the Regulation to controllers outside the EU that offer goods or services to people in the EU or monitor their behaviour. Clearview AI, with no EU establishment, was held subject to the GDPR by the Italian, French, Greek and Dutch authorities on the monitoring limb. PimEyes, operating from the Seychelles, was pursued by German and Belgian authorities on the same basis. The household exemption in Article 2(2)(c) covers a private individual's purely personal activity, not a commercial service they use.
| Article | What it requires | How it was applied |
|---|---|---|
| Art. 6 lawful basis | A legal basis for any processing | Legitimate interest rejected for scraping faces at scale (CNIL, AP) |
| Art. 9 special categories | A specific exception for biometric identification | No exception found for Clearview or PimEyes |
| Art. 14 information | Tell people whose data was collected from other sources | Not met: data subjects were never informed |
| Art. 15 and 17 access and erasure | Answer access and deletion requests | Clearview failed to respond; fines increased |
| Art. 3(2) territorial scope | Monitoring of people in the EU | Both engines held subject to the GDPR |
| Art. 83 fines | Up to EUR 20m or 4% | EUR 20m each from CNIL, Garante, HDPA; EUR 30.5m from the Dutch AP |
Who enforces it?
Each member state's supervisory authority, coordinated through the European Data Protection Board. For a company with no EU establishment there is no lead authority, so any national regulator can act, which is why Clearview collected four separate fines. Individuals can complain to their authority, sue for compensation under Article 82, and be represented by non-profits such as noyb under Article 80.
What does it mean for face search?
In the EU, a search engine that computes templates from faces on public pages without a valid Article 9 exception has been held unlawful every time a regulator has examined it: CNIL v Clearview, Garante v Clearview, the Hellenic authority, the Dutch AP, Baden-Wurttemberg v PimEyes and the Belgian authority. The remedies have been fines, orders to delete EU residents' data and bans on further collection. Engines that serve EU users, whether PimEyes, FaceCheck.ID, Lenso.ai or FaceSearch, carry the same exposure; some respond by limiting face search to certain regions, by offering opt-outs, or by arguing that they index pages rather than people. The Regulation also gives every EU resident a right to erasure, which is the legal basis of the opt-out routes the engines publish.
What is pending or unsettled?
- The AI Act added, from 2 February 2025, an outright ban on untargeted scraping of facial images to build recognition databases, independent of GDPR analysis.
- noyb's 2026 action against PimEyes seeks enforcement of earlier orders; its outcome will show whether orders against offshore engines can be made effective.
- The Commission's 2025 'digital omnibus' proposals to simplify the GDPR do not touch Article 9.
Questions
Is a photo of my face biometric data under the GDPR?
Not by itself. It becomes biometric data when processed by a specific technical means to identify you uniquely, which is what a face search engine does when it computes a template.
Can I use the GDPR to get out of a face search engine?
Yes. Articles 15 and 17 give you access and erasure rights. Engines publish opt-out forms for this reason, and you can complain to your national authority if a request is ignored.
Does the GDPR apply to a US or Seychelles engine?
If it monitors people in the EU, yes, under Article 3(2). Regulators have applied it to Clearview and PimEyes; collecting the fines is a separate problem.
Is searching my own face allowed?
Using a service to find your own data is not the issue the regulators have addressed; their decisions concern the engine's collection of everyone's faces without consent.
Sources
- 1.EUR-Lex, Regulation (EU) 2016/679 (GDPR), consolidated text (checked November 6, 2026)
- 2.European Data Protection Board, Guidelines 05/2022 on the use of facial recognition technology in the area of law enforcement (checked November 6, 2026)
- 3.Autoriteit Persoonsgegevens, Dutch DPA imposes a fine on Clearview because of illegal data collection for facial recognition (3 September 2024) (checked November 6, 2026)
- 4.CNIL, Facial recognition: 20 million euros penalty against Clearview AI (October 2022) (checked November 6, 2026)
Entry reviewed November 6, 2026. Found an error? Tell us.
Related entries
- Law EU Artificial Intelligence Act and the ban on scraping faces EU AI Act Article 5(1)(e): the ban on untargeted scraping of facial images for recognition databases, in force since February 2025, fines up to 7% of turnover.
- Law EU Digital Services Act (DSA) and image removal The EU Digital Services Act: notice-and-action duties, statements of reasons, trusted flaggers, very large platform duties, fines up to 6%, and misused photos.
- Case CNIL v Clearview AI (France) CNIL v Clearview AI: the 2021 formal notice, the EUR 20 million fine of October 2022, the EUR 5.2 million overdue penalty of 2023, and the enforcement gap.
- Case Autoriteit Persoonsgegevens v Clearview AI (Netherlands) Dutch DPA v Clearview AI: the EUR 30.5 million GDPR fine of 2024, its penalty payments, why the decision is final, and what it means for face search engines.
- Organisation European Data Protection Board (EDPB) The EU body that coordinates national data protection authorities: its powers, its facial recognition and scraping guidance, and its 2026 smart glasses statement.
- Term Biometric data Biometric data defined: identifying data from a face, fingerprint, iris or voice, when a photo becomes biometric data, and the GDPR, BIPA and DPDP rules.
Cite this entry
FaceSearch Wiki editors. "General Data Protection Regulation (GDPR) and biometric data". FaceSearch Wiki, updated November 6, 2026. https://facesearch.wiki/laws/eu-gdpr/