Face-search engines
Face-search engines let someone upload a photo of a face and get back other photos of the same face found on public web pages, with links. PimEyes and FaceCheck.ID are open to the public, and Clearview AI provides its database to its customers. You can ask each one to stop showing your face, and biometric laws in the EU, UK and Illinois may give you stronger rights. An opt-out does not remove the original photo.
- Written by
- UltoPulto Editorial
- Published
- Last reviewed
General information, not legal advice. This page has not yet been reviewed by a lawyer; check the linked primary sources before relying on it.
Key takeaways
- A face-search engine keeps a numeric template of each face it finds, with the address of the page.
- The opt-outs ask for your own photo and an identity check, so you submit them yourself.
- An opt-out hides matches in that engine. The photo stays on the site that published it.
What is the problem?
A face-search engine turns a photo into a search query. PimEyes says it stores face fingerprints of photos found on publicly available websites. FaceCheck.ID says it indexes photos from public web pages. The UK Information Commissioner's Office (ICO) found that Clearview AI scraped images of UK residents from the web and social media into a global database that its customers could use for facial recognition.
One photo of you can therefore lead to other pages where your face appears, with your name, employer or location.
How does it happen?
These services collect images from public pages, detect the faces in them and keep a numeric template of each face with the address of the page. When someone uploads a photo, the engine compares it with the stored templates and returns likely matches.
The engine does not host the original image. PimEyes states that it cannot take a photo down from the website it was posted on. An opt-out hides matches in that engine; the source page stays online until its owner removes it.
What laws may apply?
- EU and UK data protection law. Under Article 9 of the GDPR, biometric data used to uniquely identify a person is a special category, and processing it is prohibited unless a listed exception applies. In May 2022 the ICO fined Clearview AI 7.5 million pounds. Clearview appealed, and in October 2025 the Upper Tribunal found that its processing is not outside UK data protection law.
- EU AI Act. Since 2 February 2025, Article 5 has prohibited AI systems that create or expand facial recognition databases through untargeted scraping of facial images from the internet or CCTV footage.
- Illinois, BIPA. A scan of face geometry is a biometric identifier, although photographs themselves are excluded. A private entity must obtain a written release before collecting one. A person may sue and recover $1,000 for each negligent violation or $5,000 for each intentional or reckless one, or actual damages if greater.
- Other US states. Clearview AI publishes request forms for residents of California, Virginia and several other states. What you can ask for depends on your state.
What you can do yourself
These steps are free and do not need UltoPulto.
- PimEyes: submit the opt-out request form. It asks for a clear photo of your face, an anonymised scan of an ID or passport, and an email address.
- FaceCheck.ID: search with your own photo, open Remove My Photos, select the results and verify with a selfie or an anonymised ID. FaceCheck.ID says removal is free and that the photos are hidden immediately.
- Clearview AI: use the request form for your state. Illinois residents have a dedicated opt-out form.
- Deal with the source. Ask the site that hosts the photo to remove it, or make the profile private.
- Keep the confirmation emails and search again after a few months.
What UltoPulto can do
- The Exposure Scan includes a guided check of face-search engines.
- Guided opt-out steps for PimEyes and FaceCheck.ID. You submit the request with your own photo; we track it and re-check.
- On-device face matching. Face detection and embedding run in your browser. The models are being added to the public build.
- An evidence trail on each case: what was requested, when, the reply and the status history.
- Scheduled re-scans that open a new case when a match has reappeared.
What UltoPulto cannot do
- Submit a PimEyes or FaceCheck.ID opt-out for you. Both ask for your own photo and an identity check.
- Remove the original photo from the website that hosts it. That needs a separate request to the site.
- Promise that an engine will not index a new photo of you later, or that it will agree. If it refuses, the case is marked refused.
- Remove your face from a recognition or image model that has already been trained. No service can do that.
Sources
- 1Opt-Out Request FormPimEyes
- 2Delete Your Photos from FaceCheck.ID Search EngineFaceCheck.ID
- 3Privacy & RequestsClearview AI
- 4UK Upper Tribunal hands down judgment on Clearview AI IncInformation Commissioner's Office (UK)
- 5Art. 9 GDPR: Processing of special categories of personal dataGDPR text, gdpr-info.eu
- 6Article 5: Prohibited AI PracticesEU Artificial Intelligence Act text, Future of Life Institute
- 7Biometric Information Privacy Act (740 ILCS 14)Illinois General Assembly
Questions
Does opting out of a face-search engine delete my photos from the internet?
No. The opt-out stops that engine from showing matches for your face. The photos stay on the websites that published them until those sites take them down.
Why do these sites ask for my photo and ID to opt out?
The engine needs a photo to find the face templates to exclude, and an identity check to confirm the request is yours. PimEyes states that the photo is not used for any other purpose.
Is it legal to scrape faces from the web?
It depends on the place. EU law prohibits building facial recognition databases through untargeted scraping, and Illinois requires a written release before a face scan is collected.
I live in Illinois. Does that change anything?
It may. Illinois law covers scans of face geometry and gives individuals a right to sue, and Clearview AI offers Illinois residents an opt-out form.