吃瓜直播

Secretly, and without consent, a company called Clearview AI has captured billions of faceprints from people鈥檚 online photos, amassing what it claims to be the world鈥檚 largest face recognition database. Much like our fingerprints and DNA profiles, our faceprints rely on permanent, unique facts about our bodies 鈥� like the distance between our eyes and noses or the shape of our cheekbones 鈥� to identify us.

Using our faceprints, Clearview offers its customers the ability to secretly target and identify any of us, and then to track us 鈥� whether we鈥檙e going to a protest, a religious service, a doctor, or all of the above 鈥� and even to reach back in time to find us in old selfies, school and college photos, and videos. In other words, it . It also threatens our security and puts us at greater risk of identity theft by maintaining a massive biometric database, akin to a secret warehouse of housekeys.

Clearview鈥檚 nonconsensual capture of our faceprints is dangerous. It is also illegal in at least one state.

In May of last year, we sued Clearview for violating Illinois鈥� , a state law that prohibits capturing individuals鈥� biometric identifiers, like face and fingerprints, without notice and consent. We represent a group of organizations whose members and service recipients stand to suffer particularly acute harms from nonconsensual faceprinting and surveillance: survivors of domestic violence and sexual assault, undocumented immigrants, current and former sex workers, and individuals who regularly exercise their constitutional rights to protest and access reproductive health care services.

Notwithstanding these harms, Clearview asked the court to dismiss our case, arguing, in part, that the company has a First Amendment right to capture our faceprints without our consent.

As advocates for both free speech and privacy, we take this objection seriously 鈥� and we strongly disagree. As we explained to the court previously and again this week, Clearview鈥檚 view is at odds with long-established First Amendment doctrine, and could spell the end of privacy and information security laws if accepted.

Clearview argues that, to create its face recognition product, it gathers publicly-available photographs from across the internet and then uses them to run a search engine that simply expresses Clearview鈥檚 opinion about who appears to be in the photos. Clearview claims that, like a search engine, it has a First Amendment right to disseminate information that is already available online.

But our lawsuit doesn鈥檛 challenge 鈥� and BIPA doesn鈥檛 prohibit 鈥� Clearview鈥檚 gathering or republishing photographs from across the internet, or expressing its views about who appears in those photos. Clearview is free to discuss or disseminate photographs it finds online. What it can鈥檛 do under Illinois law is capture people鈥檚 faceprints from those photographs without notice and consent. That is a distinct action, which can cause grave harms.

Accepting Clearview鈥檚 argument to the contrary would mean agreeing that collecting fingerprints from public places, generating DNA profiles from skin cells shed in public, or deciphering a private password from asterisks shown on a public login screen are all fully protected speech. And it would depart from decades of judicial precedent permitting laws banning wiretapping, stealing documents, or breaking into a home 鈥� all acts that become legal if done with consent 鈥� even when that conduct might generate or capture newsworthy information. In other words, the fact that a burglar intends to publish documents they steal doesn鈥檛 mean the burglary is protected by the First Amendment. Likewise, the fact that Clearview intends to disseminate people鈥檚 photos after capturing faceprints from them doesn鈥檛 mean the company has a constitutional right to capture the faceprints without consent.

At the same time, BIPA does have an incidental effect on the speech Clearview seeks to engage in after capturing a faceprint, and so the law is subject to some First Amendment scrutiny. In , the Supreme Court explained that regulations of conduct that have an incidental effect on speech are subject to so-called 鈥渋ntermediate scrutiny.鈥� That means that the First Amendment is satisfied as long as (1) the government has the power to enact the regulation in the first place, and (2) the regulation furthers an important government interest that (3) isn鈥檛 related to suppressing free expression, and (4) burdens speech no more than it necessary to further the government鈥檚 interest.

BIPA 鈥� and its application to Clearview in our lawsuit 鈥� satisfies that test.

First, Illinois has the power to pass a law like BIPA, which is designed to protect its residents against irreparable privacy harms and identity theft.
Second, BIPA鈥檚 notice-and-consent requirement furthers the state鈥檚 substantial interests in privacy and security. Our faceprints can be used to track us across physical locations, photographs, and videos, painting a complete picture of our lives and associations. This threat of surveillance also chills our speech. And, because biometric identifiers are often used to enable access to secure locations and information 鈥� like the face recognition feature on our phones or the fingerprint scan to enter our offices 鈥� the capture of our faceprints without our notice and consent poses security risks.

These dangers aren鈥檛 hypothetical. In recent months, government actors have relied on faceprint technology to identify and track protesters in and on , and such technology has resulted in and at least . Clearview AI has contemplated providing its technology to conduct 鈥渆xtreme opposition research,鈥� and it has given access to , as well as celebrities and wealthy businesspeople, to use as they would like, including to . Recently, it entered into a And, in the last year, it suffered a data breach (though thankfully not of its faceprint database).

Third, Illinois鈥� interest in BIPA鈥檚 notice-and-consent requirement is not about silencing or limiting speech. BIPA does not prevent anyone, including Clearview, from discussing the topic of identity or from expressing an opinion about who appears to be in a photograph, regardless of what that opinion may be. Indeed, even if Clearview didn鈥檛 speak at all, and simply captured faceprints that it kept in a massive, insecure database, it would violate BIPA. BIPA is not a regulation of speech.

Finally, BIPA鈥檚 notice-and-consent requirement is sufficiently tailored to Illinois鈥� substantial interests in protecting privacy, security, and speech. The problem BIPA seeks to solve is individuals鈥� lack of knowledge about and control over the capture of their biometric identifiers 鈥� and requiring notice and consent perfectly solves it. At the same time, the law doesn鈥檛 restrict more speech than necessary because it doesn鈥檛 ban the use of faceprints; it simply requires consent first.  

If Clearview鈥檚 position prevails, states will be powerless to enact protections against violations of privacy that involve data. But that is a dangerous misreading of the First Amendment. Reasonable notice-and-consent laws governing conduct, like BIPA, simply do not violate the First Amendment.