> series: anatomy_of_a_breach —— part: 134 —— target: clearview_ai —— photos_scraped: 3,000,000,000 —— then: client_list_stolen<span class="cursor-blink">_</span>_
In January 2020, a New York Times investigation revealed that Clearview AI — a secretive startup founded in 2017 — had scraped approximately 3 billion photos from Facebook, Instagram, YouTube, Twitter, and millions of other websites to build a facial recognition database. The company sold access to this database to over 600 law enforcement agencies in the US, enabling officers to upload a photo of an unknown person and receive matches from the scraped dataset — effectively creating a surveillance capability that dwarfed anything previously available.
In February 2020, Clearview AI disclosed that its entire client list had been stolen in a data breach — revealing which law enforcement agencies, government departments, and private companies had purchased access to the facial recognition service. The double revelation — mass scraping of public photos combined with the theft of the client list — created a unique privacy crisis: not only were billions of people's photos in a surveillance database they had never consented to, but the list of organisations using that database was now also compromised. Multiple countries, including the UK (through the ICO), subsequently investigated Clearview AI and imposed fines for violating data protection law.
We'll scope your test for free and tell you exactly what you need. No obligation, no hard sell.
Free Scoping CallClearview AI taught two lessons: first, mass collection of publicly available data for purposes the individuals did not consent to is a data protection violation under GDPR. Second, surveillance companies — like Hacking Team (2015) and NSO Group (2019) — are themselves breach targets, and their compromise exposes their clients' activities.
For UK organisations, Cyber Essentials and GDPR compliance require that data collection is lawful, proportionate, and consented. Our web application testing assesses whether your platforms are being scraped. SOC in a Box monitors for scraping activity against your web assets. And UK Cyber Defence provides incident response when data scraping or misuse is detected.
<a href="/cyber-essentials">Cyber Essentials</a> addresses data protection. <a href="/penetration-testing/web-application">Application testing</a> detects scraping vulnerabilities. <a href="https://www.socinabox.co.uk">SOC in a Box</a> monitors for scraping activity.
We'll scope your test for free and tell you exactly what you need. No obligation, no hard sell.
Free Scoping Call