--- title: "GDPR and AI: A Case Study of Extraterritorial GDPR Application with Clearview AI Decisions" id: "2814" type: "post" slug: "gdpr-and-ai-a-case-study-of-extraterritorial-gdpr-application-with-clearview-ai-decisions" published_at: "2024-10-10T13:02:01+00:00" modified_at: "2026-03-03T09:45:04+00:00" url: "https://augustdeboustg.wpenginepowered.com/en/legal-article/gdpr-and-ai-a-case-study-of-extraterritorial-gdpr-application-with-clearview-ai-decisions/" markdown_url: "https://augustdeboustg.wpenginepowered.com/en/legal-article/gdpr-and-ai-a-case-study-of-extraterritorial-gdpr-application-with-clearview-ai-decisions.md" taxonomy_category: - "Legal Article" taxonomy_language: - "English" taxonomy_post_translations: - "pll_6980dd4c1ac63" taxonomy_tax_expertise: - "Personal Data and Cybersecurity" - "Tech, Digital and Data Litigation" taxonomy_tax_secteur: - "Tech & Digital" --- Menu Interagir avec notre IA Practice Areas (66) Transactional- [Artificial intelligence](https://augustdeboustg.wpenginepowered.com/en/expertise/artificial-intelligence/) - [Capital Markets](https://augustdeboustg.wpenginepowered.com/en/expertise/capital-markets/) - [Commercial and International Contracts](https://augustdeboustg.wpenginepowered.com/en/expertise/commercial-and-international-contracts/) - [Commercial Contracts and Strategic Partnerships](https://augustdeboustg.wpenginepowered.com/en/expertise/commercial-contracts-and-strategic-partnerships/) - [Competition Law, European Regulation and FDI](https://augustdeboustg.wpenginepowered.com/en/expertise/competition-state-aid/) - [Consumer, Marketing & Advertising](https://augustdeboustg.wpenginepowered.com/en/expertise/distribution-and-consumer-law/) - [Financing](https://augustdeboustg.wpenginepowered.com/en/expertise/financing/) - [Foreign Investment Control](https://augustdeboustg.wpenginepowered.com/en/expertise/foreign-investment-control/) - [Go-to-Market](https://augustdeboustg.wpenginepowered.com/en/expertise/go-to-market/) - [Intellectual Property](https://augustdeboustg.wpenginepowered.com/en/expertise/intellectual-property/) - [International Trade](https://augustdeboustg.wpenginepowered.com/en/expertise/international-trade/) - [Labor and Social Security Law](https://augustdeboustg.wpenginepowered.com/en/expertise/labor-and-social-security-law/) - [Mergers-acquisitions](https://augustdeboustg.wpenginepowered.com/en/expertise/mergers-acquisitions/) - [Patents](https://augustdeboustg.wpenginepowered.com/en/expertise/patents/) - [Personal Data and Cybersecurity](https://augustdeboustg.wpenginepowered.com/en/expertise/personal-data-and-cybersecurity/) - [Private equity](https://augustdeboustg.wpenginepowered.com/en/expertise/private-equity/) - [Projects and Infrastructure](https://augustdeboustg.wpenginepowered.com/en/expertise/projects-and-infrastructure/) - [Public Procurement](https://augustdeboustg.wpenginepowered.com/en/expertise/public-procurement/) - [Real Estate and Construction](https://augustdeboustg.wpenginepowered.com/en/expertise/real-estate-and-construction/) - [Restructuring](https://augustdeboustg.wpenginepowered.com/en/expertise/restructuring/) - [Securities Law](https://augustdeboustg.wpenginepowered.com/en/expertise/securities-law/) - [Tax](https://augustdeboustg.wpenginepowered.com/en/expertise/tax/) - [Tech And Digital](https://augustdeboustg.wpenginepowered.com/en/expertise/tech-and-digital/) Dispute Resolution- [Administrative and Public Law Litigation](https://augustdeboustg.wpenginepowered.com/en/expertise/administrative-and-public-law-litigation/) - [Arbitration and ADR](https://augustdeboustg.wpenginepowered.com/en/expertise/arbitration-and-adr/) - [Class Actions](https://augustdeboustg.wpenginepowered.com/en/expertise/class-actions/) - [Commercial and Corporate Litigation](https://augustdeboustg.wpenginepowered.com/en/expertise/commercial-and-corporate-litigation/) - [Competition Litigation](https://augustdeboustg.wpenginepowered.com/en/expertise/competition-consumer-and-distribution-litigation/) - [Constitutional Litigation](https://augustdeboustg.wpenginepowered.com/en/expertise/constitutional-litigation/) - [Defective Products and Insurance Litigation](https://augustdeboustg.wpenginepowered.com/en/expertise/defective-products-and-insurance-litigation/) - [Employment and Social Security Litigation](https://augustdeboustg.wpenginepowered.com/en/expertise/employment-and-social-security-litigation/) - [Environmental and ESG Litigation](https://augustdeboustg.wpenginepowered.com/en/expertise/environmental-and-esg-litigation/) - [European Litigation](https://augustdeboustg.wpenginepowered.com/en/expertise/european-litigation/) - [Insolvency and Restructuring](https://augustdeboustg.wpenginepowered.com/en/expertise/insolvency-and-restructuring/) - [Intellectual Property, Media, and Press Litigation](https://augustdeboustg.wpenginepowered.com/en/expertise/intellectual-property-media-and-press-litigation/) - [Patent Litigation](https://augustdeboustg.wpenginepowered.com/en/expertise/patent-litigation/) - [Real Estate, Construction, and Land Use Litigation](https://augustdeboustg.wpenginepowered.com/en/expertise/real-estate-construction-and-land-use-litigation/) - [Securities Litigation](https://augustdeboustg.wpenginepowered.com/en/expertise/securities-litigation/) - [Tax litigation](https://augustdeboustg.wpenginepowered.com/en/expertise/tax-litigation/) - [Tech, Digital and Data Litigation](https://augustdeboustg.wpenginepowered.com/en/expertise/tech-digital-and-data-litigation/) - [White-Collar Crime and Investigations](https://augustdeboustg.wpenginepowered.com/en/expertise/white-collar-crime-and-investigations/) Advisory- [Artificial intelligence](https://augustdeboustg.wpenginepowered.com/en/expertise/artificial-intelligence/) - [Commercial Contracts and Strategic Partnerships](https://augustdeboustg.wpenginepowered.com/en/expertise/commercial-contracts-and-strategic-partnerships/) - [Consumer, Marketing & Advertising](https://augustdeboustg.wpenginepowered.com/en/expertise/distribution-and-consumer-law/) - [Go-to-Market](https://augustdeboustg.wpenginepowered.com/en/expertise/go-to-market/) - [Governance and Corporate Law](https://augustdeboustg.wpenginepowered.com/en/expertise/gouvernance-et-droit-des-societes/) - [Insurance Law](https://augustdeboustg.wpenginepowered.com/en/expertise/insurance-law/) - [Intellectual Property](https://augustdeboustg.wpenginepowered.com/en/expertise/intellectual-property/) - [Labor and Social Security Law](https://augustdeboustg.wpenginepowered.com/en/expertise/labor-and-social-security-law/) - [Patents](https://augustdeboustg.wpenginepowered.com/en/expertise/patents/) - [Private Clients](https://augustdeboustg.wpenginepowered.com/en/expertise/private-clients/) - [Tax](https://augustdeboustg.wpenginepowered.com/en/expertise/tax/) - [Tech And Digital](https://augustdeboustg.wpenginepowered.com/en/expertise/tech-and-digital/) Regulatory- [Competition Law, European Regulation and FDI](https://augustdeboustg.wpenginepowered.com/en/expertise/competition-state-aid/) - [Compliance and Investigations](https://augustdeboustg.wpenginepowered.com/en/expertise/compliance-and-investigations/) - [Digital and Technology Regulation](https://augustdeboustg.wpenginepowered.com/en/expertise/digital-and-technology-regulation/) - [Digital Assets](https://augustdeboustg.wpenginepowered.com/en/expertise/digital-assets/) - [Environmental and Urban Planning Law](https://augustdeboustg.wpenginepowered.com/en/expertise/environmental-and-urban-planning-law/) - [ESG](https://augustdeboustg.wpenginepowered.com/en/expertise/esg/) - [European Law](https://augustdeboustg.wpenginepowered.com/en/expertise/european-law/) - [International Sanctions and Export Controls](https://augustdeboustg.wpenginepowered.com/en/expertise/international-sanctions-and-export-controls/) - [International Trade](https://augustdeboustg.wpenginepowered.com/en/expertise/international-trade/) - [Personal Data and Cybersecurity](https://augustdeboustg.wpenginepowered.com/en/expertise/personal-data-and-cybersecurity/) - [Product Compliance and Safety](https://augustdeboustg.wpenginepowered.com/en/expertise/product-compliance-and-safety/) - [Public Law](https://augustdeboustg.wpenginepowered.com/en/expertise/public-law/) - [Securities Law](https://augustdeboustg.wpenginepowered.com/en/expertise/securities-law/) Sectors (13) - [Aerospace and Defense](https://augustdeboustg.wpenginepowered.com/en/secteur/aerospace-and-defense/) - [Banking & Finance](https://augustdeboustg.wpenginepowered.com/en/secteur/banking-finance/) - [Data Centers](https://augustdeboustg.wpenginepowered.com/en/secteur/data-centers/) - [Energy](https://augustdeboustg.wpenginepowered.com/en/secteur/energy/) - [Health and Life Sciences](https://augustdeboustg.wpenginepowered.com/en/secteur/health-and-life-sciences/) - [Infrastructure Projects](https://augustdeboustg.wpenginepowered.com/en/secteur/infrastructure-projects/) - [Luxury And Retail](https://augustdeboustg.wpenginepowered.com/en/secteur/luxury-and-retail/) - [Manufacturing](https://augustdeboustg.wpenginepowered.com/en/secteur/manufacturing/) - [Media](https://augustdeboustg.wpenginepowered.com/en/secteur/media/) - [Real Estate & Construction](https://augustdeboustg.wpenginepowered.com/en/secteur/real-estate-construction/) - [Sport](https://augustdeboustg.wpenginepowered.com/en/secteur/sport/) - [Tech & Digital](https://augustdeboustg.wpenginepowered.com/en/secteur/tech-digital/) - [Telecommunications & Digital Infrastructure](https://augustdeboustg.wpenginepowered.com/en/secteur/telecommunications-digital-infrastructure/) Cet article résumé en une minute avec l’IA By three decisions issued by the Italian, French, and Dutch data protection authorities, Clearview AI has been sanctioned for numerous violations of the GDPR. Beyond the violations committed by the company, these decisions illustrate the broad extraterritorial scope of the GDPR, which applies to a company that (i) has no establishment in the European Union and (ii) does not offer goods or services in the Union. The authorities deemed that the GDPR applies to the company’s processing because its database contains photographs of European residents collected from publicly accessible sources, allowing for ‘behavioral monitoring’ within the European Union (Article 3.2 (b)). These conclusions could apply to any artificial intelligence system that collects massive amounts of personal data, regardless of the provider’s location or target market. **Summary of the facts** Clearview AI is a company that offers a search engine for images of individuals. Its technology relies on the regular large-scale extraction (“scraping”) of images of individuals from publicly accessible sources on the internet, including social media and search engines. Once these images are collected, Clearview generates a unique biometric template for each person, allowing its clients to match the image submitted to the search engine (“probe image”) with those in the system’s database. This enables users of the solution, primarily law enforcement agencies, to accurately identify individuals. Clearview AI also collects metadata from photographs, such as location and information added by the person. This additional information helps to create an even more detailed profile of the person. Clearview AI has thus created a database containing over 30 billion photographs, including those of people located in the European Union. **Systematic Photo Collection Enables ‘Behavioral Tracking’ Regardless of Processing Purpose.** By regularly collecting photographs of the same individual to feed and update its database, Clearview AI performs a “behavioral tracking” of individuals located in the European Union within the meaning of Article 3.2 (b) of the GDPR. Based on these photographs, it is indeed possible to infer physical changes of a specific person, personal information such as their marital status, or the activities they engage in. The decisions are particularly noteworthy in that the data protection authorities rejected Clearview AI’s argument that behavioral tracking was not the purpose of the processing. It follows that the mere collection of data enabling behavioral tracking makes the GDPR applicable to the processing in question, regardless of the actual purpose pursued by this processing. **Implications for Providers of Artificial Intelligence Systems** These decisions show that all providers of AI systems that operate through the large-scale and indiscriminate collection of data may be subject to the GDPR, even when the provider does not intend to target the European market. The conclusions are applicable to various AI systems such as: – Image search engines like Clearview AI, – Predictive AI trained on personal data, – Generative AI trained on public images/videos to mimic and imitate human behaviors. **Recommendations for AI System Developers** AI providers should therefore assess the applicability of the GDPR from the design stage by determining the data used for training and operating the system. To mitigate GDPR risks, it is advisable to implement filters to prevent the collection of personal data from individuals located in the European Union, as recommended by the Dutch authority. Additionally, it is recommended to include contractual clauses with deploying clients to ensure they do not use the solution to process data from individuals located in the European Union, unless this data remains within the deployer’s information system and is not reintegrated into the system’s database for training and improvement. Share - Linkedin - Copy Link Cet article résumé en une minute avec l’IA ### Authors 2 - [Florence Chafiol](https://augustdeboustg.wpenginepowered.com/en/collaborateur/florence-chafiol-2/) - [Robin Nini](https://augustdeboustg.wpenginepowered.com/en/collaborateur/robin-nini-2/) ### Practice Area 2 - [Personal Data and Cybersecurity](https://augustdeboustg.wpenginepowered.com/en/tax-expertise/personal-data-and-cybersecurity/) - [Tech, Digital and Data Litigation](https://augustdeboustg.wpenginepowered.com/en/tax-expertise/tech-digital-and-data-litigation/) ### Sector 1 - [Tech & Digital](https://augustdeboustg.wpenginepowered.com/en/tax-secteur/technologie-et-digital_en/) ## Discover more content that might interest you News [08/12/25 Legal Article 5 min Toward a Two-Tier Liability Regime for Online Platforms? Analysis of the CJEU’s Russmedia Decision In a judgment dated 2 December 2025, the Court of Justice of the European Union held a marketplace operator liable for the unlawful processing of sensitive data published in a user’s advertisement. The CJEU ruled that the operator is responsible for the processing of advertisements published on its platform and… Read more](https://augustdeboustg.wpenginepowered.com/en/legal-article/toward-a-two-tier-liability-regime-for-online-platforms-analysis-of-the-cjeus-russmedia-decision/)