US tech firm Clearview AI is challenging a UK privacy watchdog ruling that found it breached GDPR rules by collecting and using images of UK residents scraped from the internet and social media.

The Information Commissioner’s Office (ICO) imposed a £7.5m fine on the US-based tech company in May 2022 and asked it to delete UK residents’ data after finding it had used images of people in the UK that were collected from social media and the web to create a global online database to be used for facial recognition.

The ICO also ordered the AI company, which builds and sells a database of images used for facial recognition technology primarily for law enforcement and government agencies outside the UK, to stop scraping and using UK residents’ personal data.

Clearview appealed the fine and enforcement notice, bringing legal proceedings to the First-Tier Tribunal in 2023 and arguing the data watchdog lacked power to enforce against a company operating in a different jurisdiction; the court ruled in its favour.

However, in October 2025, the Upper Tribunal overturned the decision after the ICO appealed. The court ruled that the regulator had jurisdiction over the US tech firm and could enforce against it, establishing that Clearview AI obtaining and storing images of UK residents constituted ‘behavioural monitoring’ under the GDPR.

The tech firm was at the Court of Appeal on Tuesday and Wednesday as it sought to overturn the Upper Tribunal ruling and reinstate the First-Tier Tribunal ruling.

Decision may have ‘implications’ for AI firms

Nicola Cain, chief executive and principal consultant at legal consultancy firm Handley Gill, told the decision may have implications for AI companies which carry out similar activities.

“While Clearview AI’s appeal against the £7.5m penalty imposed by the ICO is on a technical point of law relating to whether, as a foreign entity, it is subject to the UK GDPR and required to protect the personal data of individuals in the UK, the principles involved have a wide application, with implications for AI developers, data brokers and database operators who scrape and aggregate personal information from the internet and share it for purposes including AI training.

“Should the ICO prevail in its argument that systematic scraping of online data constitutes behavioural monitoring, the Clearview AI fine may just be the first of many,” Cain added.

An ICO spokesperson said as the hearing “forms part of ongoing legal proceedings in relation to the £7.5m monetary penalty and enforcement notice we issued to Clearview AI Inc. in 2022” it “would not be appropriate for the Information Commission to comment further while the case is before the court.”

Clearview AI was contacted for comment.