Executive Summary: Key Legal and Evidentiary Issues

• Clearview AI Inc., a US-based facial recognition company, scraped billions of facial images from public websites without individuals' consent, prompting a joint investigation by four Canadian privacy commissioners.

• Constitutional applicability of British Columbia's Personal Information Protection Act (PIPA) to an out-of-province entity operating online was challenged under the "real and substantial connection" test.

• The "publicly available" exemption under s. 6(1)(d) of the PIPA Regulations was found not to encompass social media websites, as the regulation narrowly prescribes sources like magazines, books, and newspapers.

• Clearview's collection of facial data lacked a "reasonable purpose" under PIPA given the extreme sensitivity of biometric data, the indiscriminate mass scale of collection, and the disconnect from individuals' original posting purposes.

• Enforceability of the Commissioner's "best efforts" remedial order was upheld despite Clearview's arguments that its terms were vague, unnecessary, and overbroad.

• Withdrawal from the Canadian market during an active investigation did not strip the Commissioner of jurisdiction to issue prospective compliance orders.

The facts behind Clearview AI's facial recognition dispute

Clearview AI Inc. is a private US-based technology company that sells facial recognition software. Its search engine, or "image crawler," detects and scrapes human faces and associated metadata from publicly accessible websites such as YouTube, Instagram, and Facebook. Clearview's software analyzes each face using detailed measurements to produce a numerical biometric identifier known as a "vector." All facial images, associated metadata, and vectors are stored indefinitely on Clearview's servers. By 2017, its database contained facial data for some three billion individuals, a figure that grew to 30 billion facial images by 2023, as noted by the Australian Upper Tribunal. The company primarily markets its services to law enforcement and other government agencies, and conducts all of its collection activities without the knowledge or consent of the individuals whose facial data it acquires. Importantly, the technology is completely indifferent to location: the scraping occurs without regard to where the individual is in the world at the time their image was posted or scraped.

The joint investigation and Commissioner's findings

In early 2020, after media reports that Clearview was marketing its facial recognition services to Canadian clients, the information and privacy commissioners of British Columbia, Alberta, Québec, and Canada commenced a joint investigation. During the investigation, Clearview decided to withdraw from the Canadian market. The joint investigation report, issued in February 2021, concluded that Clearview had violated protection of privacy laws in all four jurisdictions. It recommended that Clearview stop offering its facial recognition services to clients in Canada, stop collecting, using, or disclosing facial data of individuals in Canada, and delete all such stored facial data. In response, Clearview confirmed it was no longer providing facial recognition services to clients in Canada but said the other recommendations were unjustified and, in any case, it was impossible to comply with them.

The Commissioner's order and judicial review

In December 2021, the BC Information and Privacy Commissioner issued a decision finding Clearview had contravened ss. 6–8, 11, 14, and 17 of PIPA. The Commissioner ordered: (a) Clearview is prohibited from offering its facial recognition services utilizing the collection, use, and disclosure of images and biometric facial arrays collected from individuals in British Columbia without their consent, to clients in British Columbia; (b) Clearview shall make best efforts to cease the collection, use, and disclosure of images and biometric facial arrays collected from individuals in British Columbia without their consent; and (c) Clearview shall make best efforts to delete the images and biometric facial arrays in its possession collected from individuals in British Columbia without their consent. The Commissioner had also inquired about litigation against Clearview in Illinois in which Clearview had agreed to take steps to stop acquiring facial data from Illinois residents and to block client searches from examining the facial data of Illinois residents in its database. Clearview informed the Commissioner it could not take steps similar to those Illinois Measures in respect of persons in BC but did not say why. Clearview applied for judicial review of the Decision, which was dismissed by the BC Supreme Court in December 2024.

The constitutional applicability of PIPA

On appeal, Clearview argued that PIPA could not apply to it as a matter of constitutional law. The Court of Appeal applied the "real and substantial connection" test established by the Supreme Court of Canada in Unifund Assurance Co. v. Insurance Corp. of British Columbia, 2003 SCC 40, and recently affirmed in Sharp v. Autorité des marchés financiers, 2023 SCC 29. For the period before July 2020, Clearview was marketing its services to BC-based entities, whether on a paying or trial basis, which constituted "doing business" in BC — a sufficient connection that Clearview did not dispute. For the period after July 2020, the Court found that Clearview's ongoing global scraping of facial data — including from individuals in BC — established a substantial, not merely incidental, connection with the province. The Court noted that Clearview's success as a business depends on its ability to acquire facial data on a global scale to build its databank, and that Clearview itself has said it is unable to geographically restrict its search engine. The Court concluded that Clearview's access to BC and every other jurisdiction is essential to its operation. The Court also emphasized that the subject matter of PIPA — protection of the right to personal privacy — is a quasi-constitutional right, making the public interest in enforcement highly relevant to the sufficient connection analysis. The Court further rejected Clearview's arguments on order and fairness, noting that the Supreme Court of Canada in Sharp described the possibility of multiple jurisdictions exercising authority over the same scheme as "a feature, not a flaw" of modern regulation.

The "publicly available" exemption and reasonable purpose

Clearview argued it did not need individual consent because the facial data was scraped from publicly available sources such as blogs, social media, and other public websites. The Court upheld the Commissioner's finding that these sources are not included in the definition of "publicly available" sources prescribed in the PIPA Regulations. Section 6(1)(d) of the PIPA Regulations permits collection, use, and disclosure of personal information appearing in "a printed or electronic publication that is available to the public, including a magazine, book or newspaper in printed or electronic form." The Court reasoned that while magazines, books, and newspapers may be in electronic form, their content is created primarily by their authors, not by individual readers — unlike social media websites where users are the primary creators of content. The Joint Report also found that because privacy protection is quasi-constitutional, restrictions on privacy rights such as s. 6(1)(d) should be interpreted narrowly. On the question of reasonable purpose, the Commissioner found — and the Court agreed — that Clearview's collection was unreasonable. The Joint Report identified the information as extremely sensitive for three reasons: facial biometric information is key to an individual's identity and unlikely to vary over time, the information includes the facial data of children, and the volume of information collected is enormous and indiscriminate. It also found that Clearview's purposes for collection, use, and disclosure were unrelated to the purposes for which individuals originally posted their images; Clearview collected indirectly from third parties who were themselves unaware of its activities; Clearview's use and disclosure is detrimental to the individual; and it creates a risk of significant harm including misidentification and exposure to potential data breaches.

The ruling and overall outcome

The British Columbia Court of Appeal unanimously dismissed Clearview's appeal on February 18, 2026. Justice Iyer, writing for the Court with the concurrence of Madam Justice Horsman and Justice Riley, found that PIPA is constitutionally applicable to Clearview, the Commissioner's interpretation and application of PIPA were reasonable, and the remedial Order — including its "best efforts" language — was enforceable and a reasonable exercise of remedial discretion. The Court noted that orders requiring entities to use "best efforts" are routinely made to rectify noncompliance with privacy legislation, and the Commissioner's record included Clearview's failure to explain why it could not take steps similar to the Illinois Measures. The Commissioner's Order stands in favour of the Information and Privacy Commissioner for British Columbia. No specific monetary amount was awarded or ordered, as the case concerned regulatory compliance orders rather than damages.