TL;DR

The EU AI Act prohibits untargeted scraping of facial images for building recognition databases. The prohibition, analyzed in depth by the Future of Privacy Forum, targets the supply chain of facial recognition systems and presents significant compliance challenges for biometric database operators.

Key Facts

• Who: European Union, via AI Act Article 5 prohibition
• What: Ban on untargeted scraping of facial images for facial recognition databases
• When: Prohibition takes effect as part of EU AI Act implementation
• Impact: Affects companies building or operating facial recognition services in the EU market

What Happened

The European Union’s AI Act has enacted a prohibition on untargeted scraping of facial images for the purpose of building facial recognition databases. This measure, codified in Article 5 of the AI Act, represents one of the most significant restrictions on biometric data collection in Western regulatory frameworks.

The Future of Privacy Forum (FPF) released a detailed analysis examining the scope, enforcement mechanisms, and technical implementation challenges of this prohibition. According to FPF, the ban specifically targets the creation of facial recognition databases through mass collection of facial images from public sources without targeted justification.

This prohibition differs from earlier biometric privacy regulations by focusing on the data collection phase rather than just the deployment or use of facial recognition technology. Companies operating facial recognition services must now demonstrate that their training data was acquired through targeted, consented, or otherwise legally compliant means.

Key Details

The FPF analysis highlights several critical aspects of the prohibition:

• Scope of Coverage: The ban applies to untargeted scraping, meaning indiscriminate collection of facial images from the internet, social media, or public spaces without specific identification purposes
• Database Creation: The prohibition specifically targets the creation and expansion of facial recognition databases, not the use of existing legally acquired datasets
• Enforcement Mechanism: National competent authorities in each EU member state will oversee enforcement, with significant penalties for non-compliance
• Technical Verification Challenge: Database operators must now establish and document provenance of facial images, creating substantial compliance overhead
• Business Model Impact: Companies that built their services on mass-scraped data face fundamental questions about the legality of their existing databases

The regulation creates a distinction between targeted and untargeted collection. Law enforcement agencies with judicial authorization, for instance, may still collect facial images for specific investigations, but mass database building without specific purpose is prohibited.

🔺 Scout Intel: What Others Missed

Confidence: high | Novelty Score: 76/100

While most coverage frames this as a privacy win, the strategic significance lies in the EU’s targeting of the facial recognition supply chain rather than just deployment. The prohibition attacks the business model at its source: companies like Clearview AI, Pimloc, and similar services built their competitive advantage on the assumption that publicly posted images were fair game for scraping. The AI Act fundamentally rejects this premise, forcing a shift toward consent-based or narrowly targeted data acquisition. The enforcement challenge, however, remains unresolved: verifying that a database contains no untargeted-scraped images requires audit mechanisms that do not yet exist at scale.

Key Implication: Facial recognition vendors operating in Europe must now invest in data provenance systems and consent management infrastructure, potentially creating a market for verified facial image datasets and third-party audit services.

What This Means

For Facial Recognition Service Providers

Companies offering facial recognition services in the EU market must conduct comprehensive audits of their training data sources. Those relying on web-scraped data face a strategic choice: exit the EU market, rebuild databases through consented sources, or develop new acquisition models. The cost of compliance will disproportionately affect smaller players without established data partnerships.

For Privacy Advocates and Regulators

The prohibition establishes a precedent for supply-side regulation of AI systems. Rather than restricting use cases after deployment, the EU has moved upstream to restrict data collection practices. This approach may influence other jurisdictions considering biometric privacy frameworks, including ongoing discussions in the UK, Canada, and several US states.

What to Watch

• Enforcement actions by national competent authorities in the first year of implementation
• Emergence of third-party certification services for facial recognition database provenance
• Legal challenges from affected companies arguing proportionality of the restriction
• Market consolidation as compliance costs push smaller operators toward acquisition or exit

Related Coverage:

• EU AI Act Prohibits Emotion Recognition in Workplaces and Schools - Another Article 5 prohibition targeting biometric AI applications

Sources

• FPF: EU AI Act Ban on Untargeted Facial Scraping — Future of Privacy Forum, 2026