Scraping The Surface: The Clearview AI Cases and Testing the Limits of Technological Neutrality

In an era where a selfie doubles as a biometric identifier, privacy law’s goals of technological neutrality are being challenged in its applicability to modern data collection practices. Precedent setting litigation across Canada surrounding Clearview AI’s data scraping practices have revealed the issues in governing rapidly evolving technologies that vastly change the data collection landscape under existing legal frameworks.

BACKGROUND

Clearview AI’s (Clearview’s) data scraping technology collects facial image data from publicly accessible online sources, such as social media, and assigns biometric identifiers to individuals. The technology allows users of its platform, including law enforcement, to upload an image and identify individuals through a matching process with Clearview’s database. Clearview’s database contained over three billion images of faces, including a vast number of Canadians. These practices have prompted investigation from multiple Privacy Commissioners in Canada leading to litigation in several provinces and federally.[1]

In 2020, the Privacy Commissioners of Canada, Quebec, British Columbia, and Alberta (the Commissioners) commenced a joint investigation into Clearview’s data handling practices.[2] This investigation determined that Clearview (i) did not obtain the requisite consent prior to the collection of personal information and (ii) did not collect, use, and disclose this personal information for a reasonable or appropriate purpose.[3]

Clearview disagreed with the findings and asserted that the information collected was publicly available and thus exempt from consent requirements. Clearview initiated judicial reviews of the Commissioners’ investigation in Alberta, Quebec, and British Columbia. Decisions on the merits of the judicial reviews are available from the Court of King’s Bench of Alberta (ABKB), Supreme Court of British Columbia (BCSC), and Court of Appeal for British Columbia (BCCA). The Court of Quebec partially granted Clearview’s application for a confidentiality and sealing order in March 2025, but no decision on the judicial review is available at the time of writing.[4]

The Legislative Regime

The Personal Information Protection and Electronic Documents Act (PIPEDA), substantially similar provincial legislation, such as Alberta’s Personal Information Protection Act (PIPA AB) and British Columbia’s Personal Information Protection Act (PIPA BC), and their respective regulations, contain (i) exceptions to consent for publicly available information and (ii) requirements that personal information must only be collected, used, or disclosed for purposes which a reasonable person would find appropriate.[5]

LEGAL ANALYSIS

The courts in Alberta and British Columbia each considered whether the province’s PIPA statute applies to Clearview, a U.S.-based company. Courts in both provinces found that Clearview obtained the personal information of Canadians and offered services to clients in Canada, creating a real and substantial connection to each province under which PIPA would apply.[6]

The decisions from the Albertan and British Columbian courts also shed light on four significant issues in relation to data scraping technologies:

i. Publicly Accessible vs. Publicly Available Information

ii. Consent Requirements and Freedom of Expression 

iii. Scope of the Reasonable Purpose Requirement 

iv. Technology Neutrality and the Limits of Canadian Privacy Laws

Publicly Accessible vs. Publicly Available Information

Under the Albertan and British Columbian private sector privacy laws, organizations may collect personal information without consent if it is publicly available from “Publications”, such as newspapers, books, or magazines, or other public information such as directories or registries.[7] The Commissioners found that information on social media does not fall into this category of publicly available information, despite being publicly accessible by Clearview. The Commissioners noted that privacy legislation is quasi-constitutional in nature and accordingly gave a broad, purposive, and liberal interpretation to the rights provided under the statutes.[8] In its applications for judicial review, Clearview argued that this was an unreasonable interpretation of the publicly available exception.

In the BCSC’s decision, the court found that the BC Commissioner had taken a reasonable and contextual approach to understanding whether social media is publicly available and distinguished social media from the types of publicly available sources listed in PIPEDA and PIPA BC Regulations. The BCSC found that social media pages (i) contain dynamic content which can be published or unpublished at any time and (ii) allow individuals to exercise a level of direct control over their accounts.[9] As a result, social media sites warrant different treatment from other online information sources. The BCCA agreed with this finding that social media sites are unlike newspapers, books, and magazines, and held that the BC Commissioner reasonably determined that only a narrow set of sources may constitute publicly available information.[10]

The ABKB came to a similar conclusion and found that the AB Commissioner’s interpretation of the publicly available exception was reasonable and justified. The ABKB held that it was reasonable for the Commissioner to conclude that social media differed substantially from the listed examples of Publications in the PIPEDA and PIPA AB Regulations such that it could not be interpreted as being “of the same kind”.[11]

Consent Requirements and Freedom of Expression

Clearview argued that if the Commissioners’ interpretation of the publicly available exception was reasonable, then the provisions of PIPA and the PIPA Regulations are unconstitutional as they limit Clearview’s provision of services to customers, an expressive activity, by requiring consent from individuals prior to scraping their information from social media. Clearview chose not to pursue this constitutional argument in its BCSC application but was successful in making this argument to the ABKB.

The ABKB found that scraping the internet with a bot to gather personal information is not expressive on its own but may be considered expressive activity when it is part of a process that leads to the conveyance of meaning, which Clearview’s facial recognition services provide to its customers (the “Services”). Thus, scraping combined with the Services was found to be expressive activity which was unjustifiably limited by PIPA and the PIPA Regulations.[12]

The ABKB also found that this infringement was not justified because confining the definition of “Publication” to newspapers, books, magazines, and like media results in the publicly available exception applying overbroadly with no pressing and substantial justification for doing so.[13] As the publicly available exception is source-based and not purpose-based, it also limits the operation of regular search engines like Google that collect, use, and disclose personal information from social media sites without consent for the purpose of indexing webpages.

The ABKB struck the language “magazines, books and newspapers” from the definition of “Publication” in s.7(e) of the PIPA Regulations so that “Publication” can take its ordinary meaning of content that has been intentionally made public.[14]

Scope of the Reasonable Purpose Requirement

Under PIPEDA, PIPA AB, and PIPA BC, personal information may only be used for purposes that a reasonable person would consider appropriate.[15] In their joint investigation, the Commissioners characterized the purpose of Clearview’s collection of images and creation of biometric identifiers as providing services to law enforcement, which represented the mass identification and surveillance of individuals by a private entity in the course of commercial activity. The Commissioners found that this was not an appropriate or legitimate purpose for collecting, using, or disclosing personal information.[16]

Clearview challenged this characterization of its purpose and argued that the Commissioners failed provide any basis for finding that Clearview’s purpose was not reasonable. However, the BCSC, ABKB, and BCCA each agreed that the Commissioners’ interpretation of the reasonable purpose requirement was justified and that the characterization of Clearview’s purpose was amply supported by the factual record.[17]

The ABKB noted that the original purpose for which personal information is made publicly available is one factor that goes into determining whether the use of personal information has a reasonable purpose. Widespread social practice, such as the use of driver’s licences for identification purposes, can influence whether a use of personal information would be considered appropriate by the reasonable person.[18] Importantly, social practices can change over time, which could impact how publicly accessible personal information on social media is treated, making it commonplace for such information to be used without consent in the future.

Technology Neutrality and the Limits of Canadian Privacy Laws

Privacy laws in Canada are designed to be technologically neutral so that they may apply regardless of how personal information is collected, used, or disclosed. However, modern technologies like artificial intelligence, automated data scraping, and biometric analysis can make it challenging to apply seemingly neutral statutes to the modern technology landscape.

The source-based nature of the publicly available exception in PIPEDA and the PIPA Regulations is an example of the challenge Courts may have in applying dated privacy laws to modern technology. By tethering this exception to where information is found rather than why it was published, the framework does not address the vastly different implications of modern data practices. Data collection, use, and disclosure have become so ubiquitous that legislation should use a purpose-based approach, otherwise risking ordinary and socially necessary practices like search engine indexing being swept into overbroad limitations.

This challenge was exemplified in the ABKB’s striking of the language “magazine, book or newspaper” from s.7(e) of the PIPA AB Regulations. By focusing the definition of “Publication” on content that has been intentionally made public, rather than focusing on form or source, the definition becomes flexible enough to apply to unknown future sources of content without having to determine whether that source is a sufficiently similar medium to newspapers, books, and magazines.

CONCLUSION

This series of Clearview AI litigations highlight the challenges of the current state of the law and its application to modern digital data practices. Courts are drawing a critical distinction between personal information that is publicly accessible and publicly available in a legal sense, which has implications for how future forms of content publication will be characterized. Companies using personal information from publicly accessible online sources should take note of the intended purposes for which the information is made accessible.

Any article or other information or content expressed or made available in this Section is that of the respective author(s) and not of the OBA.