Untargeted Scraping for Facial Recognition Databases
The fifth prohibited practice covers untargeted scraping of images to build facial recognition databases without the knowledge or consent of the people in those images. This is sometimes called mass collection of biometric data, and it enables large-scale facial surveillance.
Facial recognition AI systems require large training datasets to function. To build a system that can reliably identify anyone’s face, you need a database containing millions of images, each linked to the person’s identity. Historically, some commercial companies and academic researchers gathered these datasets by automatically scraping images from the public internet, social media platforms, or video surveillance systems without permission from the people whose faces appear in the images. Some image collections number in the tens of millions of faces.
From those collected images, AI systems extract facial templates or embeddings, which are mathematical representations of a person’s distinctive facial features. Once the system is trained on these templates, it can be used to identify or authenticate individuals in photos, video or live camera feeds.
The EU considers untargeted scraping for facial recognition databases to be prohibited because it violates consent and human dignity at a fundamental level. The people whose images are collected do not know their faces are being captured, have not agreed to it, and typically have no way to object or request removal. The stated or actual purpose is mass surveillance: building capacity to identify people at scale without their knowledge. Once the database exists, it becomes a powerful tool for tracking and identifying people across entire populations.
The prohibition specifically covers untargeted scraping. This means collecting images without a specific investigative purpose or legal authority behind the collection. Law enforcement and security authorities can conduct targeted collection of biometric data as part of a specific criminal investigation, with legal authority and judicial oversight. But untargeted mass collection to create databases available for general future use is prohibited. The difference is critical: targeted collection for a specific case is investigative; untargeted collection is surveillance infrastructure.
The prohibition also applies to any subsequent use of a database that was built through untargeted scraping. Even if an organisation did not conduct the scraping itself but later acquires access to a database built that way, using that database is prohibited under Article 5. This rule is meant to remove the market for illegally created datasets and discourage the practice throughout the supply chain. If companies know they cannot legally use datasets built through untargeted scraping, they have no incentive to acquire them.
Organisations need to have clear procedures for facial recognition deployment. Before you deploy any facial recognition system, you must verify that the training data was not collected through untargeted scraping. You must have documented consent or explicit legal authority for all biometric data in your training set. This is not just a legal requirement; it is a basic operational requirement that you may need to prove to regulators. If you cannot prove the data collection was lawful, you cannot use the system.
Examples of prohibited untargeted facial recognition database collection include: a company that harvested millions of faces from social media platforms without knowledge or permission of the people in the images; a research institution that scraped facial images from public photo sharing websites and released a dataset widely; a tech startup that collected photos from video surveillance of public spaces and built a searchable facial database available via API; a security company that scraped dating profiles and celebrity images to build facial databases. In contrast, using facial images from existing databases that were collected with explicit consent (like government photo ID databases, or employee photos where people agreed to photo collection as a condition of employment), or using images from a limited specific investigation with legal authority and judicial oversight, would not violate this prohibition.
The narrow exception is for law enforcement, border control and other competent authorities conducting targeted operations with legal authority and appropriate oversight. For example, police may use face images collected as part of investigating a specific crime with a warrant, or border control may use photos from travel documents submitted voluntarily by travellers, but they cannot conduct untargeted mass scraping to build general facial databases for future investigations.
Your compliance team should work with your data governance team to trace the origin of any facial recognition training data you use. If you cannot prove lawful collection, do not use the system.