Clearview AI asks the Court of Appeal to scrap its £7.5m UK privacy fine

What is happening in court this week

Clearview AI, the US company that built a face search engine from photos collected on the public internet, is asking the Court of Appeal of England and Wales to rule that Britain's privacy regulator never had the power to fine it. The court's hearing list shows the case, Clearview AI Inc v The Information Commissioner, listed for Monday 19 to Wednesday 21 October 2026, with the charity Privacy International intervening on the regulator's side.

The court has published the written arguments, known as skeleton arguments, from all three parties. In its own skeleton argument, Clearview asks the judges to set aside a 2025 Upper Tribunal decision and restore an earlier ruling that the notices it received in 2022 were outside the regulator's jurisdiction. Those notices sought to fine the company more than £7.5 million and to order it to stop processing the data of people in the UK.

The case does not decide whether Clearview broke data protection law. It decides a narrower question that has taken more than four years to settle: whether UK data protection law reaches a foreign company with no UK office whose only customers are foreign police and security agencies. The answer will matter to any AI company outside Britain that builds products from personal data scraped from the web.

How a 2022 fine is still unresolved

According to Clearview's skeleton, its service worked like a search engine for faces. A client uploaded a photo of a person of interest, Clearview turned the face into a set of numbers called vectors, and the system returned matching images from its database together with the web pages where they appeared. The company says that during the period in question all of its clients were foreign governments or their contractors, in countries including the United States, Panama, Brazil, Mexico and the Dominican Republic, and that 81 percent were police forces, FBI departments or military bodies.

The Information Commissioner served a monetary penalty notice and an enforcement notice on 18 May 2022, alleging that Clearview had breached the rights of millions of UK residents. Clearview says it cannot tell an image of a UK resident from anyone else's, so complying with the enforcement order would mean shutting the service down entirely. It also notes that a small UK trial between June 2019 and March 2020 involved only 721 searches and was not relied on as the basis for jurisdiction.

In 2023 the First-tier Tribunal sided with Clearview. It found that because the clients used the service only for foreign law enforcement and national security, the processing fell outside the scope of EU law and therefore outside the GDPR. On 6 October 2025 the Upper Tribunal reversed that, holding that the regulator did have jurisdiction under Article 3(2)(b), the rule that brings non-European firms within the law when their processing is related to monitoring people's behaviour in the UK.

The regulator's response to Privacy International, dated 23 September 2026, is blunt about the delay. It calls it “highly regrettable that, over four years later, the resulting appeals are still dealing with a preliminary issue as to jurisdiction.” The document also notes that from 30 September 2026 the Commissioner's functions passed to a new body, the Information Commission, which takes over the case.

Clearview's three arguments

Clearview's skeleton, dated 14 January 2026 and signed by Anya Proops KC and two other barristers from the 11KBW chambers, sets out three grounds of appeal.

The first attacks what it calls the Database Finding: the Upper Tribunal's view that building and indexing the face database was itself a form of behavioural monitoring. Clearview argues that this reading is far too broad. Its technology, it says, cannot recognise or detect behaviour, still less analyse it. It sorts face vectors so that searches run faster, and the way they are stored has nothing to do with what the person in the photo was doing. The company leans on a strong presumption in UK, EU and international law against laws reaching beyond a country's borders.

The second ground targets the Client-Centred Finding, the idea that Clearview's processing was related to monitoring carried out by its customers. Clearview argues that Article 3(2)(b) only covers a firm that does the monitoring itself, not one whose processing is linked to monitoring by someone else. It adds that there was never evidence that any client actually monitored anyone's behaviour in the UK, and that even then only the data of those specific people could be caught, not everyone in the country.

The third ground says that any monitoring by its clients, all foreign states or their contractors, falls outside the scope of EU law in the first place. Monitoring the law does not cover, Clearview argues, cannot be the hook that brings its own processing into the law.

What the regulator and Privacy International say

Privacy International's skeleton argument focuses on that third ground. It says Clearview has dropped an argument it ran in the tribunal below and is trying to bring a version of it back. Both Article 2 and Article 3(2)(b), the charity argues, are about when processing falls within the law, not about whether the monitoring itself is regulated, and it does not matter where or by whom the monitoring is done.

The charity also argues that the exception for activities outside the scope of EU law is narrow and is about dividing powers between the EU and its member states, not about services sold to other countries. Foreign states are protected by separate principles of international law such as state immunity, it says, and Clearview, a private company, cannot borrow that protection. Those principles, it argues, “draw clear boundaries between private entities and the state, whereas Clearview's approach seeks to blur those boundaries.”

The regulator's short response adopts Privacy International's arguments on the third ground. It disputes one point: it says the argument is not new, because the Upper Tribunal already considered and rejected it at paragraphs 331 to 344 of its decision. The Commissioner's own main skeleton, dated 17 March 2026, was not among the documents published this week.

Privacy International also reminds the court why it is involved. It filed a complaint about Clearview with the Commissioner on 27 May 2021, after subject access requests showed that the images and names of some of its own staff were in Clearview's database.

The European picture

Privacy International points out that five European data protection authorities have acted against Clearview under the EU GDPR: France's CNIL, the Dutch Autoriteit Persoonsgegevens, Austria's Datenschutzbehörde, Italy's Garante and Greece's Hellenic Data Protection Authority. All relied on the same monitoring rule to bring Clearview within the law, and none found it exempt because of the nature of its clients. The charity says that, as far as it is aware, Clearview has not complied with or appealed any of those decisions.

It also cites a 27 June 2024 judgment of Spain's Audiencia Nacional, which overturned the Spanish regulator's refusal to act and found that the monitoring rule did apply to Clearview. Clearview accepts that the EU and UK texts are identical on the questions before the court, so the charity argues that a ruling for Clearview would open a gap between British and European law.

The Upper Tribunal declined to consider some of those foreign decisions because they were not before the first tribunal. Privacy International says it is not offering them as evidence of facts but as legal background the Court of Appeal should know about.

Why the ruling matters beyond face search

The dispute is about face search, but the legal question is broader. Many AI systems are built by collecting public web data about people, and the regulator has been pressing AI developers on exactly that, as in its recent report on data-protection changes at ten AI labs that train foundation models. If building a searchable index of people's public images can count as monitoring their behaviour, foreign firms that compile such data may find UK law applies to them even with no UK presence.

If Clearview's narrower reading wins, a company outside the UK that only sells to foreign governments could be largely beyond the regulator's reach, however much UK data it holds. Courts elsewhere are also being asked how far responsibility for AI systems extends, from a German court ordering Google's AI Mode to stop misattributing a crime to hidden chatbot instructions that steered users away from privacy regulators, as in the WhatsApp help-page case.

There is also a practical point. The jurisdiction question was taken as a preliminary issue, so Clearview's separate challenges to the substance of the notices have not been decided. Even a win for the regulator would not end the case, and a fine first issued in 2022 would still face further litigation before any money changes hands.

What to watch

The hearing was due to end on Wednesday 21 October, and no judgment date has been announced. PPC Land, which reported on the opening day, framed the case as a test of how far UK law can reach firms based outside the UK that handle data about people in Britain.

Three things will shape the outcome: whether the judges accept that indexing a face database is behavioural monitoring, whether processing linked to someone else's monitoring is enough, and whether the foreign-state nature of Clearview's clients takes the whole activity outside the law. A ruling on any one of them will be read closely by privacy regulators and AI companies that rely on scraped personal data.

AI Lookout has not seen the regulator's main skeleton or the Upper Tribunal judgment in full, and the account above is drawn from the three documents the court published this week.