Ottawa.A company you had likely never heard of had, by early 2021, almost certainly collected your face. Clearview AI scraped roughly three billion images from the public internet, social media photos, profile pictures, anything reachable by a crawler, and turned them into a searchable database of biometric faceprints. It then sold a tool to police forces that let an officer upload a photo of a person and find matches across that database. On February 3, 2021, four Canadian privacy authorities, the federal Privacy Commissioner together with the commissioners of British Columbia, Alberta, and Quebec, released a joint finding on what that was.

Their conclusion was not hedged. They found that Clearview's collection and use of Canadians' images violated Canadian privacy law, that the company had no consent for any of it, and that what it had built amounted to mass surveillance. The commissioners were blunt that scraping the open web does not make a face fair game, and that a photo being publicly visible is not the same as a person agreeing to be enrolled in a permanent police line-up.

The police were using it

This was not theoretical. On June 10, 2021, the federal Privacy Commissioner released a second finding, this one about the Royal Canadian Mounted Police. The RCMP had used Clearview to run hundreds of searches against that illegally built database, and the Commissioner found this use violated the Privacy Act. The force had initially understated its own use of the tool. Clearview, for its part, had already stopped offering trial accounts in Canada and cut off its last Canadian client, the RCMP, in July 2020, as scrutiny mounted.

A regulator can declare a practice illegal and still discover it has almost no power to make the company stop.

The limit the case exposed

Here is the part that should worry anyone who assumes a finding settles a matter. The federal Privacy Commissioner, under the law that governs private companies, has no power to order anything. It can investigate, it can find a violation, it can publish, and then, if it wants an enforceable order, it has to go to Federal Court and ask. In the Clearview case the federal commissioner did not take that step. The teeth in this story belonged to the provinces. Quebec, Alberta, and British Columbia have commissioners who can issue binding orders, and in December 2021 they ordered Clearview to stop collecting images of people in their provinces and to delete the faceprints it had already made.

Clearview did not simply comply. It argued that Canadian privacy law did not reach it at all, because it had no real and substantial connection to the country, and that it needed no consent because the images were public. It took those arguments to court. The provincial regulators largely held. The British Columbia courts upheld the order against the company, and the Alberta courts confirmed that a provincial privacy law can reach a foreign company that collects the personal information of people inside the province. The principle survived. But the case had already shown how much work it takes to convert finding into force, and how a company can keep operating elsewhere while the Canadian fight grinds on.

The verdict

The Clearview file is, on paper, a win for privacy. Four regulators agreed, the courts backed the orders that had teeth, and the principle that a faceprint is biometric data requiring consent was affirmed. But read it for what it teaches and the lesson is colder. The single most consequential finding, the federal one covering the whole country, came from a body that cannot order anything on its own. The enforcement that mattered came from provinces that happen to have stronger laws. And the technology itself, the scraping of public faces into private police tools, did not become impossible. It became, in Canada, contested and partly blocked. For a country that wants to claim it does not run mass facial surveillance, that is a thinner protection than the headline finding suggests.

Related reading: the first time Canada invoked the Emergencies Act, our explainer on what police can and cannot do at your car, and the bail law a single killing rewrote.

A retrospective published in 2026. Drawn from the public record: the joint finding of February 3, 2021, by the Privacy Commissioner of Canada and the information and privacy commissioners of British Columbia, Alberta, and Quebec that Clearview AI's collection of roughly three billion images constituted mass surveillance and violated Canadian privacy law; the federal finding of June 10, 2021, that the RCMP's use of the tool violated the Privacy Act; the December 2021 orders by the Quebec, Alberta, and British Columbia commissioners to cease collection and delete data; the absence of order-making power for the federal commissioner under PIPEDA; and the subsequent court decisions in British Columbia and Alberta upholding provincial jurisdiction over the company. Commentary on the public record, not legal advice.