facial recognition lawsuits: what the enforced record shows (2026)
2026-08-29
The headlines say facial recognition is being banned. The enforced record says something narrower: six actions across four jurisdictions, and every one turned on how the tool was deployed, not on the technology itself. Here is what each actually ordered.
Built on verified case files. The argument below leans on evidence The Internet Ninja validated against the public record and published in full, method included.
- €30.5 million for an illegal AI face database: the Dutch DPA's final, unappealable GDPR fine on Clearview AI
- Federal court bans Rite Aid from AI facial-recognition surveillance for five years after FTC alleges thousands of false-positive matches
- Spain's AEPD fines Mercadona €2,520,000 over its store-entrance facial-recognition system
- ICO orders Serco Leisure to halt unlawful facial-recognition and fingerprint attendance monitoring of 2,000+ staff (2024)
- Spain's AEPD orders Worldcoin (Tools for Humanity) to halt biometric iris-scanning data processing (2024)
- FTC × IntelliVision: a 'zero bias, millions of faces' AI claim, measured against NIST
Search “facial recognition lawsuit” and the framing is a wall closing in: the technology is under fire, bans are spreading, deployment is a liability. The enforced record is narrower and more useful than that.
Six actions have actually resolved with a regulator or a court ordering a company to stop, pay, or delete. They span four jurisdictions and three regulators plus one federal court. Read together, none of them bans facial recognition. Every one punishes a specific failure in how the tool was run.
That distinction is the whole point of this page. The scare copy counts the technology as the risk. The record counts the process as the risk, and the process is auditable before a regulator does it for you.
What a facial recognition lawsuit actually targets
A facial recognition lawsuit or enforcement action is a legal claim that a company collected or matched people’s biometric face data unlawfully: without a lawful basis or consent, without testing the system’s accuracy, or while making claims about it that it could not substantiate. On the enforced record, the defendant is the deployer, and the finding is a process failure, not the existence of the technology.
What are the documented facial recognition enforcement actions?
Six, verified against the primary regulator or court record.
Clearview AI, Netherlands, 2024. The Dutch DPA imposed a 30.5 million euro fine on Clearview AI for building an illegal database of more than 30 billion scraped facial images, and attached four cease orders. Clearview did not object in time and cannot appeal. TIN’s case file on the Clearview fine has the decision detail.
Mercadona, Spain, 2021. Spain’s AEPD fined the grocery chain 2,520,000 euros for an unlawful facial-recognition system and prohibited all such processing in its stores. TIN’s case file on the Mercadona sanction traces the fine to the AEPD resolution.
Rite Aid, United States, 2024. A federal court entered a stipulated FTC order banning Rite Aid for five years from facial recognition in its stores, with no fine, after the FTC alleged the retailer ran the tool from 2012 to 2020 without ever testing its accuracy. TIN’s case file on the Rite Aid ban has the order.
Serco Leisure, United Kingdom, 2024. The ICO ordered Serco Leisure to stop using facial recognition to check the attendance of more than 2,000 employees at 38 sites, and to destroy the biometric data it was not legally required to keep. TIN’s case file on the Serco notice documents the enforcement notice.
Worldcoin (Tools for Humanity), Spain, 2024. The AEPD ordered Worldcoin’s iris-scanning operation to halt data processing in Spain, and Spain’s National Court refused to suspend the order, holding that data protection outweighed the company’s commercial interest. TIN’s case file on the Worldcoin halt carries both the regulator’s order and the court’s ruling.
IntelliVision, United States, 2025. The FTC finalized a 20-year order barring the facial-recognition vendor from claiming its software had zero racial or gender bias, after alleging it trained on about 100,000 people, not the millions it claimed. TIN’s case file on the IntelliVision order has the complaint and the final order.
The proof: what TIN verified
TIN checked each of these against the primary record, not the press framing, and the amounts and orders above are quoted from regulator releases, signed court orders, and the AEPD’s own resolution.
Two honest limits carry through. First, several of these closed by settlement or consent, so no court found the underlying conduct proven: Rite Aid and IntelliVision both settled without admitting the allegations, and those figures are what the FTC alleged and what each company agreed to, not an adjudicated finding. Second, an imposed fine is not a collected one. Clearview describes itself as outside the EU’s reach and the public record does not confirm it has paid the 30.5 million euros. Each case file states these caveats where the reader meets the number.
Is facial recognition legal, on this record?
Yes, and that is exactly why the enforcement pattern matters. Not one of these six actions rules that facial recognition is illegal to build or sell.
Clearview was punished for scraping faces without a lawful basis. Mercadona for processing without one. Rite Aid for never testing accuracy. Serco for using it on staff without a lawful basis. Worldcoin for collecting iris data the regulator had not cleared. IntelliVision for claiming an accuracy and bias record it could not back up. The offense in every case is a missing safeguard, not the camera.
Which biometric privacy law applies?
It depends on where the data subject is, and the record spans four regimes. In the European Union, Clearview, Mercadona and Worldcoin were all sanctioned under the GDPR, which treats facial and biometric data as a special category needing an explicit lawful basis. In the United Kingdom, Serco was sanctioned under UK data-protection law on the same principle. In the United States there is no single federal biometric privacy law; the FTC actions against Rite Aid and IntelliVision ran on its unfairness and deceptive-practices authority, not a dedicated biometrics statute.
The state-level biometric privacy law that drives most private US suits, Illinois’s BIPA, is a separate vein, and TIN does not yet hold a verified BIPA anchor. This page reports what the six verified actions established, and does not extend past them.
The record in one table
| Company | Regulator or court | Country | What was ordered | Year |
|---|---|---|---|---|
| Clearview AI | Dutch DPA | Netherlands | 30.5M euro fine, final, four cease orders | 2024 |
| Mercadona | Spain AEPD | Spain | 2,520,000 euro fine, processing prohibited | 2021 |
| Rite Aid | FTC, E.D. Pa. | United States | Five-year ban, no fine, data deleted | 2024 |
| Serco Leisure | UK ICO | United Kingdom | Notice to stop, biometric data destroyed | 2024 |
| Worldcoin | Spain AEPD, upheld on appeal | Spain | Iris-scan processing halted | 2024 |
| IntelliVision | FTC | United States | 20-year order barring false bias claims | 2025 |
Short columns, because the enforced record is specific. Three fines, two operational halts, one marketing order, and no ruling that the technology may not exist.
The bottom line
The buyer’s takeaway from “facial recognition lawsuit” is usually the wrong one: that the technology is a legal trap. The record says the trap is the deployment. Every one of these six actions traces to a step the operator could have taken first, a lawful basis, an accuracy test, a claim it could actually prove. The transferable rule is the one TIN was built on: the enforced boundary is process, and process is checkable before a regulator checks it for you.
Sources
- Autoriteit Persoonsgegevens (Dutch DPA), “Dutch DPA imposes a fine on Clearview because of illegal data collection for facial recognition,” 2024-09-03. https://www.autoriteitpersoonsgegevens.nl/en/current/dutch-dpa-imposes-a-fine-on-clearview-because-of-illegal-data-collection-for-facial-recognition
- U.S. Federal Trade Commission, “Rite Aid Banned from Using AI Facial Recognition After FTC Says Retailer Deployed Technology without Reasonable Safeguards,” 2023-12-19. https://www.ftc.gov/news-events/news/press-releases/2023/12/rite-aid-banned-using-ai-facial-recognition-after-ftc-says-retailer-deployed-technology-without
- Agencia Espanola de Proteccion de Datos, “Resolucion del procedimiento sancionador PS/00120/2021 (Mercadona, S.A.),” 2021. https://www.aepd.es/documento/ps-00120-2021.pdf
- UK Information Commissioner’s Office, “ICO orders Serco Leisure to stop using facial recognition technology,” 2024-02-23. https://ico.org.uk/about-the-ico/media-centre/news-and-blogs/2024/02/ico-orders-serco-leisure-to-stop-using-facial-recognition-technology/
- Agencia Espanola de Proteccion de Datos, “The AEPD orders a precautionary measure that prevents Worldcoin from continuing to process personal data in Spain,” 2024-03-06. https://www.aepd.es/en/press-and-communication/press-releases/agency-orders-precautionary-measure-which-prevents-Worldcoin-from-continuing-toprocess-personal-data-in-spain
- U.S. Federal Trade Commission, “FTC Takes Action Against IntelliVision Technologies for Deceptive Claims About its Facial Recognition Software,” 2024-12-03. https://www.ftc.gov/news-events/news/press-releases/2024/12/ftc-takes-action-against-intellivision-technologies-deceptive-claims-about-its-facial-recognition
Questions
Is facial recognition legal?
Facial recognition is legal in most places, and the enforced record shows the line is not the technology but the deployment. Clearview AI was fined for building a database without a lawful basis or consent, Rite Aid was banned for running the tool untested, and Mercadona was fined for processing without a lawful basis. None of these outcomes bans facial recognition itself; each punishes how it was used.
Has any company been fined for facial recognition?
Yes. Spain's AEPD fined Mercadona 2,520,000 euros in 2021 and the Dutch DPA fined Clearview AI 30.5 million euros in 2024, both over facial-recognition or biometric processing without a lawful basis. Not every action is a fine: Rite Aid received a five-year ban with no fine, and Serco Leisure received an enforcement notice ordering it to stop and to destroy the data.
Can you sue a company for using facial recognition?
Regulators have brought most of the enforced actions on TIN's record, from the FTC in the United States to data-protection authorities in the Netherlands, Spain and the United Kingdom. Private lawsuits also exist, most visibly the Illinois biometric-privacy class actions, but the outcomes documented here are regulator-driven, and their common finding is a missing lawful basis, an untested system, or an unsubstantiated marketing claim.
Sources
- Autoriteit Persoonsgegevens (Dutch Data Protection Authority), Dutch DPA imposes a fine on Clearview because of illegal data collection for facial recognition , 2024-09-03
- U.S. Federal Trade Commission, Rite Aid Banned from Using AI Facial Recognition After FTC Says Retailer Deployed Technology without Reasonable Safeguards , 2023-12-19
- Agencia Espanola de Proteccion de Datos, Resolucion del procedimiento sancionador PS/00120/2021 (Mercadona, S.A.) , 2021
- UK Information Commissioner's Office, ICO orders Serco Leisure to stop using facial recognition technology , 2024-02-23
- Agencia Espanola de Proteccion de Datos, The AEPD orders a precautionary measure that prevents Worldcoin from continuing to process personal data in Spain , 2024-03-06
- U.S. Federal Trade Commission, FTC Takes Action Against IntelliVision Technologies for Deceptive Claims About its Facial Recognition Software , 2024-12-03
This is analysis, not a verified outcome. It carries no verification badge and never will. The proof lives in the case files, where every figure is checked against the public record and the method is printed on the page.