€30.5 million for an illegal AI face database: the Dutch DPA's final, unappealable GDPR fine on Clearview AI

The problem

Clearview AI built a commercial facial-recognition service the way a scraper builds a search index: crawlers harvested photos of faces from social media, websites, news articles and public databases — over 30 billion of them, per the regulator’s findings — and converted each face into a biometric vector. Intelligence and investigative agencies could then upload a camera image and get back matching photos and source links. The people in the database were never asked, and never told.

This is a verified negative: an independent European regulator investigated a deployed AI system, made formal findings about what it does, and priced the violations in a signed, final decision. No vendor narrative is involved at any point in the chain.

What the regulator found

The Autoriteit Persoonsgegevens found five violations of the GDPR. Clearview “processes, without a legal basis to do so, personal data of data subjects who are within the territory of the Netherlands”; it processes “a special category of personal data (biometric data)” in violation of the outright prohibition of Article 9(1); it fails to inform the people in its database; and it neither answered two individual access requests nor facilitates access rights at all. In the release’s summary: “the company should never have built the database and is insufficiently transparent.”

The outcome

The decision of 16 May 2024, published 3 September 2024, imposes two administrative fines totalling €30,500,000 — €20,000,000 for the illegal-database violations and €10,500,000 for the access-rights violations — plus four cease orders backed by monthly non-compliance penalties capped at €5.1 million in total. Because Clearview did not object within the objection period, the regulator states it “is therefore unable to appeal against the fine.”

The honest caveats

• Imposed, not collected. Nothing in the record shows Clearview has paid. The decision itself notes collection runs through the Dutch Central Judicial Collection Agency and awaits the end of any follow-up proceedings, and Clearview’s chief legal officer calls the decision “unlawful, devoid of due process and… unenforceable,” saying the company has no EU business or customers.
• The €5.1M is exposure, not a levy — the maximum if Clearview ignores the four cease orders.
• The 30-billion figure is the regulator’s finding but ultimately traces to Clearview’s own description of its database — it is context here, not the headline claim.
• Other European fines on Clearview (UK, Italy, Greece, France) are separate actions and are never added to the €30.5M in this story.

Why this matters for AI-led ops

The AP decision is the EU’s plainest pricing of an AI data-supply chain built on scraping: the violation was not a model error but the training/search corpus itself. For anyone deploying face-matching or scraped-data AI in Europe, the €30.5M figure — final and unappealable — is the reference number, and the regulator’s warning extends to customers: Dutch organisations that use Clearview “may therefore expect hefty fines.”