Privacy & Cybersecurity Law Blog

On March 10, 2020, the Vermont Attorney General filed a lawsuit against Clearview AI (“Clearview”), alleging that Clearview violated Vermont’s consumer protection law and data broker law. We previously reported on Vermont’s data broker law, which was the first data broker legislation in the U.S.

The complaint alleges that Clearview, which is registered as a data broker in Vermont’s Data Broker Registry, scraped photographs of individuals from public websites, amassing a database of 3 billion photographs. The complaint further alleges that Clearview engaged in unfair and deceptive business practices, in violation of Vermont consumer protection law, when it used the scraped photographs in its facial recognition app, which it made available to numerous for-profit corporations despite representations on its website that the app was open only to law enforcement and not available to the public. The complaint also alleges numerous misrepresentations in Clearview’s privacy policy, including those regarding data security and consumer rights with respect to personal information. In addition to unfair and deceptive business practice claims, the Vermont Attorney General alleged that Clearview’s use of scraping technology to acquire individual’s photographs violated a provision of Vermont’s data broker law that prohibits “fraudulent acquisition of brokered personal information.” The complaint seeks injunctive relief and restitution, as well as civil penalties of $10,000 for each violation of the Vermont Consumer Protection Act, and $10,000 for each violation of Vermont’s Fraudulent Acquisition of Data Law.