Applicable to: AI providers and deployers.
Date of application: 2 February 2025.
Objective: to prohibit the use of AI systems that create or expand facial recognition databases through the untargeted scraping of facial images.
Regulation (EU) No 1689/2024 on Artificial Intelligence (AI Act) of 13 June 2024 introduced a series of prohibitions within the European Union on practices involving the use of AI systems that pose an ‘unacceptable’ risk (the highest level assigned to certain AI systems in the risk-based approach adopted by the AI Act).
In this article, we will analyse the practice covered by Article 5.1 e) of the AI Act, under which the following is prohibited:
the placing on the market, the putting into service for this specific purpose, or the use of AI systems that create or expand facial recognition databases through the untargeted scraping of facial images from the internet or CCTV footage
The elements that characterise the prohibited practice are:
1) the fact that the AI system is placed on the market, put into service or used within the European Union
2) for the purpose of creating or expanding facial recognition databases
3) through the untargeted scraping of facial images
4) from the internet or CCTV footage
These types of databases are created by transforming an image into a mathematical representation for comparison and the subsequent making available for the authomatic search for a face or a person.
The Guidelines approved by the European Commission on 29 July 2025 have clarified that the expression “scraping” refers to using web crawlers to extract data and that the notion of ‘untargeted’ means without a specific focus on a given individual or group of individuals.
For example, this means that it will not be permitted to supply or use an AI system that collects facial images from the internet or CCTV footage and stores them in a database for integration into an access control video surveillance system for the purpose of automatic facial recognition.
However, “targeted” scraping, that is the one aimed at collecting images or video containing human faces only of specific individuals or a pre-defined group of persons (for example to find one specific criminal), it’s not covered by the prohibited practice in question.
In this context, it is permissible, for example, to supply or use an AI system designed to automatically search for an image captured by a CCTV camera (of a person entering a particular premises) by scanning the internet or CCTV footage.
It goes without saying that, as specified in the Guidelines, the publication of one’s own image on a publicly visible social media page does not mean that that person has given his or her consent for those images to be included in a facial recognition database.
Articoli Correlati