Four GDPR Fines on Clearview AI, None Collected: The Risk Moves to Users and Directors

What the Record Actually Shows

Four European data protection authorities have fined Clearview AI a combined €90.5 million under the GDPR. No source shows that a single euro has been collected. Read quickly, that looks like a regulation without teeth. Read properly, it shows where the teeth go when the obvious target is out of reach: to the European organisations that use the service, and to the people who run the company.

The point for a decision-maker is not that the GDPR failed against a US vendor. It is that an uncollectable fine on a supplier leaves the obligation fully in place, and moves the practical risk onto parties a regulator can reach. If your organisation, or a supplier of yours, touches a Clearview-type service, you are one of those parties.

Four Decisions, One Reading

Each authority applied the GDPR to a company with no establishment in the EU, using Article 3(2)(b): processing linked to monitoring the behaviour of people in the Union. The CNIL stated the conclusion directly: the processing "falls within the territorial scope of the GDPR"⁵. The Hellenic DPA recorded that Clearview AI, Inc. is based in the USA and "has no establishment in the EU" before reaching the same result⁴.

Sources:^1234568. Austria's authority found the processing unlawful in a decision published on 10 May 2023, but issued no fine and no general ban⁸.

The findings converge. No lawful basis under Article 6: the Garante found that Clearview's legitimate interest "does not qualify as such"², the Hellenic DPA found that nothing in the file established any Article 6 basis, and the CNIL concluded the company "has no legal grounds for the processing"⁵. Greece added breaches of Article 9 (biometric data), Article 14 (information), Articles 12 and 15 (access) and Article 27 (EU representative)⁴. The CNIL added a breach of Article 31 because the company ignored its November 2021 compliance order and two reminders⁵.

These are not contested readings of a new law. They are four regulators reaching the same conclusion on the same facts under a regulation in force since 2018. The Dutch authority notes that Clearview did not object and "is therefore unable to appeal against the fine"¹. On the instrument, the record is settled.

Where Enforcement Stops

The money is a different matter. An April 2025 investigation by Solomon and IrpiMedia found that Clearview "has yet to pay a single euro"⁶. The Hellenic DPA told the reporters that, because Clearview has no economic activity in Europe, "we cannot proceed with the envisaged actions for the registration and collection of the fine". Greece's tax authority explained that collection is hindered without bilateral agreements on the mutual recognition and enforcement of administrative sanctions⁶.

Two cautions. First, payment status after April 2025 rests on journalism and on an advocacy group's account, not on any regulator's published register. Second, the French and Greek amounts above come from reporting, because the operative sections of those decisions were not legible in the copies reviewed. Neither caution changes the shape of the finding: binding in law, not yet binding in cash.

An unpaid fine does not suspend the obligation. Erasure orders, processing bans and the illegality finding remain in force, and they bind anyone in Europe who uses the service.

Where the Risk Moves

To European users

This is the part that applies to enterprises directly. The Dutch authority did not stop at the vendor. Its announcement states that "this makes using the services of Clearview illegal", and that "Dutch organisations that use Clearview may therefore expect hefty fines"¹. That is a regulator's published position, not a decision against any user. But a Dutch organisation is fully within the authority's reach in a way the vendor is not, and the authority has said where it will look.

The logic is not peculiar to the Netherlands. The Italian and Greek orders prohibit processing of data about people in their territories through this system³⁴. An EU organisation that uploads a probe image for a match becomes a controller in its own right, with its own need for a lawful basis, and the regulators have already found the underlying database to have none.

To the people running the company

The second shift is towards individuals. The Dutch authority said it would investigate whether "the directors of the company can be held personally responsible for the violations"¹. In October 2025 noyb filed a criminal complaint with Austrian prosecutors against Clearview AI and its managers, relying on Article 84 GDPR, which lets member states set criminal penalties, and on § 63 of Austria's Data Protection Act. noyb's stated reason is that EU authorities "did not come up with a way to enforce its fines and bans against the US company"⁷⁸.

Both routes are untested. No Dutch decision on director liability has been published, and the outcome of the Austrian complaint is unknown. A complaint is not a charge, and an investigation is not a finding. What the record does show is regulators and claimants looking for parties who can be made to answer when the company will not.

What to Do with This

Stop treating a non-EU vendor's unpaid fines as evidence that the obligation is soft. The decisions stand, the vendor's processing has been held unlawful four times over, and the only parties left to enforce against inside Europe are its customers and, potentially, its officers.

The usable test is a procurement one. Before adopting any service that builds biometric or scraped-data capability from people in the EU, ask three questions: has a European authority already found its processing unlawful; has it appointed an Article 27 representative; and could a regulator collect from it if it had to. If the answers are yes, no and no, your organisation is the reachable party. Price that in, or do not buy.

This is commentary on published decisions and reporting, not legal advice.