Clearview AI Inc, the US facial recognition company that built its database from images collected online, went before the Court of Appeal of England and Wales on Monday, October 19, 2026, in a three-day hearing over whether the UK's Information Commissioner had the power to issue the enforcement notice and monetary penalty notice it served on the company in 2022. Privacy International, which intervenes in support of the Commissioner, has filed an 18-page skeleton argument asking the court to reject Clearview's claim that processing linked to its foreign state clients falls outside the UK General Data Protection Regulation.

In Short

A company that collects pictures of faces from the internet and sells searches to police forces abroad is arguing in a UK appeals court that British privacy law does not cover it. A privacy charity told the court that working for foreign governments does not make a private company exempt, because only governments themselves can claim that kind of protection. The decision will help settle how far UK data protection law reaches companies based outside the UK that handle data about people in the UK.

The case before the court

The appeal, numbered CA-2026-000226, comes from the Upper Tribunal (Administrative Appeals Chamber), whose decision is reported as [2025] UKUT 319 (AAC). According to the case summary reproduced in a LinkedIn post published on October 19 by Luis Alberto Montezuma, who describes himself as working in data and privacy policy and labels the post as personal opinion, the hearing was listed for Monday 19 to Wednesday 21 October 2026.

The procedural history is layered. According to that summary, Clearview appeals the decision of the Upper Tribunal, a panel of Mrs Justice Heather Williams DBE, Judge Thomas Church and Judge Judith Butler, dated October 6, 2025. That decision allowed in part the Information Commissioner's appeal against a 2023 ruling of the First-tier Tribunal. The First-tier Tribunal had found that the Commissioner "lacked jurisdiction to issue the enforcement notice and monetary penalty notice that it issued to Clearview AI Inc in 2022."

The UK penalty itself was reported by PPC Land as more than 7.5 million pounds, imposed on May 23, 2022. Neither of the two documents behind this article states the amount.

The legal question, as the case summary frames it, is "to what extent the processing of the personal data of UK data subjects by a private company based outside the UK is excluded from the scope of regulation, including where such processing is carried out in the context of its foreign clients' national security or criminal law enforcement activities." The court is interpreting both the UK GDPR and the EU GDPR from which it was derived.

Three grounds, one intervention

Clearview's own skeleton argument is not among the documents published with the post. What it argues can only be read through Privacy International's account of it, which is an advocate's summary and not a neutral one. The Commissioner's skeleton, referred to as "ICO §" throughout, is also absent.

According to Privacy International, the appeal turns on three grounds:

  • Ground 1 asks whether Clearview is engaged in monitoring the behaviour of people in the UK, the hook in Article 3(2)(b) that brings a company established outside the UK within the regulation's territorial scope. Privacy International says it "endorses the Commissioner's submissions" on this point.
  • Ground 2 concerns whether Clearview's processing "relates to" behavioural monitoring carried out by its clients, a finding Clearview calls the "Client-Centred Finding." Privacy International supports the Commissioner here as well.
  • Ground 3 asks whether that processing escapes the UK GDPR because it forms part of services to foreign state clients. This is the only ground the charity addresses in detail.

The skeleton is explicit about how the grounds connect. Ground 3 "is premised on the success of Ground 1," it says, because if the court finds that Clearview itself is engaged in behavioural monitoring, "the appeal must be dismissed." Clearview, according to the document, "(rightly) does not seek to argue that it should benefit from the cloak of state immunity or any similar exemption for its own activities." Ground 3 also assumes that Ground 2 fails, so that the relevant monitoring is the monitoring done by Clearview's customers.

The document is signed by Marie Demetriou KC and Aarushi Sahore of Brick Court Chambers, with the law firm AWO, and is dated August 26, 2026. One drafting slip appears in its second paragraph, which describes Clearview as "the Respondent." Everywhere else, including the heading, Clearview is the appellant and the Commissioner is the respondent.

An argument dropped, and one that replaced it

Privacy International opens by pointing to a change in Clearview's position. Before the Upper Tribunal, Clearview ran what the skeleton calls an "intersectional" argument: that its own processing fell outside the material scope of the EU and UK GDPR because of its "intersection" with the processing carried out by its foreign state clients. According to the document, Clearview has abandoned that argument on appeal.

What took its place, in Privacy International's description, is a two-step claim. First, the behavioural monitoring done by Clearview's foreign state clients is by its nature outside the scope of EU law and so outside the UK GDPR. Second, because that monitoring is out of scope, "there is simply no behavioural monitoring to which the legislation can attach," and Clearview's processing linked to it is out of scope too. The skeleton says Clearview argues that the clients' monitoring "should accordingly be regarded as a nullity."

"Clearview's submission is misconceived," the skeleton states. It describes the argument as having "evolved considerably" and as an attempt "to resurrect a version" of the abandoned one.

Reading Article 3(2)(b)

Privacy International's first answer is textual. Article 3(2)(b) applies the regulation to a controller or processor established outside the UK where its processing of personal data of people in the UK relates to "the monitoring of their behaviour as far as their behaviour takes place within the United Kingdom." The skeleton breaks that into three questions: is the controller established outside the territory, is it processing personal data of people inside it, and does that processing relate to monitoring of their behaviour there?

"There is nothing in Article 3(2)(b) that lays down any requirements as to the nature or location of the monitoring or the person conducting the monitoring," the document argues. "That is a complete answer to Clearview's argument on construction."

The charity then points to what it sees as the practical consequence of Clearview's reading. If Clearview supplied the same service to a private company that was monitoring behaviour, Article 3(2)(b) would apply. If the customer was a state, the provision would have to be read down "by introducing the fiction that it never occurred." The skeleton adds that this would hold "even where it has been established that Clearview and its clients are joint controllers when searching Clearview's database," citing the First-tier Tribunal's findings at paragraphs 135 to 137. Privacy International calls the result "entirely unworkable" and "rife with uncertainty."

To support the point, the document cites the UK Supreme Court's 2015 ruling in United States of America v Nolan, where the US government argued for a "tailored exemption" in employment legislation to reflect state immunity without actually pleading it. The Supreme Court refused, warning that such reasoning would "very largely make redundant a plea of state immunity at least in respect of any statutory claim." The charity's conclusion: "The position should be a fortiori where a private entity is invoking the fact that its clients are states to create a tailored exemption for itself in the UK GDPR."

What "scope of Union law" means

The second strand of the argument concerns Article 2(2)(a) of the EU GDPR, which excludes processing "in the course of an activity which falls outside the scope of Union law." Clearview, according to the skeleton, argues that activities of third countries such as the US are self-evidently outside the scope of EU law.

Privacy International says the phrase is a term of art about how responsibilities are divided between the EU and its member states, not a general carve-out for anything beyond EU competence. It relies on the Court of Justice of the European Union's Grand Chamber in Case C-33/22, Österreichische Datenschutzbehörde v WK, which held that the exception "must be interpreted strictly" and is "designed solely to exclude from the scope of that Regulation the processing of personal data carried out by state authorities in the course of an activity which is intended to safeguard national security." It also cites Schrems II, where the CJEU said the rule that national security remains the sole responsibility of each member state "concerns Member States of the European Union only."

The WK judgment came after Brexit and does not bind the UK court. The skeleton argues it is nonetheless "highly persuasive" because Parliament deliberately kept the EU-law concept in the UK GDPR.

The document also argues that Clearview's reading "proves too much." Persons and activities in Brazil, it notes, are not in the ordinary sense within the scope of EU law, yet Article 3(2) plainly brings some of them into scope. If Clearview served only private US corporations, the skeleton says, "it would not be able to argue that those activities were excluded by Article 2(2)(a) even though as a matter of ordinary language they would be outside the scope of EU law." The only thing distinguishing a foreign state from a foreign company is its sovereign function, and that, in Privacy International's account, belongs to public international law rather than to the meaning of the regulation.

How the UK version works

After Brexit, the EU GDPR was saved into domestic law and amended in 2019. The resulting structure is unusual. Article 2(1)(a) of the UK GDPR brings into scope processing that, before the end of the transition period, fell outside the scope of EU law, so that the UK can regulate it domestically. Article 3(2A) then removes that same category from the extraterritorial reach of Article 3(2) where controllers established abroad are concerned. According to the skeleton, the end result "is intended to be the same as the EU GDPR," a point it says has been uncontroversial throughout the proceedings, with Clearview accepting at CV §11 that the two regimes are identical on the questions before the court.

State immunity as the proper route

The third strand is where Privacy International sets out what it regards as the correct test. Foreign states such as the US cannot be the subject of enforcement under the GDPR, the document accepts, but that is because of state immunity and the act of state doctrine, which operate independently of the regulation's text.

State immunity, as the skeleton summarizes it, covers the head of state, the government and government departments, and extends to "separate entities" including companies only when they act in the "exercise of sovereign authority." To benefit, Clearview would have to show "that its nexus with the foreign state(s) was so close that it was exercising sovereign authority," or explain why the court would otherwise be sitting in judgment on a foreign state's sovereign acts.

The charity doubts that test could be met. It says a detailed examination would be needed of "the precise law enforcement or national security functions of the state when using the database," and of "how Clearview could conceivably exercise public authority on behalf of multiple different states at once." According to the skeleton, the First-tier Tribunal recorded that Clearview had provided services to states including Panama, Brazil, Mexico and the Dominican Republic, and Privacy International believes Clearview currently serves the US, Ukraine, Brazil and Argentina. "Applying the correct principles, it appears highly unlikely that a private firm in these circumstances could invoke state immunity or any equivalent principles," the document says.

The skeleton also responds to a Clearview point that it would be "artificial" for US police forces to be free to use in-house facial recognition while being unable to use Clearview's services. "There is obviously no prohibition on US police forces using Clearview's technologies," Privacy International replies; the effect of the notices "is simply that Clearview is required to comply with the UK GDPR when providing those services to the US police." Its analogy is blunt: "States cannot expect all their contractors (e.g. caterers providing catering services to a state department) to be immune from foreign enforcement merely because they act for the state; something more is required."

The European record

Privacy International's interest is not new. According to the skeleton, the charity submitted a complaint to the Commissioner on May 27, 2021, after right of access requests by its own staff showed that their images and names were held by Clearview. That complaint argued Clearview's activities were caught by Article 3(2)(b) because it "engaged in monitoring of the behaviour of data subjects within the UK."

The document lists five EU data protection authorities that have sought enforcement against Clearview: CNIL in France, the Autoriteit Persoonsgegevens in the Netherlands, the Datenschutzbehörde in Austria, the Garante in Italy and the Hellenic Data Protection Authority in Greece. Privacy International says it originated the French complaint and drafted the others before local organizations translated and filed them. All five relied on Article 3(2)(b), and none found Clearview exempt because of the nature of its clients. Only the Dutch regulator, the skeleton notes, "expressly considered Article 2(2)(a) and found that it did not apply." The charity adds that, as far as it is aware, Clearview "has not complied with any EU enforcement actions or penalties, nor has it appealed these decisions."

The dates in the skeleton's footnotes are those of the decisions themselves, and three of them differ from the dates PPC Land has given for the same fines. The Garante order is dated February 10, 2022; PPC Land placed the Italian fine of 20 million euros in March 2022. The CNIL deliberation is dated October 17, 2022, while PPC Land dated the 20 million euro French penalty October 19, 2022. The Dutch statement is dated May 16, 2024, while PPC Land dated the 30.5 million euro Dutch fine September 3, 2024. The Greek decision, number 35/2022, carries July 13, 2022 in both.

The skeleton also mentions a ruling that Privacy International says it found only while preparing for this appeal. On June 27, 2024, Spain's Audiencia Nacional overturned the Spanish authority AEPD's refusal to act, finding that Article 3(2)(b) did apply to Clearview, in part by relying on the French regulator's reasoning. The charity uses that to criticize Clearview's reliance on evidence about the Spanish-language version of the GDPR, describing it as "cherry-picked foreign law advice."

There is a procedural dispute here too. The Upper Tribunal declined to consider three EU regulators' decisions because they had not been before the First-tier Tribunal. Privacy International says it relies on them only as legal background, not as evidence of facts, and argues that the UK court "ought to be on notice of the potential divergence between the UK and EU."

Why this matters for marketers and ad tech

PPC Land has followed Clearview's European record closely. Its database reached more than 60 billion images scraped from websites and social media, and after fines that PPC Land put at roughly 100 million euros went unpaid, noyb filed a criminal complaint in Austria on October 28, 2025 targeting the company's management. The pattern of a non-European company collecting data at scale and then contesting whether European rules reach it at all has repeated elsewhere: the Hamburg regulator found that PimEyes acted unlawfully but declined further steps because the company appeared to be based in Dubai.

The case reaches beyond facial recognition. Article 3(2)(b), the monitoring limb, is the same provision that brings a non-UK company within the UK GDPR when its processing relates to tracking people's behaviour in the UK. In PPC Land's reading, which is an inference rather than anything stated in the documents, a Court of Appeal ruling on how that limb applies when the monitoring is done by a company's customers rather than by the company itself could matter to any provider that supplies data or tools to clients who do the targeting or profiling. That covers data brokers and measurement vendors as well as tools built on web scraping. Privacy International's skeleton argues the identity of the client makes no difference to the test; Clearview, as the skeleton describes it, argues the opposite for state clients.

Privacy International has also pressed the UK government directly. In a submission covered by PPC Land, the charity asked the UK to ban five AI uses, including mass scraping to build biometric databases. Biometric privacy litigation is also active in the US, where a federal judge in Illinois let most of a class action over faceprints in Apple's Photos app proceed toward trial.

Clearview's tools have also surfaced in coverage of how police use them. PPC Land reported that a Clearview AI search run by a police department in North Dakota identified a potential suspect in a case that led to a woman's wrongful five-month detention.

What happens next

The hearing was scheduled to close on Wednesday, October 21. The documents give no indication of when judgment will follow. Privacy International's conclusion is short: "the appeal on Ground 3 should be dismissed." If the court rejects Ground 1 and finds that Clearview itself monitors behaviour in the UK, Ground 3 never needs to be decided, according to the skeleton's own reading of the case.

Timeline

Summary

Who: Clearview AI Inc, the appellant; the UK Information Commissioner, the respondent; and Privacy International, the intervener, represented by Marie Demetriou KC and Aarushi Sahore of Brick Court Chambers with AWO. The hearing was publicized on LinkedIn by Luis Alberto Montezuma in a post marked as personal opinion.

What: A Court of Appeal hearing on whether the Commissioner had jurisdiction to issue the 2022 enforcement notice and monetary penalty notice to Clearview. Privacy International's skeleton argument addresses Ground 3, arguing that processing linked to foreign state clients is not excluded from the UK GDPR and that only state immunity or the act of state doctrine could displace it.

When: The hearing was listed for October 19 to 21, 2026. The skeleton is dated August 26, 2026, and the appeal comes from the Upper Tribunal's decision of October 6, 2025.

Where: The Court of Appeal (Civil Division) of England and Wales, appeal number CA-2026-000226, on appeal from [2025] UKUT 319 (AAC).

Why: The outcome will shape how far the UK GDPR's monitoring limb reaches companies established outside the UK, including when the monitoring is carried out by their clients. Five EU authorities and a Spanish court have applied the equivalent EU provision to Clearview, and Privacy International argues that a different UK answer would open a divergence.