TL;DR: Vermont's lawsuit against Clearview AI was dismissed on December 18, 2025, the third time the state failed to hold the company accountable. The reason? Clearview claims it doesn't "do business" in Vermont, so Vermont courts can't touch them. Meanwhile, an Illinois lawsuit under BIPA resulted in a $51.75 million settlement. The difference: Illinois has the strongest biometric privacy law in America. Most states don't.
What Happened
On December 18, 2025, Washington County Superior Court Judge Daniel Richardson dismissed Vermont's lawsuit against Clearview AI [1]. This was Vermont's third attempt to sue the facial recognition company for scraping residents' faces without consent.
The reason for dismissal: jurisdiction. Judge Richardson wrote that "the largely uncontested record here shows that Clearview conducts no substantial business in Vermont and never has."
Clearview AI has scraped over 30 billion facial images from the internet, including from Vermonters. They sell access to police departments across the country. But because they don't have an office in Vermont, don't specifically target Vermont residents, and haven't contracted directly with Vermont agencies, the state can't do anything about it.
"Clearview AI does not operate in Vermont," the company said in a statement, "and today's ruling appropriately recognizes that courts should exercise jurisdiction over companies with which they have a meaningful connection" [1].
Vermont's Three Failed Attempts
Attempt 1: Federal Court
Vermont Attorney General Charity Clark first sued Clearview in federal court, alleging violations of the state's Consumer Protection Act. The case was consolidated with other lawsuits into a multidistrict litigation (MDL) in Illinois.
Attempt 2: Refiled After Settlement
In April 2025, just as Clearview was settling the MDL, Vermont refiled in state court. The Attorney General alleged Clearview violated consumer protection laws, sought an injunction forcing the company to delete data, and demanded restitution and civil penalties [2].
Attempt 3: Dismissed on Jurisdiction
Clearview filed a motion to dismiss in June 2025, arguing Vermont courts lack jurisdiction. Judge Richardson agreed. Case dismissed.
The Core Problem
Vermont's Consumer Protection Act wasn't designed for internet-age surveillance. Traditional jurisdictional standards ask: Does the company have offices here? Did they contract with people here? Do they advertise here?
Clearview scraped Vermonters' faces from Facebook, LinkedIn, and other platforms. They built a surveillance database that police can search. But they never "contacted, contracted with, or took information directly from people in the state" in the traditional legal sense [1].
Judge Richardson acknowledged he wanted to consider "how traditional pre-digital jurisdictional standards apply to modern e-commerce situations." But he ruled for Clearview anyway.
Why Illinois Succeeded
The BIPA Advantage
While Vermont's lawsuit failed, a lawsuit in Illinois resulted in a $51.75 million settlement against Clearview in March 2025 [3]. The difference: Illinois has the Biometric Information Privacy Act (BIPA).
BIPA, enacted in 2008, is the nation's strongest biometric privacy law. Key provisions:
- Written consent required: Companies must get consent before capturing biometric identifiers like faceprints
- Private right of action: Individuals can sue, not just the state attorney general
- Statutory damages: $1,000 per negligent violation, $5,000 per intentional violation
- No consent defense: "We scraped public data" isn't an excuse
The Settlement Terms
The ACLU-led lawsuit resulted in restrictions that go far beyond Illinois [4]:
- Nationwide ban: Clearview permanently banned from selling database access to private entities across the entire US
- Illinois-specific: Five-year ban on providing database access to any state/local government in Illinois
- End of free trials: Must stop offering free trial accounts directly to individual police officers without employer approval
- Opt-out portal: Required to maintain opt-out system for Illinois residents
The class members received a 23% equity stake in Clearview AI, a first-of-its-kind resolution [5].
Why BIPA Works
BIPA works because it doesn't rely on traditional jurisdictional arguments. If Clearview scraped the face of an Illinois resident, even from a server in another state, they violated Illinois law. The company's lack of physical presence is irrelevant.
As Rebecca Glenberg noted, BIPA was "intended to curb exactly the kind of broad-based surveillance that Clearview's app enables" [4].
Why Most States Fail
The Jurisdiction Shell Game
Surveillance companies have learned to exploit jurisdictional gaps:
- Incorporate in privacy-hostile states
- Don't maintain offices in states with strong laws
- Don't directly contract with residents
- Scrape data through intermediaries (social media platforms)
When states sue, companies argue: "We don't operate there. Your courts can't touch us."
Weak State Laws
Most state consumer protection laws weren't written for biometric surveillance. They require showing:
- Direct business relationship with consumers
- Deceptive practices toward state residents
- Traditional commercial activity
Clearview's argument: We scraped public photos. We sell to police. We never interacted with consumers. That's not "consumer protection" territory.
The MDL Problem
When Clearview faced multiple state lawsuits, they successfully consolidated most into a single federal MDL in Illinois. Twenty-two state Attorneys General opposed the MDL settlement because they didn't receive injunctive relief [5].
Vermont was one of them. When Vermont refiled independently, Clearview used the jurisdiction argument to get the case dismissed.
The Biometric Privacy Gap
States With Strong Laws
Only a handful of states have laws approaching Illinois's protections:
- Illinois (BIPA): Strongest law, private right of action, no consent defense
- Texas: Biometric protections but no private right of action, only AG can sue
- Washington: Biometric protections but no private right of action
States With Weak or No Laws
Most states have either no biometric privacy law or laws that surveillance companies can easily dodge. Vermont's Consumer Protection Act, as the December dismissal showed, isn't enough.
Federal Vacuum
There is no federal biometric privacy law. Congress has considered several bills but passed none. Meanwhile, companies like Clearview operate across all 50 states, scraping faces and building databases, largely without accountability.
As Nathan Freed Wessler of the ACLU noted: "Strong privacy laws can provide real protections against abuse" [4]. The key word is "strong." Most state laws aren't.
What Actually Works
The BIPA Model
For states that want to hold facial recognition companies accountable, the BIPA model provides a template:
- Private right of action: Let individuals sue, not just government
- Statutory damages: Set minimum penalties that make litigation worthwhile
- No consent loophole: "Public data" scraping still requires consent
- Extraterritorial reach: If you process our residents' biometrics, our law applies
Why Companies Fear BIPA
Clearview changed its practices nationwide because of one state's law. The Illinois settlement:
- Banned private-sector sales across the entire US
- Required an opt-out system
- Cost $51.75 million
- Set a precedent for future enforcement
When state laws have teeth, companies change behavior. When they don't, cases get dismissed.
What You Can Do
Immediate Actions
• If you're in Illinois, use Clearview's opt-out portal
• Reduce your facial recognition exposure
• Limit public photos that can be scraped
• Check if your state has biometric privacy laws
Long-term Advocacy
• Support BIPA-style legislation in your state
• Demand federal biometric privacy law with private right of action
• Oppose industry lobbying to weaken state laws
• Support organizations like ACLU and EFF fighting these cases
The Bottom Line
Clearview AI scraped your face without consent. They built a database of 30 billion images. They sell access to police departments. And in most states, there's nothing you can do about it.
Vermont tried three times. Three times they failed. The company doesn't "operate" there in the traditional sense, so Vermont courts can't touch them.
Illinois proved it's possible to hold facial recognition companies accountable, if you have the right law. BIPA forced Clearview to change nationwide. One state's strong law became de facto national policy.
The lesson is clear: weak privacy laws don't protect anyone. If your state doesn't have BIPA-style protections, surveillance companies will scrape your face, build their databases, and dare you to try to stop them.
They're betting you can't. In most states, they're right.
References
- VTDigger - Judge throws out Vermont's lawsuit against Clearview AI (December 18, 2025)
- Vermont Attorney General - Refiles Lawsuit Against Clearview AI (April 25, 2025)
- Regulatory Oversight - $51.75M Settlement in Clearview AI Litigation (April 2025)
- ACLU - Settlement Ensures Clearview AI Complies With Illinois Biometric Privacy Law (May 2022)
- National Law Review - BIPA Litigation Class Members Receive Equity in Clearview AI (2025)