TL;DR
Consumer face-recognition apps are search engines for faces. You upload a photo, the app extracts a mathematical fingerprint of the geometry in the picture, and the app searches that fingerprint against an index of billions of images scraped from the open web.[1][2] Your upload is a query, not a deposit: PimEyes says it stores user-uploaded photos only for as long as the search takes, and that the face fingerprints it keeps are "derived only from publicly available web sources, never from your uploads."[1] What persists is the index, which holds the faces of everyone whose photos were scraped. Opting out requires per-service paperwork: PimEyes wants a face-verification selfie and an ID scan.[3] FaceCheckID wants either a selfie or an anonymized ID document.[5] Illinois residents get a hard wall in some cases: PimEyes's privacy policy says the company "does not offer any services in Illinois or for Illinois residents."[1] California and a growing list of other states put the legal burden on the company, not on you.
The Two Different Things People Mean by "Face Recognition App"
There are two entirely different products hiding behind the same phrase.
The first is the consumer face search engine. PimEyes and FaceCheckID both do roughly the same job: you hand them a photo, they hand you back every other public photo on the internet that contains the same face. These tools are marketed to journalists, investigators, the curious, and stalkers. The index is built by scraping the open web.[1] No names, no government IDs, no biometric enrollment on your end. You do not have to create an account to run a search.
The second is the identity-verification and authentication app. Banks, employers, and gig-economy platforms run face-matching against a face template they already have on file for you. The face template was created when you enrolled (uploaded a selfie plus a government ID, or had your photo taken at a kiosk). The app's job is to confirm that the face in front of the camera now matches the template it already holds. This is BIPA territory in Illinois, biometric-clock-in territory at work, and TSA PreCheck territory at the airport.
Both classes of apps are governed by overlapping but distinct laws. The face search engine side is mostly consumer-protection law and platform-terms-of-service. The identity-verification side is the world of state biometric privacy statutes, employer consent rules, and the federal facial-recognition procurement rules.
What PimEyes Says It Does, in Its Own Words
PimEyes is one of the most widely used consumer face search engines, and its privacy policy is unusually explicit about what the company does and does not do. Reading it is the clearest way to see how this class of product actually behaves.
The policy draws a sharp line between what PimEyes does and what an identification service would do. Its description of the index reads: "PimEyes does not engage in targeted searches for any particular individual, but rather indexes images that are openly available on the Internet."[1] The same page says the system is built around "fingerprints" of faces, and PimEyes "does not undertake any action to confirm the identities of the persons depicted in the indexed photos, whom this policy refers to as 'unidentified entities.'"[1]
That distinction matters. A face fingerprint, or face embedding, is a vector of numbers derived from the geometry of a face in a photo. It is not a name. It is not a Social Security number. It is a string of bytes that an algorithm computes from a photo and then compares against other photos. The same technology powers both consumer search engines and law-enforcement identification systems, but PimEyes's pitch is that it only does the search half. It does not match a fingerprint back to a name. It only matches a fingerprint to other fingerprints.
The company's home page makes the storage claim in plain language: "Your uploaded images are never stored, never shared, and never used to train models."[2] The privacy policy is more detailed about what is and is not stored, and how long things stick around. It keeps search results for 30 calendar days after a search.[1] It also says PimEyes does not "store user-uploaded photos beyond the time required to perform the search," and that "face fingerprints are derived only from publicly available web sources, never from your uploads."[1] When PimEyes displays a match, it downloads a temporary copy from the source website, holds it "for a temporary period not exceeding 30 calendar days," and deletes it "instantaneously upon being exhibited."[1] Uploads made for an opt-out request are retained for a "reasonable period of time (no more than 96 hours)," "needed to carry out your request," after which the personal data is "permanently removed from our system."[1] Photos sent by users without an account are "securely stored for 48 hours after the User not having account sends the photo."[1] The headline retention cap is "no later than when the initial purpose for collecting them has been satisfied or within 3 years of the data subject's last interaction with PimEyes, whichever occurs first."[1]
What that policy does not address, and what the company's FAQ does not make easy to find, is what happens to the face fingerprints themselves. The fingerprint of a face that appears in a scraped image is, by the company's own description, what makes the index searchable. The privacy policy lists retention windows for uploaded images, for search results, and for the temporary copies it pulls down to show you a match. It does not state, in plain language, that face fingerprints derived from scraped images are deleted when the underlying images are. A reader who wants to remove the fingerprint of their face from PimEyes's index has to go through the opt-out process, not a privacy request.
The Opt-Out Process: Three Forms, Face Verification, and ID Scans
PimEyes runs an opt-out request form that requires a face verification selfie and an ID scan. The form breaks the process into three explicit consent steps.
The first step is a photo of the user's own face: "I agree to use the photo of my face for the purpose of blocking any images of me that may appear in search results."[3] PimEyes's intent here is to match the photo you submit against the face fingerprints it already holds, and use that match to drop matching entries from the index. Without the photo, PimEyes says the request cannot be processed.
The second step is a government ID scan, with one twist: "I confirm that the scan of my ID/passport does not contain any sensitive data and is anonymized according to the mentioned instruction."[3] The form's instructions specify which fields must be redacted. PimEyes uses the redacted scan to confirm that the face verification selfie is actually yours.
The third step is an email address for the confirmation reply: "I agree to be notified about the result of my request."[3] The opt-out page does not promise a fixed turnaround time, and PimEyes's privacy policy separately says the "full deletion process can take up to 30 calendar days."[1]
The form also has a clear disclaimer about what it cannot do. PimEyes writes: "Uploading your photo is necessary in order to carry out the opt-out procedure... The only data we store is face fingerprints of photos found on publicly available websites."[3] And: PimEyes is "not liable for the origin of the photo, nor able to take it down from the website it was posted on."[3] Removing yourself from the PimEyes index is not the same as removing your face from the source pages where PimEyes originally found it.
FaceCheckID runs a parallel process on its own domain, and its removal flow works differently. You search for your face in the results, select the photos, and start a selfie capture, which the company calls the quickest, fully automated way to confirm the request is yours.[5] Most selfie requests are approved instantly and the photos are deleted right away.[5] If you cannot take a selfie, you upload an anonymized ID document instead, and that route requires manual review: FaceCheckID says the document check runs "1 to 5 business days."[5] Either way your photos are "IMMEDIATELY HIDDEN," so they stop showing up in new searches, and once a request is approved your photos and your uploaded document are "permanently deleted."[5] If a request stalls, the next lever is the data protection authority in your jurisdiction: the ICO in the UK, the CNIL in France, or your state attorney general under CCPA in the United States.
The Laws That Actually Apply
The laws that govern face-recognition apps split cleanly along state lines, and the one in the country that most directly covers this technology is the Illinois Biometric Information Privacy Act. PimEyes's own privacy policy treats BIPA as applying to its data, and says Illinois residents can demand deletion.
PimEyes's privacy policy acknowledges BIPA directly. The same page that describes its retention schedule also says: "any data subject to whom the Illinois Biometric Data Privacy Act ('BIPA') applies, is entitled to exercise the opt-out right" and can submit a request to "have their data removed from the PimEyes system."[1] And it states the company's own workaround for that legal exposure: "PimEyes does not offer any services in Illinois or for Illinois residents."[1]
That is the most important sentence in the document for an Illinois reader. PimEyes has decided that, rather than build a BIPA-compliant consent flow, it will simply turn off access for users it believes to be in Illinois. The same section claims the company has implemented technical measures to block data "that can be reasonably linked with Illinois or Illinois residents," both when collecting from public sources and when a data subject provides it directly.[1] What the policy does not say is whether those measures reach photos of Illinois residents that were already scraped before the block went up.[1] But the company's stated position is that the law applies to its data, and that the company chooses to opt out of the Illinois market rather than to comply with it.
California takes a different approach. The CCPA, as amended by the CPRA, defines biometric information as a category of personal information, and treats biometric information processed to identify a consumer as a form of sensitive personal information that triggers the statute's notice-and-opt-out rules. The California Attorney General's CCPA page lists "biometric information processed to identify a consumer" among the categories of sensitive personal information.[4] The right to delete under the CCPA gives California residents the right to demand that a vendor delete face fingerprints the vendor has collected about them, with limited exceptions.
Outside Illinois and California, the legal picture is patchier. A consumer face-recognition app that does not sell face data and does not use it for identification may face only a general consumer-protection or unfair-and-deceptive-practices inquiry if it misbehaves. The U.S. federal baseline for biometric data is thin. More than twenty states now have some kind of biometric privacy statute, and we keep a [state-by-state breakdown](/guides/basic/23-states-biometric-privacy-laws) of them. The fastest way to know whether your state has a statute is to check that list before you upload a photo of your face.
What a Reader Should Do Before Uploading a Face
The honest framing of these tools is that they are useful for what they were built for, and dangerous for everything else. PimEyes is genuinely useful for finding every public photo of yourself on the open web, and the opt-out flow is genuinely functional. FaceCheckID is useful for investigators trying to find scammer photos or doxxing sources. They are not designed to be used as identification systems, and PimEyes explicitly disclaims that role in its privacy policy.
Three practical rules cover most of the risk:
- If you are in Illinois, do not use PimEyes at all. The company has chosen to refuse service rather than comply with BIPA, and any attempt to bypass the geofence would put both you and the company in a legally murky position.
- If you are outside Illinois, treat the upload as a privacy event. Your photo is the query, but what persists is the index: PimEyes's own opt-out form says the only data it stores is "face fingerprints of photos found on publicly available websites."[3] Your face can already be in that index if any of your photos are public. Do not upload a photo of a face that has not consented to being searched.
- If you want your face removed, the only reliable path is the per-service opt-out form, plus a separate request to the source website where the original photo lives. PimEyes and FaceCheckID can drop you from their index. They cannot delete the photo from the blog, news site, or forum it originally appeared on.
The bigger question, which no opt-out form answers, is what a face-recognition app should not be allowed to do at scale. The same technology that lets a journalist find a stranger's mugshot also lets a private investigator find a domestic-violence survivor's new social-media photos, and lets a political operative build a faceprint database of everyone who attended a protest. The legal frameworks in Illinois and California treat these as foreseeable harms. Most of the country does not.