Clearview AI v. Alberta: A Turning Point for Privacy Law and Internet Scraping

When a U.S. software company scraped billions of public photos and provided them to third parties, including law enforcement, a Canadian Court answered – what does this mean for Canadians’ online privacy?

Overview

In looking back at noteworthy privacy decisions of 2025, in May 2025, the Court of King’s Bench of Alberta (“ABKB”) released a highly anticipated decision, Clearview AI Inc. v. Alberta (Information and Privacy Commissioner), 2025 ABKB 287. 

The decision arises from a challenge brought forward by Clearview AI Inc. (“Clearview”) that included a judicial review of an enforcement order issued by Alberta’s Information and Privacy Commissioner (the “Commissioner”). The decision ultimately resolves a clash between modern day privacy practices and Alberta’s privacy law and addresses the collection, use and disclosure of personal information scraped from the Internet.

The ABKB ultimately found that Alberta’s Personal Information Protection Act (“PIPA”), and its regulations, applied to Clearview, a U.S.-based company, on the basis that its activities had a real and substantial connection to Alberta. Even though Clearview did not have a physical presence in Alberta, its collection and use of personal information clearly included information of Alberta residents. Further, the Court found that certain provisions of PIPA were unconstitutional and found that they infringed an individual’s right to freedom under Section 2(b) of the Canadian Charter of Rights and Freedoms (the “Charter”).

The ABKB made three critical findings in Clearview AI Inc. v. Alberta (Information and Privacy Commissioner), 2025 ABKB 287:

1. PIPA applies to out-of-province parties if a real and substantial connection exists between the party and province.
2. The Commissioner’s narrow interpretation of PIPA’s “publicly available” exception to consent, further described below, was reasonable.
3. Together, the PIPA consent requirements and the narrow “publicly available” exception are unconstitutional under section 2(b) of the Charter.  

In short, the ABKB found that the Commissioner’s narrow interpretation of the “publicly available” PIPA exception was reasonable but ultimately held that the exception itself was unconstitutional. The Court interpreted “publicly available information” to include personal information that individuals have intentionally made accessible to the general public online. The “publicly available” PIPA exception applies where the collection, use or disclosure of the “publicly available information” is for a purpose a reasonable person would consider appropriate in the circumstances. The ABKB held that Clearview’s collection and use of facial images for the purpose of mass identification and surveillance for a commercial purpose was not a use that a reasonable person would consider appropriate, even when the images were posted publicly online.

Background

Clearview is a U.S. company offering facial recognition software and databases to customers. Clearview’s databases include billions of images taken from the Internet, including from Albertan websites and social media accounts, a practice commonly referred to as “data scraping.”

Clearview’s practice of “data scraping” caught the attention of privacy regulators that together formed a joint commission to investigate, including the Canadian federal privacy regulator and the provincial privacy regulators in Alberta, British Columbia and Québec (collectively, the “Joint Commission”). The Joint Commission launched an investigation into, among other things, Clearview’s “data scraping” practices and concluded that Clearview’s activities were harmful and conducted without obtaining appropriate consent from the individuals whose data was being collected. The Joint Commission released a report, which recommended that Clearview:

i. Cease offering its facial recognition tool to clients in Canada;

ii. Cease the collection, use and disclosure of images and biometric facial arrays collected from individuals in Canada; and

iii. Delete images and biometric facial arrays collected from Canadians in its possession.

Clearview declined to adopt the recommendations made by the Joint Commission in the report. The Commissioner issued an order on December 7, 2021, that put the Joint Report’s recommendations into “full force and effect” (the “Order”).

In response, Clearview brought an application for judicial review of the Order in Alberta. There were two components to Clearview’s challenge: (1) a judicial review of the Commissioner’s Order; and (2) a constitutional challenge to the Commissioner’s interpretation of PIPA at Sections 12, 17 and 20.

Alberta’s Privacy Regime

There are two material aspects of Alberta’s privacy regime relevant to the judicial review of the Commissioner’s Order and constitutional challenge brought by Clearview. First, PIPA requires consent for collection, use and disclosure of personal information. Second, PIPA imposes a prohibition on collection, use and disclosure of personal information with an exception for purposes that are “reasonable”. Section 14(e) of PIPA further provides an exception to the consent requirement where the personal information is “publicly available”. Sections 17(e) and 20(j) of PIPA provide the same exception for the use and disclosure of personal information.

The term “publicly available” is defined in the Personal Information Protection Act Regulation (the “PIPA Regulation”). The PIPA Regulation provides that personal information is not “publicly available” unless it falls within the enumerated circumstances listed in the PIPA Regulation at Section 7. Importantly, the PIPA Regulation does not expressly provide that the Internet is a source of personal information that is “publicly available”. However, Section 7(e) of the PIPA Regulation provides that personal information contained in a “publication” is “publicly available”.

Does “Publicly Available” Include the Internet?

The ABKB considered whether the Commissioner’s finding that Clearview did not have a reasonable purpose for collecting, using and disclosing personal information was reasonable. The ABKB also considered whether the Commissioner’s interpretation of the exceptions to the consent requirement under PIPA was reasonable. Clearview argued that the “publicly available” exception under PIPA should be broadly interpreted to include, among other things, social media. Ultimately, the ABKB concluded that the Commissioner’s interpretation was reasonable. The Joint Commission relied on the principle that, because privacy legislation is quasi-constitutional, the rights should be interpreted broadly and the restrictions on those rights narrowly. The Court found the Commissioner’s interpretation reasonable.

The Joint Commission’s Narrow Interpretation Rendered the Exception Unconstitutional

Clearview argued that PIPA created a blanket prohibition on collection, use and disclosure of personal information on the Internet, violating their section 2(b) Charter rights. The ABKB agreed. The ABKB found that Clearview’s services were expressive and that the restriction of scraping personal information on the Internet was overbroad by limiting valuable expressive activity like operating a search engine. The ABKB decided that the appropriate remedy was to strike the words “including, but not limited to magazines, books, and newspapers” from PIPA Regulation at Section 7 and leaving the word “publication” to be interpreted as its ordinary meaning, as something that is made public. This remedy allows personal information posted to the Internet without any restrictions to be used without being subject the consent requirements under Alberta’s PIPA.

Key Takeaways

This case demonstrates that AI programs using publicly available information on the Internet, such as Clearview’s “scraping” bots, may be afforded constitutional protection, however, extraterritorial organizations are not exempt from PIPA where there is a real and substantive connection to Alberta. Notably, ABKB’s broadening of the publicly available exception does not provide a free license to repurpose publicly available images or personal information for an unrelated or intrusive purpose that a person would not find reasonable in the circumstances. It is critical that organizations leveraging data scraping or operating in a data-heavy sector review their consent practices and re-evaluate their reliance on “public” data in light of this decision.

For more information about AI and privacy compliance in Canada, please contact Lisa R. Lifshitz, Roland Hung or Laura Crimi of Torkin Manes’ Technology and Privacy & Data Management Groups.

 *The authors would like to thank Torkin Manes’ Articling Student Noah Beiles for his invaluable contributions in preparing this insight.