On March 10, Vermont’s attorney general, T.J. Donovan brought the first enforcement action under the state’s data broker law.  According to the OAG’s press release, the suit was initiated against “Clearview AI, a data broker that uses facial recognition technology to map the faces of Vermonters, including children, and sells access to this data to private businesses, individuals, and law enforcement.” Clearview AI, which has registered as a data broker, has been accused of violating the Vermont Consumer Protection Act and the Data Broker Law.

The attorney general “alleges that Clearview AI has been collecting photos of Vermonters available on the internet – called ‘screen scraping’ – and using artificial intelligence to ‘map’ individual’s faces. Private businesses, individuals, and law enforcement use this data via an app that allows a user to identify a person within seconds using only a photograph. No Vermont state or local law enforcement agencies have used the app. Clearview AI collects the facial recognition data of Vermont children, as well as adults, without their notice or consent.”

As summarized in a Hunton blog, Clearview,

scraped photographs of individuals from public websites, amassing a database of 3 billion photographs. The complaint further alleges that Clearview engaged in unfair and deceptive business practices, in violation of Vermont consumer protection law, when it used the scraped photographs in its facial recognition app, which it made available to numerous for-profit corporations despite representations on its website that the app was open only to law enforcement and not available to the public. The complaint also alleges numerous misrepresentations in Clearview’s privacy policy, including those regarding data security and consumer rights with respect to personal information. In addition to unfair and deceptive business practice claims, the Vermont Attorney General alleged that Clearview’s use of scraping technology to acquire individual’s photographs violated a provision of Vermont’s data broker law that prohibits “fraudulent acquisition of brokered personal information.” The complaint seeks injunctive relief and restitution, as well as civil penalties of $10,000 for each violation of the Vermont Consumer Protection Act, and $10,000 for each violation of Vermont’s Fraudulent Acquisition of Data Law.