Last week the Court of Appeal of England and Wales heard Clearview AI's challenge to the Information Commissioner's 2022 enforcement action, which imposed a penalty of about £7.5 million and ordered the US company to stop processing, and to delete, data on UK residents. The procedural path has been unusually winding: in October 2023 the First-tier Tribunal held that the ICO lacked jurisdiction, and on 6 October 2025 the Upper Tribunal reversed key parts of that finding. The three-day hearing opened on 19 October 2026. The core question is whether scraping, storing and indexing facial images amounts to "monitoring" the behaviour of people in the UK, which would bring a non-UK company within the regulation's territorial reach. Clearview argues it is not itself a behavioural monitor, that possible misuse by clients cannot create jurisdiction, and that the deletion order would put it out of business; the ICO, supported by Privacy International as intervener, answers that collecting and organising images is monitoring in its own right, whoever ultimately uses the results. No judgment date has been set.

In my view, this is one of the most important territorial-scope cases in UK data law since Brexit! I find the ICO's reading the more convincing one; a test that asks only whether the foreign company itself analyses behaviour would let any data broker escape scrutiny by leaving the "analysis" to its customers. Yet I also see a gap: the state-immunity angle, raised because Clearview's clients are often public bodies, remains underdeveloped, and courts have yet to explain when a contractor can shelter behind a sovereign client. There is also a practical lesson about enforcement. Regulators in several EU states have already applied the equivalent EU rule to Clearview and, according to Privacy International, the company has neither complied nor appealed; jurisdiction on paper means little without a route to collection. I believe non-UK vendors offering scraping, profiling or measurement tools should treat this appeal as a live compliance risk now, not after the judgment!

Source: Biometric Update, 20 October 2026; Resultsense, 20 October 2026