Article 5(1)(e) prohibits the placing on the market, the putting into service or the use of AI systems for the purpose of creating or expanding facial recognition databases through the untargeted scraping of facial images from the internet or CCTV footage. The prohibition targets mass, indiscriminate collection. It does not, by its wording, prohibit every collection of a facial image, and targeted collection for a defined lawful purpose follows a different analysis, although data protection law, biometric rules in Annex III, and other law can still apply. The word untargeted and the purpose of creating or expanding a database are the elements to test.
What collection does point (e) prohibit?
Point (e) describes AI systems used to create or expand facial recognition databases by scraping facial images without targeting. Untargeted scraping means collecting facial images broadly, without a defined target, purpose or selection criterion that limits the collection to identified persons or a defined set. Scraping the internet for facial images at scale, or harvesting CCTV footage indiscriminately to build a database of faces, illustrates the pattern. The database element matters: the purpose must be creating or expanding a facial recognition database. Collection for a different, defined purpose, with selection criteria that limit whose images are collected and why, needs a separate analysis, but the burden is on the record to show the targeting and the purpose, not to assert them.
What does untargeted mean for a real collection?
Untargeted is assessed on the collection method, not on the size of the database alone. A large database built from targeted, consented or lawfully obtained images for a defined purpose is not automatically untargeted scraping. A small collection built by scraping every face from a public source, without selection, can be untargeted even if the resulting database is modest. The record should describe the sources, the selection criteria, the filters applied, the volume collected, the retention, and the purpose of the database. Where images are collected from the internet, the record should state which sites or feeds were used, what was excluded, and how the exclusion was enforced, because an absence of filters is evidence of untargeted collection.
For the broader regulatory framework, see prohibited practices under Article 5.
What about CCTV footage?
CCTV footage is named separately in point (e), because facial images captured by cameras in public or semi-public spaces can be harvested at scale without the person's knowledge. Using CCTV footage to build or expand a facial recognition database through untargeted scraping is prohibited in the same way as internet scraping. Using CCTV for a defined, targeted purpose, such as identifying a specific person in a specific investigation under lawful authority, follows a different analysis and must be tested against the applicable law enforcement, data protection and Annex III rules. The distinction is not the camera: it is the targeting, the purpose, and the database being built. A system that continuously enrols every face seen by a camera into a database needs particular care.
How does point (e) relate to biometric identification?
Point (e) concerns the creation or expansion of the database. Separate provisions concern the use of that database. Remote biometric identification in publicly accessible spaces for law enforcement is addressed in point (h), with narrow exceptions. Biometric identification and categorisation uses in Annex III can be high-risk. A database built lawfully can still be used unlawfully, and a database built through untargeted scraping is tainted at creation even if a later use looks targeted. Teams should therefore assess collection and use separately, and should not assume that a database obtained from a supplier is lawful merely because the supplier supplied it. Supplier due diligence should include the collection method and the purpose for which the database was built.
What due diligence should buyers and builders do?
A builder should document the source of every facial image set, the licence or lawful basis claimed, the selection criteria, and the steps taken to exclude untargeted material. A buyer should request the same information from the supplier, including whether the database was built by scraping, and should record the supplier's answers and any verification performed. Contracts should require disclosure of collection methods and should prohibit supply of databases built by untargeted scraping. Where the supplier cannot or will not disclose the collection method, the buyer should treat the database as unassessed and should not deploy it for identification purposes until the position is clarified with qualified advice.
Continue with real-time remote biometric identification.
What is left open by this guide?
This guide explains the elements of point (e) in outline. It does not decide whether any particular collection, database or supplier is within the prohibition, or whether a collection counts as targeted. Those questions need the sources, the selection criteria, the purpose, and the database design, read against the consolidated text and data protection law. Facial recognition databases carry high stakes for the people whose images are collected, often without their knowledge, so borderline collection practices should be confirmed with a competent authority or legal adviser before the database is created, expanded or used.
Frequently asked questions
Is collecting any facial image from the internet prohibited?
No, not by point (e) alone. The prohibition targets creating or expanding facial recognition databases through untargeted scraping. Targeted collection for a defined purpose follows a different analysis, although data protection and other laws can still apply and must be checked.
Does point (e) apply to a database bought from a supplier?
Yes, in substance. The prohibition covers placing on the market, putting into service or use of AI systems for the prohibited purpose. A buyer that uses a database built by untargeted scraping should assess the collection method and should not assume supplier supply makes the database lawful.
Is using CCTV to identify one specific person prohibited by point (e)?
Not necessarily by point (e). The question is whether the use creates or expands a facial recognition database through untargeted scraping. A targeted identification for a defined lawful purpose is a different pattern, governed by other provisions including point (h) and Annex III, which must be checked separately.
Continue through this AI Act cluster
This article is an informational overview, not a legal determination. Check the current legal text and official implementation guidance for your system and role.
Consolidated Regulation (EU) 2024/1689 ↗AI Act Service Desk timeline ↗European Commission regulatory framework for AI ↗