Face search websites can help protect your privacy, but they can also be abused. Try these steps to protect yourself.
I recently handed over a selfie and a digital copy of my driver's license to a company I don't trust, the face image search engine PimEyes.
I did this to find and delete myself from the PimEyes searchable Rolodex of faces. The free website scans through billions of images from the internet and finds matches of your photo that could have appeared in a church bulletin or a wedding photographer's website.
PimEyes says it empowers people to find their online images and try to get unwanted ones taken down. But PimEyes face searches are largely open to anyone with either good or malicious intent.
People have used PimEyes to identify participants in the Jan. 6, 2021, attack on the Capitol, and creeps have used it to publicize strangers' personal information from just their image.
The company offers an opt-out form to remove your face from PimEyes searches. I did it and resented spending time and providing even more personal information to remove myself from the PimEyes repository, which we didn't consent to be part of in the first place.
The increasing ease of potentially identifying your name, work history, children's school, home address and other sensitive information from one photo shows the absurdity of America's largely unrestrained data-harvesting economy.
You can take measures to protect your privacy -- I'll suggest a couple for your images -- but individuals are outgunned.
Privacy and security experts were divided on whether it's worth opting out of PimEyes. I'll share my experience and reporting so you can decide for yourself.
How PimEyes works
The website is conceptually similar to Google, except you're searching for faces from across the web instead of information.
Give PimEyes a digital photo of yourself, and the results show slightly blurred snapshots of your image that have appeared on publicly available websites, blogs, online photo albums and more.
PimEyes says you can only use a photo of yourself, although nothing stops you from searching with someone else's image. The results don't include names, just images and previews of links where those images appeared. You can still learn a lot about people.
When I did a free search with my own photo, the more than 100 results of my image were mostly innocuous and not entirely surprising because I put my face out there for my job. It was still unnerving.
Skip to end of carousel
Shira Ovide
(Patrick Dias for The Washington Post)
Tech Friend writer Shira Ovide gives you advice and context to make technology work for you. Sign up for the free Tech Friend newsletter.
End of carousel
There I was in a digitized copy of a college alumni magazine article that I hadn't seen before, from a snapshot of a panel discussion.
The PimEyes search dug up my roughly 15-year-old employee ID photo from a Japanese-language blog post that dissected technology reporting at the Wall Street Journal, where I worked at the time.
The moment I freaked out was seeing a handful of identical images of me in my living room.
They looked like they had been snapped from a laptop webcam, and a text box warned that a couple of the links with my image were "potentially explicit" results.
Though I was sure I was fully clothed in those images, I felt nervous. I paid PimEyes $14.99 plus taxes for an extra feature to click on the links to where the screenshots had appeared.
After hunting around, I believe the image came from a large web video call in early 2020 that someone Zoom-bombed to display pornographic images. They presumably took a screenshot of the participants, and the image of our tiny heads catapulted to random websites.
The working web links with my Zoom snapshot appeared relatively harmless. One showed a person from a 2021 party wearing what I assumed was a Zoom-themed costume with my face on it.
No biggie, I guess, but I felt vulnerable seeing publicly available images snapped without my knowledge from inside my home.
The results don't include everything. PimEyes says it skips social media sites when scanning for images. I didn't find images from The Washington Post website, where my photo appears with my articles.
My face is more public than most, but other people have found in PimEyes images of themselves from wedding photographer's websites, music festivals, and from the background of other people's airport snapshots.
PimEyes CEO Giorgi Gobronidze said in an email that the company "developed a service to locate and remove unauthorized photos for individuals who wish to protect their privacy."
He noted that PimEyes is assembling images that already exist online and pointing you to them. Gobronidze also said PimEyes has technical protections to block photo searches of children.
But Adam Schwartz, privacy litigation director of the consumer advocacy group Electronic Frontier Foundation, said PimEyes and technologies like it are "deeply, deeply dangerous" because they destroy anonymity and can be easily abused.
You only have one face, he said. Technologies that make your photos easily searchable can enable stalking or fake pornography in your likeness.
Schwartz and other digital privacy experts worry about the range of technologies making it easier to find and use sensitive information about you. (Gobronidze said the search engine "does not target individuals but instead focuses on publicly accessible websites.")
The news organization 404 Media wrote last month about two Harvard University students who rigged internet-connected glasses with custom software linking to PimEyes, face detection software, databases of personal information and artificial intelligence-generated summaries.
The students, AnhPhu Nguyen and Caine Ardayfio, showed they were able to capture images of strangers with the glasses and identify names, addresses, work information, family members' names and middle school photos.
The students' experiment shows "how easy it is to create an efficient surveillance apparatus," said Severin Engelmann, who focuses on the ethics of facial analysis AI at the Digital Life Initiative affiliated with Cornell University.
The students' personal identification wasn't accurate for everyone. Nguyen and Ardayfio told me they wanted to highlight the privacy risks of emerging technologies and offered instructions to opt out of PimEyes and other databases. They didn't make public their customized people-identifying technology.
Gobronidze said PimEyes banned several accounts associated with the students for misusing the company's technology. He said what the students did with PimEyes wouldn't be possible on a large scale.
How to delete your face from PimEyes, and the gaps
PimEyes lets anyone request their removal from the search database. If you do so, searches on PimEyes with your photo shouldn't return images of you. The opt-out doesn't delete the photos of you from the websites from which PimEyes compiled them.
To opt out, you give PimEyes at least one photo of yourself plus a digital copy of a passport or ID with personal details obscured.
I did this by scanning my driver's license with my phone's Google Drive app and using Microsoft's Photos computer software to put black digital ink over my address, date of birth and license ID number.
Within about 48 hours, PimEyes confirmed that search results of my face were removed from its system. The email said I might need to repeat the opt-out with more photos. Gobronidze said PimEyes doesn't keep the information you provide to opt out.
Some digital privacy experts said it's worth opting out of PimEyes, even if it's imperfect, and that PimEyes probably legitimately needs a personal photo and proof of identity for the process.
Others found it "absurd" to provide more information to PimEyes, as Engelmann said, or they weren't sure opting out was the best choice.
Shauna Dillavou, CEO of Brightlines, which helps people remove potentially risky online information, suggested skipping the PimEyes opt-out. The site can be helpful for finding your online images.
Instead, Dillavou recommended searching Google Images for your name. If you see unexpected online photos, or something like an image you took for an online review that includes your email address, Dillavou suggested scrubbing the information from accounts you can access. Information like an email address can be a gateway to find more personal details, Dillavou said.
Chris Gilliard, who researches digital privacy and is co-director of the Critical Internet Studies Institute, said it's worth being careful about posting images anywhere online that include your children, friends or strangers. It's an unfair responsibility, but Gilliard said images could be used to train artificial intelligence or to erode others' privacy in ways you can't anticipate.
Experts said the fundamental problem is how much information is harvested and accessible without your knowledge or consent from your phone, home speakers, your car and information-organizing middlemen like PimEyes and data brokers.
Nathan Freed Wessler, an American Civil Liberties Union attorney focused on privacy litigation, said laws need to change the assumption that companies can collect almost anything about you or your face unless you go through endless opt-outs.
"These systems are scary and abusive," he said. "If they're going to exist, they should be based on an opt-in system."
Once your information is loose, it's difficult to pull it back. Nearly a month after PimEyes said it removed me from its face repository, I repeated a search with another photo. The PimEyes results had two images of me.
