Unchecked Surveillance: The PimEyes Face-Search Dilemma

• PimEyes enables targeted identification of individuals by scanning and measuring facial images scraped from the internet.
• Despite clear prohibitions in the EU AI Act, the service remains fully operational for users in Germany.
• Enforcement of these new regulations has been stalled, leaving the controversial platform online.

Regulatory Landscape and Enforcement

• The EU AI Act explicitly forbids AI systems that create facial recognition databases by indiscriminately scraping internet images.
• The Federal Network Agency (Bundesnetzagentur) is designated as the oversight body for AI regulations in Germany as of summer 2026.
• While the agency has the authority to investigate and impose sanctions—including fines of up to 7% of global annual turnover—it has declined to comment on pending actions against PimEyes.
• Enforcement is complicated by the company's base in Dubai, though experts argue that targeting European payment processors or the leadership could still effectively restrict the service.

Governmental Contradictions

• Civil liberties advocates, including the Chaos Computer Club, warn that such tools facilitate stalking and pervasive mass surveillance.
• In a contradictory move, the German government is pursuing legislation to grant police forces the right to use biometric search engines like PimEyes for criminal investigations.
• Some government officials attempt to bypass the AI Act by arguing the ban only applies when "AI systems" are strictly used, a reading that EU lawmakers and digital policy experts reject as contrary to the legislative intent.