On February 18, 2026, the British Columbia Court of Appeal (the “BCCA”) dismissed Clearview AI’s (“Clearview” or the “Company”) appeal and affirmed the BC privacy commissioner’s Order (and its affirmation by the lower BC Court) that foreign based companies cannot escape Canadian privacy laws when they collect, use and disclose the personal information of Canadians.
Notably, the BCCA found that collection of personal information of BC residents was sufficient to create a real and a substantial connection between the foreign entity and the province, such that BC’s privacy law properly applied to foreign entity.
The BCCA also upheld the interpretative approach of the BC privacy commissioner, holding that due to the “quasi-constitutional nature” of privacy laws, a narrow interpretation to exceptions to having to obtain consent from data subjects is reasonable.
Background
In early 2020, following media reports that US-based Clearview was marketing its facial recognition services to Canadian clients (chiefly law enforcement), the privacy commissioners of British Columbia (the “BC Privacy Commissioner”), Alberta (the “AB Commissioner”), Québec, and Canada (collectively, the “Commissioners”) launched a joint investigation into whether Clearview was violating privacy laws in their respective jurisdictions. During the investigation, Clearview voluntarily withdrew from the Canadian market.
In February 2021, the Commissioners issued a joint investigation report (the “Report”) concluding that Clearview had violated privacy laws in their respective jurisdictions, by inter alia failing to seek consent, and using personal information of Canadians for an inappropriate purpose (i.e., using the screen-scraped images of Canadians for facial recognition to offer services to law enforcement). The Commissioners recommended that Clearview cease offering its tool in Canada, stop collecting images and biometric data from Canadians, and delete such information in its possession.
In response to the Report, Clearview stated it had already ceased offering services in Canada since summer 2020 and was willing to continue this for 18 months, but claimed it was impossible to identify and delete images of Canadians from photographs alone. The BC Commissioner rejected this argument, and in December 2021, issued a binding order under the British Columbia Personal Information Protection Act (the “BC PIPA”) requiring Clearview to: (a) cease offering its facial recognition services to clients in British Columbia; (b) make best efforts to cease collecting, using, and disclosing images and biometric facial arrays from British Columbians without consent; and (c) make best efforts to delete such images and biometric data in its possession (the “BC Order”).
Clearview sought judicial review of the BC Order, seeking a declaration that it was unreasonable and an order quashing it. Among other things, Clearview argued that the BC Commissioner erred by concluding that BC PIPA applied to Clearview at all.
On December 18, 2024, the British Columbia Supreme Court (“BCSC”) found that BC PIPA applies to Clearview despite its U.S. base and having only a virtual presence and sales in Canada.
Clearview appealed, and on February 18, 2026, the BCCA unanimously upheld the BCSC’s decision.
The BCCA held that BC PIPA is constitutionally applicable to Clearview as there is a “real and substantial” connection between Clearview and the province. Despite Clearview having ceased its marketing activities in B.C. in July 2020, the BCCA found it continued to acquire facial images of individuals in BC after that time.
In considering the “real and substantial” connection test, the Court appeared to modernize the test for the digital age. The Court emphasized that the technological advances that have led to the proliferation of companies whose business model is based on acquiring information from global internet sites have significantly reduced the importance of traditional factors such as physical location, whether of content providers, servers, or end users. As a result, the Court engaged in a contextual inquiry into the relationship between jurisdiction (BC), the subject matter of the law (PIPA’s privacy protections), and the regulated entity (Clearview) and determined that “BC’s relationship to Clearview is substantial, not incidental.”
Key to this determination was that Clearview’s services depended on its ability to collect facial images from individuals around the world to build its database, and that because it was unable to exclude BC from its scraping activities, that meant that “Clearview’s access to BC (and every other jurisdiction) is essential to its operation.”
In addition, the BCCA concluded that the BC Commissioner’s interpretation of BC PIPA was reasonable and that the BC Order was enforceable.
Similarly in Alberta, the AB Commissioner found Clearview’s response to the Report to be unacceptable. On December 7, 2021 it issued an order (the “AB Order”) with similar requirements to those in the BC Order.
Clearview applied to the Alberta Court of King’s Bench (“ABKB”) to quash the AB Order claiming that the Company is not subject to Alberta’s Personal Information and Protection Act (“AB PIPA”) and that the AB Commissioner’s finding that Clearview did not have reasonable purpose for collecting, using and disclosing personal information is unreasonable. Clearview argued that the Order was unenforceable because it claimed it was impossible to identify which images in its database belonged to Alberta residents.
On May 8, 2025, the ABKB dismissed Clearview’s application, finding that Clearview iss subject to AB PIPA.
Takeaways
For businesses operating in the digital space, these decisions send a clear message: when an individual posts something online, that individual has not forfeited control over how that information is used. Canadians are not required to become “digital recluses” to maintain their privacy.
Furthermore, the BCCA has provided strong support for the territorial and substantive reach of Canadian privacy laws. In both BC and AB, the absence of a physical presence in the province will not render a foreign-based organizations immune from the application of those provinces’ privacy laws where a “real and substantial” connection to the province is found.
In assessing the “real and substantial” connection issue, historical questions of what assets are located where will be of less importance than factors such as the location of sales, the location of the data subjects, and the location of customers.
Currently, the decisions are limited to Alberta and BC, however they set a strong precedent nationwide. The reach of the federal privacy law, PIPEDA, remains somewhat of an open question as, unlike the BC and Alberta privacy commissioners, the federal privacy commissioner lacks the power to directly issue orders. However, with amendments to PIPEDA expected soon, it is likely that such order-making powers will be incorporated into such amendments, and the BC and Alberta court rulings would provide a strong basis for the extraterritorial application and enforcement of PIPEDA.
US and other foreign-based companies which have sheltered behind the belief that because they lack a physical presence in Canada they are immune from Canadian privacy laws should revisit their assessment of whether they have a “real and substantial” connection to Canada, and where they have exposure, revisit their privacy program to ensure it complies with Canadian privacy laws.
For organizations with significant data holdings sourced from Canadian data subjects, it would be prudent to undertake a similar exercise to determine whether the continued use of such data creates unreasonable risk to the organization. This will be particularly true for organizations using web scraping, AI training data, or biometric technologies, higher risk areas which generally require consent.
For more information on this topic, please contact Kirsten Thompson, Rachel Macklin or other members of the Dentons Privacy and Cybersecurity group.
