AI company deletes the 3 million OKCupid photos it used for facial recognition training

When online platforms violate their own privacy policies to sell your photos, have no fear: They just might have to pay an undisclosed settlement fee 12 years later. (Who says justice is dead?) According to Reuters, AI company Clarifai says it has deleted 3 million profile photos taken from dating site OkCupid in 2014. It follows a settlement reached last month between the FTC and Match Group, OkCupid’s owner.

The Delaware-based Clarifai reportedly certified the data deletion to the FTC on April 7. The company also confirmed to US Representative Lori Trahan (D-MA) that it deleted any models that trained on the data. Clarifai told the representative’s office that it hadn’t shared the data with third parties.

The FTC opened the investigation in 2019, after The New York Times reported that Clarifai had built a training database using OkCupid dating profile photos. The behavior was a direct violation of OkCupid’s privacy policy. Court documents reviewed by Reuters reveal that Clarifai asked OkCupid executives for the data in 2014. Apparently, they obliged.

“We’re ⁠collecting data now and just realized that OkCupid must have a HUGE amount of awesome data for this,” Clarifai founder Matthew Zeiler wrote in an email to OkCupid co-founder Maxwell Krohn. The AI startup used the dating site’s images to build a facial recognition service that can identify a person’s age, gender and race. (Another brilliant and totally ethical idea from Clarifai, tapping into unsecured city surveillance cameras without authorization, was reportedly shuttered.)

Zeiller suggested to The New York Times in 2019 that people needed to, well, get over it. “There has to be some level of trust with tech companies like Clarifai to put powerful technology to good use, and get comfortable with that,” the AI founder declared. Some of OkCupid’s founders were reportedly investors in Clarifai.

As part of the settlement, the FTC “permanently prohibited” OkCupid from misrepresenting its data collection and privacy controls. TechCrunch notes how strange it is to use that as a penalty, given that FTC rules already bar that behavior.