At the FTC's request, Clarifai destroyed 3 million OkCupid user photos leaked for AI training

Clarifai deleted 3 million photographs of OkCupid dating platform users, which the platform provided to the company to train facial recognition algorithms. The deletion became a condition for settling claims from the U.S.

Federal Trade Commission. Details of the case were revealed in court documents. The story began in 2014.

Clarifai — one of the pioneers in computer vision — approached OkCupid with a request to provide user data. The platform agreed and provided millions of photographs of real people registered on the dating site. The images were used to train a facial recognition model without notifying the users themselves and without their explicit consent.

Court documents revealed a fundamental detail: OkCupid's leaders during that period were themselves investors in Clarifai. This meant a direct conflict of interest — people making the decision to transfer data were personally interested in the success of the recipient company. Such a scheme has long been considered a red flag for regulators in the privacy protection field.

The FTC conducted an investigation and reached a settlement agreement with Clarifai. The key condition was the destruction of all photographs obtained from OkCupid. The company complied with the requirement.

Financial penalties under the agreement were not publicly disclosed. This case fits into a broad wave of proceedings related to the use of personal data for training AI. In the early stages of machine learning development, companies often resorted to data collection methods that are now considered violations of privacy.

Photographs from dating platforms are particularly sensitive: they contain biometric data, are tied to real individuals, and were originally intended for completely different purposes. Clarifai was founded in 2013 and became one of the leading companies in image recognition. The OkCupid incident shows how blurred the line was between "partner data" and unauthorized use of others' information in those years.

The settlement with the FTC does not mean automatic admission of guilt, but signals that the regulator considered the practice problematic. In recent years, the FTC has significantly strengthened oversight of companies collecting biometric data without proper user notification. In parallel, a number of states have passed laws directly prohibiting biometric data collection without explicit consent — most notably Illinois with the BIPA law.

The deletion of three million photographs does not in itself restore violated privacy. The data was already used in training the model, and the result of that training has not disappeared. This is the key contradiction of all such settlements: destroying a dataset does not erase the patterns that the algorithm managed to extract from it.

This is why digital rights experts insist that the real solution should be a ban on using such data from the start, not their subsequent deletion. For the industry, this case is another reminder that data collection practices that seemed neutral ten years ago are now classified as violations. Companies developing AI increasingly face retroactive claims for decisions made in the early days of machine learning.