Skip to Content Subscribe My Account Manage My Subscriptions FAQ Newsletters Canada Canadian True Crime Canadian Politics Health World Israel & Middle East Financial Post NP Comment Longreads Puzzmo Diversions Comics NP News Quiz New York Times Crossword Horoscopes Life Eating & Drinking Style Sponsored Play for Ontario Travel Travel Canada Travel USA Travel International Cruises Travel Essentials Culture Books Celebrity Movies Music Theatre Television Business Essentials Advice Lives Told Tails Told Shopping Buy Canadian Home Living Outdoor Living Kitchen & Dining Tech Style & Beauty Personal Care Entertainment & Hobbies Gift Guide Travel Guide Amazon Prime Day Deals Savings National Post Store More Sports Hockey Baseball Basketball Football Soccer Golf Tennis Driving Vehicle Research Reviews News Gear Guide Obituaries Place an Obituary Place an In Memoriam Classifieds Place an Ad Celebrations Working Business Ads Archives Healthing Epaper Manage Print Subscription Profile Settings My Subscriptions My Offers Newsletters Customer Service FAQ Newsletters Canada World Financial Post NP Comment Longreads Puzzmo Diversions Life Shopping Epaper Manage Print Subscription HomeNewsTech9 million faces exposed in ClarityCheck leak. How many of the photos were Canadian is unknownClarityCheck lets a stranger upload your photo and get back your name. A University of Ottawa privacy chair says Canadians have almost no way to get one removedLast updated 10 minutes ago Group of men and women in a collage. Photo by SIphotography /Getty Images/iStockphotoA company that sells the ability to identify a stranger from a photograph left more than nine million files unsecured online, a researcher found.Enjoy the latest local, national and international news.Exclusive articles by Conrad Black, Barbara Kay and others. Plus, special edition NP Platformed and First Reading newsletters and virtual events.Unlimited online access to National Post.National Post ePaper, an electronic replica of the print edition to view on any device, share and comment on.Daily puzzles including the New York Times Crossword.Support local journalism.Enjoy the latest local, national and international news.Exclusive articles by Conrad Black, Barbara Kay and others. Plus, special edition NP Platformed and First Reading newsletters and virtual events.Unlimited online access to National Post.National Post ePaper, an electronic replica of the print edition to view on any device, share and comment on.Daily puzzles including the New York Times Crossword.Support local journalism.Create an account or sign in to continue with your reading experience.Access articles from across Canada with one account.Share your thoughts and join the conversation in the comments.Enjoy additional articles per month.Get email updates from your favourite authors.Create an account or sign in to continue with your reading experience.Access articles from across Canada with one accountShare your thoughts and join the conversation in the commentsEnjoy additional articles per monthGet email updates from your favourite authorsSign In or Create an AccountorClarityCheck sells reverse image searches. A user uploads a photo and the site returns names, social profiles and where else the image appears online. Canadian visitors are quoted $1.69 for a seven-day trial and $38.99 every 28 days after that.The company also sells lookups on phone numbers, email addresses, vehicle identification numbers, names and businesses. Its homepage says it can “identify unknown callers, verify online contacts, check photos, and decode vehicles using publicly available data from trusted sources.”Get a dash of perspective along with the trending news of the day in a very readable format.By signing up you consent to receive the above newsletter from Postmedia Network Inc.A welcome email is on its way. If you don't see it, please check your junk folder.The next issue of NP Posted will soon be in your inbox.We encountered an issue signing you up. Please try againCybersecurity researcher Jeremiah Fowler found 9,042,977 image files in unsecured cloud storage belonging to the company, in folders labelled faces and profiles. The images included adults, teenagers and children, he wrote in a report published by ExpressVPN.The site is offered in more than 20 languages and prices its trial separately for the United States, Britain, the European Union, Australia and Canada. How many of the images were Canadian is unknown.The people in those folders are not the customers. They are the people being looked up. ClarityCheck’s image search page says the subject of a search will never be notified, and the company will pull a phone number or an email address from its results on request. It has no equivalent for a photograph.“If you’re trying to find out who a person is, you might not have authorization or permission, so people might not know that their image had been dumped into this database that was public,” Fowler told Wired magazine.A scammer holding those images could identify someone, build a fake profile and approach their friends and family as that person, his report said. A face cannot be reset the way a password can. ClarityCheck’s about page says its services “must not be used to stalk, harass, dox, or monitor any person.”Fowler found the storage in early April, he said in an email to National Post. Most of the ClarityCheck addresses he tried bounced, and messages he sent through the company’s customer support did not reach the right people, he wrote. Public access was not restricted until July, after Wired contacted the company.A ClarityCheck spokesperson told Wired access “required knowledge of a specific, unindexed URL that was not discoverable through ordinary use of the ClarityCheck service or a general web search.” The company said the files included duplicates, resized copies and non-image data rather than nine million unique images.Fowler wrote that he did not see duplicate, cropped or resized images in the sample he reviewed, though he was not claiming they were absent. The storage URL appeared in code on ClarityCheck’s own website, Wired reported.Teresa Scassa, the Canada Research Chair in Information Law and Policy at the University of Ottawa, said Canadian law puts a duty on companies to protect the personal information they hold. “I don’t think that that would qualify as meeting that duty or that obligation,” she said.The company is registered in Delaware. Its reverse image search page tells Canadian visitors it handles personal information under the Personal Information Protection and Electronic Documents Act, Canada’s private sector privacy law. It points them to the opt-out in its terms, which works by sending a one-time code to the number or address being removed.Scassa said the law reaches the company regardless, and that it keeps separate privacy policies for American, British and European users. “All that’s required for PIPEDA to apply is for there to be that real and substantial connection,” she said.The only control on an upload is a box the user ticks confirming they own the image or appear in it. Canada’s privacy commissioner examined that model in 2024. It found Pornhub’s owner, Aylo, could not rely on uploaders to confirm consent, even though Aylo checked government identification against a live face scan.Scassa said the comparison holds, with a caveat. Intimate images are far more sensitive than a photograph, she said, so ClarityCheck’s position is less serious than Aylo’s. “I still don’t think it’s adequate consent. They should have something more than that.”A Canadian who suspects their face is in there can ask the company what it holds on them, and it has to answer, Scassa said. Finding out would likely mean handing over a fresh photograph to search against. If the company has something, they can ask for it to be deleted, and Bill C-36, tabled in June, would make that right clearer, she said.Beyond that the privacy commissioner can investigate and issue findings, Scassa said, but they are not binding, and any Federal Court order would have to be enforced through an American court.Fowler’s report quotes ClarityCheck’s terms setting a 14-day retention period for uploaded images. The terms now say seven days and carry a July 28 update. It appears the company edited them after his disclosure, Fowler wrote.ClarityCheck’s FAQ says it does not provide facial recognition. Marketing copy on the same page describes face recognition and facial recognition search. A Wired reporter who uploaded their own face was shown the phrases scanning facial landmarks and mapping unique face geometry.ClarityCheck did not answer questions from National Post by deadline. Five replies came back from customer support on Friday, each signed with a different first name, saying the questions had been routed to the responsible team.The company said in an email over the weekend that the questions reached its escalations team late on Friday and would need input from its legal, engineering and product teams. It asked until Aug. 28 for written answers. The Office of the Privacy Commissioner did not respond.Fowler wrote that he saw nothing in the images showing where they came from. He did not report the exposure to a Canadian regulator because the company is registered in the United States.The one way to find out runs through the company itself. “You won’t know if you’re in the database until you get in the database,” Scassa said.Our website is the place for the latest breaking news, exclusive scoops, longreads and provocative commentary. Please bookmark nationalpost.com and sign up for our newsletters here. Join the Conversation This website uses cookies to personalize your content (including ads), and allows us to analyze our traffic. Read more about cookies here. By continuing to use our site, you agree to our Terms of Use and Privacy Policy.