Anyone can use this powerful facial-recognition tool — and that’s a problem.

Let’s Explain why PimEyes.com is so scary.

If you upload a picture of your face to PimEyes’ website, it will immediately show you any pictures of yourself that the company has found around the internet. You might recognize all of them, or be surprised (or, perhaps, even horrified) by some; these images may include anything from wedding or vacation snapshots to pornographic images.

PimEyes is open to anyone with internet access. It’s a stark contrast from Clearview AI, which became well-known for building its enormous stash of faces with images of people from social networks and limits its use to law enforcement (Clearview has said it has hundreds of such customers).

PimEyes’ decision to make facial-recognition software available to the general public crosses a line that technology companies are typically unwilling to traverse, and opens up endless possibilities for how it can be used and abused.

Imagine a potential employer digging into your past, an abusive ex tracking you, or a random stranger snapping a photo of you in public and then finding you online. This is all possible through PimEyes: Though the website instructs users to search for themselves, it doesn’t stop them from uploading photos of anyone. At the same time, it doesn’t explicitly identify anyone by name, but as CNN Business discovered by using the site, that information may be just clicks away from images PimEyes pulls up.

“Using the latest technologies, artificial intelligence and machine learning, we help you find your pictures on the Internet and defend yourself from scammers, identity thieves, or people who use your image illegally,” the website declares.

PimEyes lets users see a limited number of small, somewhat pixelated search results at no cost, or you can pay a monthly fee, which starts at $29.99, for more extensive search results and features (such as to click through to see full-size images on the websites where PimEyes found them and to set up alerts for when PimEyes finds new pictures of faces online that its software believes match an uploaded face).
The company offers a paid plan for businesses, too: $299.99 per month lets companies conduct unlimited searches and set up 500 alerts.

The images come from a range of websites, including company, media and pornography sites — the last of which PimEyes told CNN Business that it includes so people can search online for any revenge porn in which they may unknowingly appear.

Shrouded in secrecy
To learn more about how PimEyes works, and why it’s open to anyone, as well as who’s behind it. This was much trickier than uploading my own face to the website. The website currently lists no information about who owns or runs the search engine, or how to reach them, and users must submit a form to get answers to questions or help with accounts.

Using the Internet Archive’s Wayback Machine, as well as other online sources, yielded some details about the company’s past and how it has changed over time.

The Pimeyes.com website was initially registered in March 2017, according to a domain name registration lookup conducted through ICANN (Internet Corporation for Assigned Names and Numbers). An “about” page on the Pimeyes website, as well as some news stories, shows it began as a Polish startup.

An archived image of the website’s privacy policy indicated that it was registered as a business in Wroclaw, Poland, as of August 2020. This changed soon after: The website’s privacy policy currently states that PimEyes’ administrator, known as Face Recognition Solutions Ltd now operate the site. This suggests that, while it may be registered on the European Union list of tax havens, it may be operating elsewhere.

In June 2020, some news articles noted how PimEyes may be used by stalkers. In one piece, PimEyes told the BBC that the website’s aim was to help individuals “fight for their own online privacy,” including finding fake profiles, leaked images, and unauthorized photo usage. At the time, it also told the BBC that it worked with police forces via a software investigation tool called Paliscope (and an archived version of the PimEyes’ website’s “Frequently Asked Questions” indicated that PimEyes marketed to law enforcement as recently as that month; though that reference was gone a few days later, a company blog post suggests PimEye’s technology can be used to “look for criminals or missing persons.”)

In early July, the website suddenly emphasized personal privacy. “Upload your photo and find where your face image appears online. Start protecting your privacy,” PimEyes’ site said at the time.

This kind of AI-driven image-matching is different from what happens when you upload a picture of yourself to a site such as Google Images and conduct a search: There, the results will include pictures of similar people (for me, that means lots of dark-haired women in glasses), but Google isn’t using facial measurements in the hopes of finding you, specifically, in other pictures online.

When PimEyes’ search engine finds a match between the photo a user uploads and one PimEyes has previously seen online, it can pair the measurements of the previously analyzed photo with the web address where that photo is located. The website shows you an array of all the pictures it thinks look most like your own photo.

The search accuracy, the company claimed, is about 90%; in general, the accuracy of facial-recognition technology depends on many factors, such as the quality of face images that are fed into a system.

Connecting names and faces

It could also result in plenty of users misidentifying the faces that the search engine thinks closely resemble the person they’re trying to find, the consequences of which could be enormous. Police already use facial-recognition systems to track down potential suspects, even though the technology has been shown to be less accurate when identifying people of color. Several Black men, at least, have been wrongfully arrested due to this use of facial recognition.