The Unending Stalking Machine: Why PimEyes Persists Despite EU Bans

In an era where privacy is increasingly treated as a relic of the past, the search engine PimEyes stands as a formidable, if controversial, monument to the death of anonymity. With just a single uploaded photograph, any user can scan the furthest, most obscure corners of the internet to find a match. Within seconds, the tool provides a comprehensive overview of where that face—or a strikingly similar one—has appeared online. What was once a daunting task of manual digital sleuthing has been reduced to a simple, automated point-and-click operation.

If the internet is, as The New York Times once famously described it, a "haystack" of infinite data, then PimEyes is the most powerful magnet ever engineered. It is a technology designed to extract human identity from the shadows, making the private public and the obscure visible. Since netzpolitik.org first labeled the platform an "attack on anonymity" six years ago, the legal and social landscape surrounding facial recognition has undergone seismic shifts. Yet, despite being squarely in the crosshairs of the European Union’s landmark Artificial Intelligence Act (AI Act), the machine continues to operate, churning out matches for a monthly subscription fee.

A Chronology of Surveillance: From Niche Tool to Global Controversy

The trajectory of PimEyes reflects the rapid evolution of intrusive technology. Initially launched as a niche search tool, it soon became a favorite for those seeking to identify strangers, track down long-lost acquaintances, or engage in more malicious behavior. The platform’s ownership has changed hands, eventually landing with a Georgian businessman, while its headquarters have allegedly shifted to the tax-haven-adjacent environment of Dubai.

In 2020, the conversation surrounding the tool turned from technological curiosity to human rights alarmism. Security experts and civil rights activists began sounding the siren, pointing out that the tool essentially allows any individual with a credit card to conduct mass, indiscriminate surveillance. By 2022, when the EU began drafting its AI Act, PimEyes became the poster child for the risks associated with biometric data scraping. The European Parliament, motivated by the desire to protect the fundamental rights of citizens, pushed hard for specific prohibitions against the very type of indiscriminate, web-wide facial scanning that PimEyes facilitates.

The AI Act: A Shield Without a Sword?

When the AI Act officially entered its application phase on February 2, 2025, it was hailed as a global gold standard for digital regulation. Article 5 of the regulation explicitly prohibits "AI systems that create or expand facial recognition databases by untargeted scraping of facial images from the internet or surveillance footage."

On paper, this language is a direct strike against PimEyes. The engine works by measuring the biometric distances between eyes, nose, and mouth—the "templates" of a human face—and comparing them against billions of scraped images. It is, by all definitions, an AI-powered system that builds a massive, searchable database of human identities.

However, a critical gap emerged immediately upon the law’s enactment: the lack of enforcement. The regulation requires individual EU member states to designate a national supervisory authority to police these bans. For months, there was a bureaucratic vacuum. While PimEyes continued to charge users approximately €32.90 for the ability to search up to 75 faces per day, regulators were still finding their footing. It was not until the summer of 2026 that the German government finally designated the Federal Network Agency (Bundesnetzagentur) as the official oversight body for AI compliance.

The Enforcement Paradox: Why the Agency Hesitates

The Bundesnetzagentur now holds the legal authority to investigate PimEyes, demand technical audits, and even issue fines amounting to 7% of the company’s global annual turnover. Yet, in response to inquiries regarding active investigations, the agency remains tight-lipped. "Please understand that we cannot comment on planned or current proceedings," a spokesperson stated.

This silence is deafening to activists like Matthias Marx, a Hamburg-based IT security expert who has been fighting to shut down such services for years. Marx discovered his own face in the PimEyes database in 2020 and has since navigated a labyrinthine legal battle. He argues that the authorities have ample tools at their disposal. The agency could, for example, target the financial infrastructure of the company. PimEyes utilizes third-party payment processors that have branches within the EU; freezing these revenue streams would effectively cripple the service’s ability to operate in the European market.

The refusal to act is being viewed by many as a dangerous precedent. If the state allows a service that violates basic privacy laws to continue operating simply because it is based in Dubai, it creates a "lawless zone" for digital harms.

The Hypocrisy of State-Sponsored Surveillance

The situation becomes even more convoluted when one considers the German government’s own agenda. While the EU has sought to ban the indiscriminate scraping of faces for commercial use, German federal authorities—specifically the Federal Criminal Police Office (BKA) and the Federal Police—have expressed a desire to use similar technologies for law enforcement.

Following the high-profile identification of former Red Army Faction (RAF) member Daniela Klette, who was spotted via a facial search on social media, the appetite for such tools among security agencies has grown. The federal government has drafted legislation that would allow police to use third-party facial recognition providers to search for suspects and even witnesses of serious crimes.

To bypass the restrictions of the AI Act, government lawyers have constructed an "argumentative trapdoor." They suggest that the prohibition only applies if the scraping process itself relies on AI. By claiming that a database could theoretically be built without the use of "artificial intelligence" (a dubious technical claim), the government hopes to maintain its access to these tools while ostensibly complying with the letter of the law. This legal gymnastics has drawn sharp criticism from the European Parliament.

Official Responses and the Future of Privacy

Tiemo Wölken, a Member of the European Parliament who helped negotiate the AI Act, is blunt about this interpretation. "The AI Act is clear," he asserts. "The creation of databases with facial images from the internet has been banned since February 2025." Wölken argues that the definition of an AI system was intentionally crafted to be broad enough to capture the exact technology used by PimEyes. He insists that any attempt by national authorities to circumvent this—whether for police use or otherwise—is a direct violation of the spirit of the legislation.

Alexandra Geese, another prominent MEP, echoes this sentiment. She argues that the technology represents a fundamental threat to a free society. "We are talking about technology that allows strangers to identify us in a crowd, outside our homes, or at our workplaces without our consent," she notes. Geese warns that if the current oversight bodies fail to enforce the law, the legislature must be prepared to tighten the rules further, leaving no room for the "technical loopholes" currently being exploited by both private companies and state agencies.

Implications for the Individual

The core of the issue is the erosion of the "right to be left alone." When a digital footprint can be instantly mapped to a physical body, the concept of a private life becomes fragile. The Chaos Computer Club (CCC) has been among the most vocal critics, warning that such infrastructures are essentially "stalking machines" that, by design, ignore the consent of the millions of people captured in their databases.

The legal battle being fought by activists like Matthias Marx, supported by the NGO noyb, is not just about a single website. It is a battle for the integrity of European law. If the authorities continue to claim they are "powerless" against a company based in Dubai, they are essentially admitting that the internet is beyond the reach of the rule of law.

As the Bundesnetzagentur prepares its next steps, the pressure is mounting from all sides. The government is caught between its desire for new, intrusive policing tools and its commitment to the very privacy regulations it helped draft. Meanwhile, for the average citizen, the reality remains unchanged: a single photo, a stray upload to social media, or a candid shot in the background of a news report is enough to make them a target for anyone with a subscription and a malicious intent.

Whether the AI Act proves to be a robust barrier against mass biometric surveillance or merely a paper tiger depends on whether the regulators can summon the political will to confront both the commercial scrapers and their own internal ambitions. Until then, the magnet remains, and the haystacks of the internet continue to yield their secrets.