The British Columbia Court of Appeal has confirmed that a company operating outside Canada may still be subject to provincial privacy legislation where its online activities have a real and substantial connection to the province. In Clearview AI Inc. v. British Columbia (Information and Privacy Commissioner), released February 18, 2026, the Court dismissed the appeal from Clearview AI Inc. (“Clearview”) and upheld an order requiring the company to stop offering certain facial recognition services in British Columbia and to make best efforts to cease collecting and delete facial data of individuals in the province that had been collected without consent.
For charities and not-for-profits in Ontario and other provinces, this decision is relevant even though it arises under B.C.’s Personal Information Protection Act (PIPA). Privacy statutes across Canada, including the provincial legislation, and the federal Personal Information Protection and Electronic Documents Act (PIPEDA), share common themes, including consent-based collection, limits tied to appropriate purposes, and regulatory concern over the handling of sensitive personal information. Although PIPEDA governs commercial activities and may not apply to charities and not-for-profits directly, its Schedule 1 outlines the privacy principles established as a practical standard.
This appeal decision follows the earlier B.C. Supreme Court decision, which likewise upheld the 2021 order of the British Columbia Information and Privacy Commissioner against Clearview. As previously discussed in the Privacy Update of the January 2025 Charity & NFP Law Update, that earlier ruling confirmed that Clearview’s scraping of facial images from the internet without consent contravened PIPA.
Clearview, a U.S.-based technology company, operates facial recognition software that scrapes images of faces and related metadata from publicly accessible websites, such as Facebook, Instagram and YouTube. It then analyzes those images to generate biometric identifiers and stores the resulting facial data in a searchable database. The service is marketed primarily to law enforcement and government clients. There was no dispute that the facial data in issue constituted “personal information” under PIPA.
The Court of Appeal addressed three main issues: whether PIPA was constitutionally applicable to Clearview; whether the Commissioner had reasonably concluded that Clearview could not rely on the “publicly available” exception or the “reasonable purpose” provisions under PIPA; and whether the Commissioner’s order was unreasonable because it was unnecessary, unenforceable or overbroad.
On the constitutional issue, the Court held that PIPA validly applied to Clearview because there was a real and substantial connection between the company’s activities and British Columbia. Before July 2020, Clearview marketed its services to entities in the province. Even after withdrawing from the Canadian market, it continued to scrape facial data from individuals in B.C. as part of its global data-collection activities. The Court held that this ongoing collection was not merely incidental. Rather, access to facial data from B.C., like access to data from other jurisdictions, was integral to Clearview’s business model.
In reaching that conclusion, the Court emphasized that privacy legislation must be interpreted with regard to the evolving nature of the internet. The fact that Clearview’s technology operated globally and without regard to borders did not insulate it from provincial regulation. The Court also noted the “quasi-constitutional” protection of privacy rights, citing precedent from the Supreme Court of Canada, and rejected the argument that applying PIPA in these circumstances would create unfair or improper overlapping regulation.
The Court also upheld the Commissioner’s conclusion that Clearview could not rely on the statutory exception for “publicly available” information. The Commissioner had reasonably found that social media websites and other public internet sources were not the kind of “printed or electronic publication” contemplated by the PIPA regulations. The Court agreed that the listed examples, such as magazines, books and newspapers, are materially different from social media platforms, where content is dynamic and individuals retain some measure of control over privacy settings and access.
Similarly, the Court found it was reasonable for the Commissioner to conclude that Clearview’s collection, use and disclosure of facial data was not for a purpose that a reasonable person would consider appropriate in the circumstances. The Court accepted that the personal information at issue was highly sensitive, that the collection was indiscriminate and massive in scale, and that Clearview’s commercial use of the information was unrelated to the purposes for which individuals had originally posted their images online. The Commissioner had also reasonably considered the risks of harm, including misidentification, unwanted surveillance, investigation and data breach.
Finally, the Court rejected Clearview’s challenge to the order itself. It found that the prohibition against offering the impugned services in British Columbia was not unnecessary merely because Clearview had said it was no longer operating in the province. The Court also held that the requirement to use “best efforts” to cease collection and delete data was sufficiently precise and enforceable. In the privacy context, such language was found to provide appropriate flexibility while still requiring meaningful compliance.
The B.C. Court of Appeal ruling offers a useful indication of how Canadian courts may approach mass data scraping, facial recognition technology, and claims that online information is “publicly available.” For organizations in Ontario and other provinces, the case is a reminder to review privacy practices carefully and not assume that public accessibility alone permits unrestricted use of personal data.