A company that sells the ability to identify a stranger from a photograph left more than nine million files unsecured online, a researcher found.
ClarityCheck sells reverse image searches. A user uploads a photo and the site returns names, social profiles and where else the image appears online. Canadian visitors are quoted $1.69 for a seven-day trial and $38.99 every 28 days after that.
The company also sells lookups on phone numbers, email addresses, vehicle identification numbers, names and businesses. Its homepage says it can “identify unknown callers, verify online contacts, check photos, and decode vehicles using publicly available data from trusted sources.”
Cybersecurity researcher Jeremiah Fowler found 9,042,977 image files in unsecured cloud storage belonging to the company, in folders labelled faces and profiles. The images included adults, teenagers and children, he wrote in a report published by ExpressVPN.
The site is offered in more than 20 languages and prices its trial separately for the United States, Britain, the European Union, Australia and Canada. How many of the images were Canadian is unknown.
The people in those folders are not the customers. They are the people being looked up. ClarityCheck’s image search page says the subject of a search will never be notified, and the company will pull a phone number or an email address from its results on request. It has no equivalent for a photograph.
“If you’re trying to find out who a person is, you might not have authorization or permission, so people might not know that their image had been dumped into this database that was public,” Fowler told Wired magazine.
A scammer holding those images could identify someone, build a fake profile and approach their friends and family as that person, his report said. A face cannot be reset the way a password can. ClarityCheck’s about page says its services “must not be used to stalk, harass, dox, or monitor any person.”
Fowler found the storage in early April, he said in an email to National Post. Most of the ClarityCheck addresses he tried bounced, and messages he sent through the company’s customer support did not reach the right people, he wrote. Public access was not restricted until July, after Wired contacted the company.
A ClarityCheck spokesperson told Wired access “required knowledge of a specific, unindexed URL that was not discoverable through ordinary use of the ClarityCheck service or a general web search.” The company said the files included duplicates, resized copies and non-image data rather than nine million unique images.
Fowler wrote that he did not see duplicate, cropped or resized images in the sample he reviewed, though he was not claiming they were absent. The storage URL appeared in code on ClarityCheck’s own website, Wired reported.
Teresa Scassa, the Canada Research Chair in Information Law and Policy at the University of Ottawa, said Canadian law puts a duty on companies to protect the personal information they hold. “I don’t think that that would qualify as meeting that duty or that obligation,” she said.
The company is registered in Delaware. Its reverse image search page tells Canadian visitors it handles personal information under the Personal Information Protection and Electronic Documents Act, Canada’s private sector privacy law. It points them to the opt-out in its terms, which works by sending a one-time code to the number or address being removed.
Scassa said the law reaches the company regardless, and that it keeps separate privacy policies for American, British and European users. “All that’s required for PIPEDA to apply is for there to be that real and substantial connection,” she said.
The only control on an upload is a box the user ticks confirming they own the image or appear in it. Canada’s privacy commissioner examined that model in 2024. It found Pornhub’s owner, Aylo, could not rely on uploaders to confirm consent, even though Aylo checked government identification against a live face scan.
Scassa said the comparison holds, with a caveat. Intimate images are far more sensitive than a photograph, she said, so ClarityCheck’s position is less serious than Aylo’s. “I still don’t think it’s adequate consent. They should have something more than that.”
A Canadian who suspects their face is in there can ask the company what it holds on them, and it has to answer, Scassa said. Finding out would likely mean handing over a fresh photograph to search against. If the company has something, they can ask for it to be deleted, and Bill C-36, tabled in June, would make that right clearer, she said.
Beyond that the privacy commissioner can investigate and issue findings, Scassa said, but they are not binding, and any Federal Court order would have to be enforced through an American court.
Fowler’s report quotes ClarityCheck’s terms setting a 14-day retention period for uploaded images. The terms now say seven days and carry a July 28 update. It appears the company edited them after his disclosure, Fowler wrote.
ClarityCheck’s FAQ says it does not provide facial recognition. Marketing copy on the same page describes face recognition and facial recognition search. A Wired reporter who uploaded their own face was shown the phrases scanning facial landmarks and mapping unique face geometry.
ClarityCheck did not answer questions from National Post by deadline. Five replies came back from customer support on Friday, each signed with a different first name, saying the questions had been routed to the responsible team.
The company said in an email over the weekend that the questions reached its escalations team late on Friday and would need input from its legal, engineering and product teams. It asked until Aug. 28 for written answers. The Office of the Privacy Commissioner did not respond.
Fowler wrote that he saw nothing in the images showing where they came from. He did not report the exposure to a Canadian regulator because the company is registered in the United States.
The one way to find out runs through the company itself. “You won’t know if you’re in the database until you get in the database,” Scassa said.
Our website is the place for the latest breaking news, exclusive scoops, longreads and provocative commentary. Please bookmark nationalpost.com and sign up for our newsletters here.
