The company behind a discontinued cloud photo storage application, which later transitioned to offering facial recognition services, has been legally required to remove user data and any algorithmic models created using it, as outlined in a Federal Trade Commission (FTC) agreement.

The FTC launched an investigation following reports concerning the Ever application – previously criticized for employing deceptive tactics to solicit contact information from users – regarding its application of facial recognition technology to user photographs without adequate disclosure of its data handling practices.

The proposed agreement mandates that Ever eliminate photos and videos belonging to users who closed their accounts, as well as all face embeddings—that is, data pertaining to facial characteristics utilized for facial recognition—obtained from photos of users who did not explicitly consent to such usage.

Furthermore, the company must delete any facial recognition systems or algorithms developed utilizing users’ photos or videos.

This comprehensive set of deletion requirements—encompassing not only the data itself but also any derivatives and training materials—is generating significant discussion within legal and technology policy communities, with some suggesting it may set a precedent for other facial recognition software developed using unlawfully obtained data.

In essence, large technology corporations that secretly gather data to train artificial intelligence systems could face regulatory scrutiny from the US authorities regarding their algorithms.

As background, the Ever application ceased operations last August, citing increased competition from major technology companies like Apple and Google as the reason.

However, this followed an NBC News investigation in 2019 that revealed Everalbum, the application’s creator, had begun marketing facial recognition services to private businesses, law enforcement agencies, and the military (under the brand Paravision), seemingly repurposing personal family photos to train AI systems capable of facial analysis.

NBC News reported that Ever only included a “limited mention” of this new application within its privacy policy after being contacted by journalists inquiring about the shift in April of that year.

The FTC announced the proposed settlement with Ever yesterday, with unanimous support from the commissioners, as reported earlier by The Verge.

Commissioner Rohit Chopra released a separate statement expressing concerns that current facial recognition technology is “inherently flawed and perpetuates damaging biases,” and voiced support for “measures to implement temporary prohibitions or significantly restrict its deployment.”

“In the meantime,” he stated, “it is essential that the FTC rigorously enforce existing laws to prevent those who engage in wrongdoing from benefiting from technologies built through the illegal collection of facial images and likenesses of American citizens.”

Chopra’s statement underscores the fact that commissioners have previously authorized data protection law infringers to retain algorithms and technologies that “derive substantial value from improperly acquired data,” referencing a prior settlement with Google and YouTube that permitted the technology company to maintain algorithms and other technologies “improved by illegally obtained data concerning children.”

He characterized the Ever decision as “a crucial shift in direction.”

Ever will not be subject to a financial penalty under the terms of the settlement—a point Chopra described as “regrettable,” explaining it is linked to the commissioners “not having re-established this principle as a rule under Section 18 of the FTC Act.”

He also noted that Ever refrained from processing the facial data of users residing in states with laws prohibiting facial recognition and the handling of biometric data, citing this as an illustration of “the importance of preserving states’ authority to safeguard personal data.” (Note: Ever also avoided processing biometric data from users within the European Union, another region with data protection regulations.)

“Given the immense volume of data being collected on individuals, a collaborative effort is needed to oversee these companies,” he continued. “State and local governments have rightfully enacted bans, moratoria, and other restrictions on the use of these technologies. While certain groups are actively lobbying for federal legislation to supersede state data protection laws, Congress must resist these efforts. Broad federal preemption would significantly weaken this multifaceted approach and leave more consumers vulnerable.”

“It will be vital for the Commission, the states, and regulators worldwide to pursue further enforcement actions to hold accountable providers of facial recognition technology who make inaccurate claims about accuracy and engage in unfair, discriminatory practices.”

Paravision has been contacted for a response to the FTC settlement.

Update: Paravision provided us with the following statement via email: