Canadian authorities have found that the collection of facial-recognition data by Clearview AI is illegal because it violates federal and provincial privacy laws, representing a win for individuals’ privacy and potentially setting a precedent for other legal challenges to the controversial technology.

A joint investigation of privacy authorities ... came to this conclusion Wednesday, claiming that the New York-based company’s scraping of billions of images of people from across the Internet represented mass surveillance and infringes on the privacy rights of Canadians.

Moreover, the investigation found that Clearview had collected highly sensitive biometric information without people’s knowledge or consent, and then used and disclosed this personal information for inappropriate purposes that would not be appropriate even if people had consented.

Clearview, founded in 2017 by Australian entrepreneur Hoan Ton-Thatand, is in the business of collecting what it calls “faceprints,” which are unique biometric identifiers similar to someone’s fingerprint or DNA profile, from photos people post online.

Clearview to date has amassed a database of billions of these faceprints, which it sells to its clients. It also provides access to a smartphone app that allows clients to upload a photo of an unknown person and instantly receive a set of matching photos.