9 Million Faces Were Exposed Online. What Does That Mean for Your Privacy?
Your face is no longer just a photo.
Increasingly, it can be a search key.
On August 19, WIRED reported that the reverse-lookup service ClarityCheck had left more than 9 million image files exposed online. The approximately 450 GB database contained images of adults, teenagers, and children, including facial photographs and profile images. A separate configuration problem exposed email addresses and phone numbers through the site's APIs. :contentReference[oaicite:16]{index=16}
TechRadar subsequently reported that the database contained more than 9 million images totaling about 450.2 GB and said the company secured the exposed data after the issue was reported. There is no evidence from the reporting that the exposed information was actually misused by criminals. :contentReference[oaicite:17]{index=17}
Why Is This Story So Concerning?
Because the service was not simply storing random photographs.
ClarityCheck is designed to help identify people from images. WIRED reported that its face-search system can analyze an uploaded image and generate reports that may include names, addresses, location history, social-media profiles, photos, videos, and other information. :contentReference[oaicite:18]{index=18}
That creates a much bigger privacy question than the existence of one exposed database:
How much can a company learn about someone from a single photograph?
Your Face Is Different From a Password
A password can be changed.
Your face cannot.
That is one reason biometric information raises a different kind of privacy concern. If your password leaks, you can create a new one. If a photograph of your face is copied into a database and spreads elsewhere, there is no simple equivalent of resetting your face.
WIRED quoted privacy experts warning that increasingly automated systems for collecting and analyzing sensitive personal information increase the stakes when those systems are not properly secured. :contentReference[oaicite:19]{index=19}
The Most Interesting Part Wasn't Just the 9 Million Images
ClarityCheck's exposure also showed how different pieces of identity information can be connected.
The company says its services can search people using names, phone numbers, email addresses and other identifiers. WIRED reported that a separate API misconfiguration allowed URLs to be manipulated to return multiple potential email addresses, physical addresses, and phone numbers associated with a name. :contentReference[oaicite:20]{index=20}
That is the larger privacy problem.
A person's identity is often not one piece of data. It is a collection of pieces that can be connected together.
Could Your Photo Have Been in the Database?
That is one of the uncomfortable questions raised by the incident.
ClarityCheck's service was designed to identify people from images. WIRED noted that many individuals whose faces appeared in the exposed files may not have known their images were stored there in the first place. :contentReference[oaicite:21]{index=21}
That is a very different privacy problem from uploading a selfie to your own social-media account.
You may not even know which companies have copies of your image.
What Can You Do About Your Online Images?
Search for Yourself
Search your full name and common usernames. Reverse-image tools can also show where a particular photograph has appeared online.
Review Old Social Profiles
Old social accounts often contain years of photographs that you have forgotten about. Delete accounts and images you no longer want online where practical.
Check People-Search Sites
A photo may be only one piece of an identity profile. Search for your name, phone number, email address, current address, and previous addresses to see what is already publicly available.
Remove What You Can
When personal information appears on a people-search or data-broker site, request removal. Removing those profiles can reduce the amount of information that strangers can use to identify or contact you.
This Is Bigger Than One Database
The ClarityCheck incident is easy to describe as a security mistake.
But the deeper privacy story is the growth of services designed to turn photographs, names, phone numbers, and email addresses into searchable identity profiles.
The technology keeps getting better at connecting the dots. That makes it more important for consumers to ask what information about them is already available before somebody else does the searching.
Privoria helps reduce the information connected to your identity
Privoria helps find and remove personal information from data brokers and people-search websites. We cannot erase a photograph from every database on the internet, but reducing your public name, address, phone, and contact information can make your overall digital footprint smaller.
Check Your Online ExposureYour Face May Be Permanent. Your Digital Footprint Doesn't Have to Be.
Nobody can change the fact that you have a face that can appear in photographs.
But you can take steps to reduce how much additional information is attached to your identity online.
The ClarityCheck exposure is a reminder that personal information can become more powerful when different systems connect it together. The less unnecessary information that is publicly available, the fewer pieces there are for someone to work with.
Your privacy is not only about keeping secrets. It is also about making it harder for strangers to assemble the pieces.
Frequently Asked Questions
What happened to ClarityCheck?
WIRED reported that a ClarityCheck database containing more than 9 million image files was left accessible online because of a misconfigured Amazon S3 bucket. A separate API issue exposed personal information such as email addresses and phone numbers. The company secured the affected systems after being contacted. :contentReference[oaicite:22]{index=22}
Does ClarityCheck have my photo?
There is no general way to determine whether a specific person's image was included in the exposed files based solely on public reporting. WIRED reported that the service stored facial images and other photographs, including images of adults, teenagers, and children. :contentReference[oaicite:23]{index=23}
Can I remove my information from people-search websites?
Many people-search and data-broker websites provide opt-out or removal processes. The challenge is that there can be many sites, each with its own process, and listings can sometimes return later. Learn more about how data-broker opt-outs work.