In 2014, Clarifai's founder emailed OKCupid's co-founder and asked for access to the dating site's photo database. "We're collecting data now and just realized that OKCupid must have a HUGE amount of awesome data for this," Clarifai founder Matthew Zeiler wrote. OKCupid handed over 3 million user photos. No user was asked. No user was told.

Twelve years later, Clarifai has finally deleted them. The company confirmed to the FTC on April 7 that every photo and every facial recognition model trained on that data has been destroyed. But the story of how we got here tells you everything about how little protection exists when an AI company wants your face.

The Cozy Deal That Started It All

The data transfer was not some shadowy hack. It was a business relationship between friends. At the time Zeiler requested the data, several OKCupid executives were investors in Clarifai. Court documents obtained by Reuters show the request was handled casually, as if borrowing a neighbour's lawnmower rather than transferring millions of people's dating photos to build surveillance technology.

The transfer violated OKCupid's own privacy policy and a federal law against deceptive business practices. But nobody noticed for five years. It took a New York Times investigation in 2019 to prompt the FTC to open a probe. It then took another seven years for the case to reach settlement.

What Clarifai Built With Your Face

Clarifai is not a small player. The Delaware-based company offers facial recognition technology that identifies individuals in images and video, and can analyse age, race, and gender. It has contracted with the U.S. military. It has received investment from Nvidia. The 3 million OKCupid photos, which included demographic data from user profiles, were used to train the kind of models that power real-world surveillance systems.

The company told Representative Lori Trahan's office on April 16 that the models trained on the data have been deleted and the data was never shared with third parties. Clarifai did not respond to Reuters' questions about how many models were deleted or how long they were in use. For context: the data was collected in 2014 and deleted in 2026. That is 12 years of use.

The FTC Settlement That Did Almost Nothing

OKCupid and its parent company Match Group settled with the FTC in late March. Under the terms, they agreed not to misrepresent their privacy policies going forward. That is it. No fine. No penalty. The FTC says it does not have the authority to issue penalties for the violations alleged in this case.

Democrats in Congress called the settlement inadequate. Representative Trahan called the data deletion "a step in the right direction" but said "the FTC should have never settled for less in the first place." FTC spokesperson Joe Simonson dismissed the criticism entirely, calling it "a completely baseless issue manufactured by Democrats who do nothing but lie for a living."

Clarifai was not accused of any wrongdoing at all. The company that built military-grade facial recognition from dating photos without user consent walked away clean.

The Bigger Problem

This case is a perfect snapshot of the current AI data landscape. A company asks for your data. Another company hands it over. Nobody tells you. Your photos train models for a decade. When regulators finally catch up, the penalty is a promise not to do it again. The company that used the data is not even accused of doing anything wrong.

The case also shows how political AI regulation has become. Democrats push for enforcement. Republicans call it overreach. Meanwhile, the data is already trained into the models, the models have been in production for years, and the deletion is verified by a self-certification letter. Nobody audited the deletion. Nobody confirmed the models are actually gone. We are taking Clarifai's word for it.

If you used OKCupid in 2014, your face trained military facial recognition software. You were never asked. You were never told. And the entire enforcement action resulted in zero dollars of penalties and a politely worded promise. That is the state of AI privacy regulation in 2026.

Sources: Reuters (primary reporting by Jody Godoy), FTC settlement documents, court filings, Representative Lori Trahan's office statement.