On September 23, 2026, the Court of Québec upheld the order the Commission d'accès à l'information had issued against Clearview AI. The American company built a database of faces from images found on the web and on social media. For a financial firm, the issue is not facial recognition. It is a far more ordinary habit: looking a client up on LinkedIn or Facebook before a meeting, then noting what you found in the file.
Two texts published this year say the same thing, one about facial recognition, the other about generative artificial intelligence. The fact that information is visible online does not give anyone the right to collect it. Here is what they say, and what it changes in practice for a firm.
- Clearview AI (2026 QCCQ 4502). The Court of Québec confirms that a company cannot build files on Quebecers from images found online without their consent, even with no office in Québec.
- OpenAI (May 6, 2026). For Québec's Commission d'accès à l'information, information posted on the web is not public for that reason, and publishing it is not consent to its reuse.
- For a financial firm. What you find on LinkedIn or Facebook and record in a client file is collected from a third party. The simplest approach is to ask the client.
What the Court of Québec upheld
Clearview AI runs a facial recognition search engine. It indexes images published on web pages, including social media, and creates a biometric identifier for each face. Its clients are mostly police services and public bodies.
In December 2021, the Commission ordered it to do three things: stop building files on people in Québec, stop collecting their images to derive identifiers from them, and destroy what it had already gathered. Clearview appealed. The Court of Québec dismissed the appeal, and three points of its judgment deserve attention.
- The law applies even without an office in Québec. Clearview argued it had no office, employees or clients in Québec. The court held that collecting information about people who live there is enough to create the required connection.
- Consent was required. Building these files without consent breaches Québec's private-sector privacy act, and Clearview did not show a serious and legitimate reason.
- Freedom of expression does not prevail. The court recognized that Clearview's activities have expressive content protected by the Canadian Charter. But the act's rules on collection, disclosure and consent are justified limits in a free and democratic society.
OpenAI: publishing is not consenting
On May 6, 2026, the Office of the Privacy Commissioner of Canada and its counterparts in Québec, British Columbia and Alberta published their joint investigation into ChatGPT. They found that OpenAI had not obtained valid consent for the personal information used to train its GPT-3.5 and GPT-4 models, much of it scraped from the web.
OpenAI argued that people who publish without restriction accept, at least implicitly, that their information may be reused. Québec's Commission d'accès à l'information answered on three points.
- Visible is not public. Québec law does not make information public merely because it is posted on the web. Only information that is public under a statute falls outside its rules.
- Publishing is not consenting. Unrestricted publication does not prove that the person was informed or consented.
- A social network is a third party. Collecting information from a social network is, in principle, collecting it from a third party, which requires the person's consent.
And when a company cannot tell whether the person authorized the publication, the Commission's answer is that, when in doubt, it should refrain from collecting the information. For Québec, the complaint on consent was found well-founded and unresolved.
What is visible online is not, for that reason, available.
Three everyday habits to revisit
These cases target large technology companies, but the principle applies to any firm that collects personal information. Québec's private-sector act sets two simple rules. Collect only what is necessary for the purpose of the file. And collect it from the person themselves, unless they consent to your asking a third party.
1. The search before the meeting
Typing a client's name into Google, checking their LinkedIn profile, scrolling through their travel photos on Facebook: it all takes a few seconds. What matters is what you do with it. As soon as something found online is recorded in the file or used in a recommendation, the firm has collected it from a third party.
The simplest way to stay on the right side is to ask the client. They know their situation better than LinkedIn does, and the answer they give you themselves is the only one you will be able to defend.
Checks that a statute requires of you, for example under anti-money laundering rules, follow a different logic: the statute itself authorizes them.
2. Prospecting lists
A purchased contact list, or one compiled from public profiles, raises exactly the question settled in Clearview and in the OpenAI investigation. Before you use it, ask the vendor where the information comes from and what consent it relies on. If they cannot answer, you have your answer.
3. Tools that fill in the file for you
Browser extensions that show a correspondent's LinkedIn profile, CRMs that complete records on their own, AI assistants that research the client before the meeting: the collection happens without anyone clicking anything. It is still a collection by the firm, and the firm is accountable for it.
A word on faces
Clearview is also a reminder that biometrics are a separate matter. In Québec, the Act to establish a legal framework for information technology requires a person's express consent before their identity is verified using biometric characteristics. Creating a database of biometric characteristics must also be disclosed to the Commission before it is put into service.
If a vendor offers to verify your clients' identity with a selfie, ask two questions: who filed the disclosure with the Commission, and where are the face templates stored?
Four reflexes for your firm
- Visible is not public. Under the law, information is public only if a statute makes it public. A LinkedIn profile is not.
- The client first. Collect information from the person themselves. It is more accurate, and it is the rule.
- Question your vendors. Lists, enrichment tools, AI: ask where the data comes from and what consent it rests on.
- When in doubt, refrain. That is the Commission's position, and it costs far less than a complaint.