If you uploaded photos of your kids to Flickr they might have been used to train AI

• The large facial-recognition database MegaFace contains the images of nearly 700,000 people, The New York Times reported.
• In 2014, Yahoo took photos from the photo-sharing website Flickr uploaded under Creative Commons licenses and put them in a database that was downloaded by researchers, including those at the University of Washington who used them to create another database called MegaFace.
• The images have been used to train AI to surveil protesters and identify porn actors, among other uses.
• Although there are not yet lawsuits related to this database specifically, legal experts told the Times that this could be a future class-action lawsuit.
• Visit Business Insider's homepage for more stories.

Uploading family photos to the photo-sharing website Flickr could lead to your children's photos being used to train AI facial recognition programs, Kashmir Hill and Aaron Krolik recently reported at The New York Times.

As many as 700,000 individuals had their likenesses uploaded from Flickr to the giant facial-recognition database MegaFace, including many children, according to the report.

In 2014, Yahoo uploaded images from its subsidiary Flickr into a massive photo database. The goal was to "empower the research community by giving them a robust database," according to then director of research at Yahoo David Ayman Shamma. Flickr users were not informed about the photo use, according to the Times. Spokespeople for Flickr, MegaFace, and Yahoo were not immediately available for comment.

Yahoo researchers reportedly attempted to include a safeguard in their database: they included links to Flickr photos, not the photos themselves, so if users deleted an image or changed privacy settings it would no longer be included in the database. In practice, researchers who had access to the data downloaded images and redistributed them, which is how a University of Washington team created MegaFace, which contains millions of photos of hundreds of thousands of people.

A University of Washington spokesperson told the Times that the researchers who created the MegaFace database "have moved on to other projects and don't have the time to comment on this."

MegaFace is directly tied to troubling surveillance techniques and uses of AI, including monitoring Uighurs in China, The New York Times reported. In 2015 and 2016, the school invited companies working on facial recognition to test their algorithms on the photo set. More than 300 groups used the dataset, including Tencent, SenseTime, and NtechLab. SenseTime was placed on a trade blacklist by the US for its role in creating technology used to track the Uighur minority population in China, and NtechLab has been used to out pornography actors and identify strangers, sometimes called "Shazam for people."

The MegaFace database is still available for public download, and The New York Times was able to track down people from their images. Although the photos don't contain names, they do have numbers that link them to the original Flickr account that posted them. There is no clear recourse for people in the images to have them removed from the database.

Flickr was obtained by SmugMug in 2018, and announced an end to its unlimited photo storage. The company announced that it would limit free users to 1,000 photos, and any content beyond that was "at risk of deletion." Even if photos are deleted from Flickr, they will still exist in MegaFace's database.

Flickr isn't the only photo-sharing website where images were used to train AI. In March, Olivia Solon at NBC News reported that researchers have treated sites like Facebook, Youtube, mugshot databases, and more as a "free for all."

People's whose likenesses have been used without their consent by MegaFace have little recourse, unless they live in states with strong privacy laws like Illinois, according to The New York Times. Unusually strict for the US, the state's Biometric Information Privacy Act prohibits using fingerprints or face scans of Illinois residents without their consent. Law professors and lawyers told the Times that companies that used the database may be financially liable. Although there are not yet lawsuits related to this database specifically, legal experts told the Times that this could be a future class-action lawsuit.