Link
A viral TikTok account is doxing ordinary and otherwise anonymous people on the internet using off-the-shelf facial recognition technology, creating content and growing a following by taking advantage of a fundamental new truth: privacy is now essentially dead in public spaces.
The 90,000 follower-strong account typically picks targets who appeared in other viral videos, or people suggested to the account in the comments. Many of the account’s videos show the process: screenshotting the video of the target, cropping images of the face, running those photos through facial recognition software, and then revealing the person’s full name, social media profile, and sometimes employer to millions of people who have liked the videos. There’s an entire branch of content on TikTok in which creators show off their OSINT doxing skills—OSINT being open source intelligence, or information that is openly available online. But the vast majority of them do it with the explicit consent of the target. This account is doing the same, without the consent of the people they choose to dox. As a bizarre aside, the account appears to be run by a Taylor Swift fan, with many of the doxing videos including Swift’s music, and including videos of people at the Eras Tour.
404 Media is not naming the account because TikTok has decided to not remove it from the platform. TikTok told me the account does not violate its policies; one social media policy expert I spoke to said TikTok should reevaluate that position.
The TikTok account, conversations with victims, and TikTok’s own lack of action on the account show that access to facial recognition technology, combined with a cultural belief that anything public is fair game to exploit for clout, now means that all it takes is one random person on the internet to target you and lead a crowd in your direction.
One target told me he felt violated after the TikTok account using facial recognition tech targeted him. Another said they initially felt flattered before “that promptly gave way to worry.” All of the victims I spoke to echoed one general point—this behavior showed them just how exposed we all potentially are simply by existing in public.
“I worry about the potential application of this technology for something worse than online thirstiness. Like full-blown stalking for example or who knows what,” Eli Lloyd, one of the victims, told me in an email.
Earlier this year another victim Matthew (I agreed to not publish his full name) was wearing a brightly patterned shirt and a reflective visor while waving a Pride flag. A social media content creator popular on TikTok and Instagram interviewed Matthew as he pointed a microphone into Matthew’s face. In a video the creator filmed, the two bantered back and forth in the short 26 second clip, including about actor Pedro Pascal.
Matthew never provided the interviewer his full name or any identifiable personal information. It was a fleeting moment that ordinarily would have ended there. But it didn’t.
Shortly after, the facial recognition TikTok account responded to the original video with their own. The video shows the user taking several screenshots of Matthew. Then they opened a website called Pimeyes that lets anyone run facial recognition searches. They uploaded the screenshots, selected Matthew’s face from the photos, and hit search.
Nearly immediately, Pimeyes provided a hit: a photo of Matthew on his employer’s website. The person scrolls down the employer’s website and easily finds Matthew’s full name. They then copy and paste that name into Instagram and find Matthew’s profile. To punctuate their public unmasking of a stranger on the internet, the TikTok creator screenshots Matthew’s Instagram, as if—mission complete. At the time of writing, the TikTok revealing Matthew’s name, employer, and personal social media account has around 676,000 views. The comments are a mix of people making sexual jokes about Matthew, some marveling at the capability of Pimeyes, and others asking whether the practice is even legal.
ONE OF THE VIDEOS ON THE ACCOUNT. REDACTIONS BY 404 MEDIA. SCREENSHOT FROM TIKTOK.
Matthew, meanwhile, had no idea someone had just taken an otherwise anonymous clip of him and run facial recognition tech against it. At the time, he was on his honeymoon in South Africa, he told me. Some friends had seen the original video and told him they found it funny. But then he started to hear about this second video that unmasked him.
“My Instagram exploded,” Matthew told me. “I think I got about 2000+ follow requests, dozens of DMs asking me things like ‘what is my OnlyFans.’” One person even emailed Matthew’s work email, he said.
Still on his honeymoon, Matthew said he couldn’t relax. He “felt a bit violated really.” He hated the fact the TikTok creator had used his employer’s website to find him. Matthew reported the video to TikTok but received no response, and the video, and the account, remained online.
Fortunately he was away from wifi for much of the trip so that helped him decompress, he said. After about a week, the furor died down. Although in that case Matthew said the implications were quite harmless, “it showed me how easy it was for a person to be found using just their face.”
Matthew is just one of dozens of people the offending TikTok account has unmasked, in many cases with facial recognition tech like Pimeyes or another site called FaceCheckID. Judging by the content of the videos, there is no public interest in uncovering and blasting Matthew or the others’ identities. There aren’t any examples of wrongdoing by the targets being unmasked. Rather, the TikTok account did so in part because they were asked to by people in its comments. In Matthew’s case, the request came from a TikTok user called Kenny, who simply wrote “I need his @” in response to the original video of Matthew. Kenny did not respond to multiple requests for comment on why they wanted to unmask Matthew.
The TikTok videos often include the original comment that spurred the doxing. Some of those requests include “plz we need your help,” “u know what has to be done,” and “find me this man.” The requests appear to come from a mix of voyeurism, attraction, and vague interest. In other words, people just felt like knowing more about these targets’ private lives.
The account has received seemingly hundreds of private messages too. In July the account posted a screenshot of their inbox with 317 requests. “Y’all need to calm down I’m only one person
,” they wrote. While many users are feeding the account people to target, other commentators are concerned by the practice. “That is so privacy invading tho…,” read one. “Should I be concerned?” read another.
The owner of the account did not respond to multiple requests for comment sent over TikTok and an apparent related account on Instagram.
The account is not always correct in its doxing attempts, by its own admission. The caption of one video reads “correction, i was wrong
.”
A SCREENSHOT OF PIMEYES' UPLOAD INTERFACE. SCREENSHOT FROM PIMEYES' WEBSITE.
Pimeyes told me in an email that it only became aware of this account when I asked them about it. “We have already forwarded information to our data security unit and ur [sic] lawyers, to evaluate if the account has violated our terms of service, and if there is any violation of our terms of service, we will immediately take according actions.”
Those terms are vague. “User should use the Services solely for private, personal, and legitimate consumer purposes, in accordance with the principles of good manners and etiquette,” Pimeyes’ website reads. It then mentions that Pimeyes bans some illegal activities “including but not limited to threatening, stalking, spying, bullying and etc,” but none of those likely apply here, at least in a legal sense, because no crime is being committed. FaceCheckID did not respond to a request for comment.
Ultimately, a TikTok account using facial recognition tech to unmask people for clout is not really a legal question. It is a cultural one.
“I don’t immediately see anything illegal since folks are captured in public,” Whitney Merrill, a privacy attorney, told me. That’s not to say it isn’t invasive or creepy or anything else. This account shows “privacy by obscurity isn’t something folks can rely on in public places,” Merrill added. “Will this change the way that people act in public if this becomes a popular trend?”
ONE OF THE VIDEOS ON THE ACCOUNT. REDACTIONS BY 404 MEDIA. SCREENSHOT FROM TIKTOK.
The history of the facial recognition industry is a long one, with researchers and individuals experimenting with, and warning about, the technology for years, as Kashmir Hill’s new book Your Face Belongs to Us shows. What is different now to the early days of facial recognition is that strangers are able to dox one another with incredible ease; this capability is not just in the hands of governments. In one section of her book, Hill describes how a man used Pimeyes to discover the identity of sex workers from porn videos. The operator of the TikTok account is doing a similar thing, but rather than keeping the results to themselves, is blasting them to millions of viewers.
A broad trend on TikTok is people sharing information that even a few years ago would have been rarer on social media. In one ongoing example TikTok users hear people talking in public—they eavesdrop—about friends behind their back and then make a TikTok video about what they heard. These sometimes include personal information that make identifying the parties involved possible. Arguably, using Pimeyes or other facial recognition tech to unmask strangers is the natural clout chasing extension of that.
TikTok for its part has not removed the facial recognition account. Matthew told me he reported the account in July through TikTok’s normal mechanism but received no response. Since then, the account has uploaded at least a dozen more pieces of content.
Ben Rathe, a spokesperson from TikTok, told me TikTok has reviewed the account and concluded it does not violate the social network's terms of use. This is because in TikTok's eyes the account is only using publicly available information, rather than information which may be considered private such as a phone number.
One expert I spoke to pushed back against TikTok's assessment of the account. Danielle Citron, a Jefferson Scholars Foundation Schenck Distinguished Professor in Law at the University of Virginia School of Law, said “TikTok’s TOS [terms of service] bans doxing and this strikes me as precisely the kind of disclosure of public information that breaks context and raises risk of harm—economic and physical as well as mental.” Citron said that although the law may not cover this combination of facial recognition outing and personal information that is available online, “it is an error of the highest order given the way information travels and work and given expectations of obscurity.”
Citron said social media platforms, including TikTok, should reevaluate their current policies around this. “It is something I’ve talked to and advised companies about,” she added.
Arguably, social networks may need to grapple with the idea that facial recognition tech complicates the typical distinction between “public” and “private” information. The type of “public” information that society is used to, like someone's own social media posts, is qualitatively different to “public” information such as a search engine that collates every instance of someone's unique face it can find across the internet.
At least some of the commentators on the TikTok account’s videos continue to push back against the practice, albeit while still feeding it engagement. “This is genuinely scary,” reads one.
A viral TikTok account is doxing ordinary and otherwise anonymous people on the internet using off-the-shelf facial recognition technology, creating content and growing a following by taking advantage of a fundamental new truth: privacy is now essentially dead in public spaces.
The 90,000 follower-strong account typically picks targets who appeared in other viral videos, or people suggested to the account in the comments. Many of the account’s videos show the process: screenshotting the video of the target, cropping images of the face, running those photos through facial recognition software, and then revealing the person’s full name, social media profile, and sometimes employer to millions of people who have liked the videos. There’s an entire branch of content on TikTok in which creators show off their OSINT doxing skills—OSINT being open source intelligence, or information that is openly available online. But the vast majority of them do it with the explicit consent of the target. This account is doing the same, without the consent of the people they choose to dox. As a bizarre aside, the account appears to be run by a Taylor Swift fan, with many of the doxing videos including Swift’s music, and including videos of people at the Eras Tour.
404 Media is not naming the account because TikTok has decided to not remove it from the platform. TikTok told me the account does not violate its policies; one social media policy expert I spoke to said TikTok should reevaluate that position.
The TikTok account, conversations with victims, and TikTok’s own lack of action on the account show that access to facial recognition technology, combined with a cultural belief that anything public is fair game to exploit for clout, now means that all it takes is one random person on the internet to target you and lead a crowd in your direction.
One target told me he felt violated after the TikTok account using facial recognition tech targeted him. Another said they initially felt flattered before “that promptly gave way to worry.” All of the victims I spoke to echoed one general point—this behavior showed them just how exposed we all potentially are simply by existing in public.
“I worry about the potential application of this technology for something worse than online thirstiness. Like full-blown stalking for example or who knows what,” Eli Lloyd, one of the victims, told me in an email.
Earlier this year another victim Matthew (I agreed to not publish his full name) was wearing a brightly patterned shirt and a reflective visor while waving a Pride flag. A social media content creator popular on TikTok and Instagram interviewed Matthew as he pointed a microphone into Matthew’s face. In a video the creator filmed, the two bantered back and forth in the short 26 second clip, including about actor Pedro Pascal.
Matthew never provided the interviewer his full name or any identifiable personal information. It was a fleeting moment that ordinarily would have ended there. But it didn’t.
Shortly after, the facial recognition TikTok account responded to the original video with their own. The video shows the user taking several screenshots of Matthew. Then they opened a website called Pimeyes that lets anyone run facial recognition searches. They uploaded the screenshots, selected Matthew’s face from the photos, and hit search.
Nearly immediately, Pimeyes provided a hit: a photo of Matthew on his employer’s website. The person scrolls down the employer’s website and easily finds Matthew’s full name. They then copy and paste that name into Instagram and find Matthew’s profile. To punctuate their public unmasking of a stranger on the internet, the TikTok creator screenshots Matthew’s Instagram, as if—mission complete. At the time of writing, the TikTok revealing Matthew’s name, employer, and personal social media account has around 676,000 views. The comments are a mix of people making sexual jokes about Matthew, some marveling at the capability of Pimeyes, and others asking whether the practice is even legal.
ONE OF THE VIDEOS ON THE ACCOUNT. REDACTIONS BY 404 MEDIA. SCREENSHOT FROM TIKTOK.
Matthew, meanwhile, had no idea someone had just taken an otherwise anonymous clip of him and run facial recognition tech against it. At the time, he was on his honeymoon in South Africa, he told me. Some friends had seen the original video and told him they found it funny. But then he started to hear about this second video that unmasked him.
“My Instagram exploded,” Matthew told me. “I think I got about 2000+ follow requests, dozens of DMs asking me things like ‘what is my OnlyFans.’” One person even emailed Matthew’s work email, he said.
Still on his honeymoon, Matthew said he couldn’t relax. He “felt a bit violated really.” He hated the fact the TikTok creator had used his employer’s website to find him. Matthew reported the video to TikTok but received no response, and the video, and the account, remained online.
Fortunately he was away from wifi for much of the trip so that helped him decompress, he said. After about a week, the furor died down. Although in that case Matthew said the implications were quite harmless, “it showed me how easy it was for a person to be found using just their face.”
Matthew is just one of dozens of people the offending TikTok account has unmasked, in many cases with facial recognition tech like Pimeyes or another site called FaceCheckID. Judging by the content of the videos, there is no public interest in uncovering and blasting Matthew or the others’ identities. There aren’t any examples of wrongdoing by the targets being unmasked. Rather, the TikTok account did so in part because they were asked to by people in its comments. In Matthew’s case, the request came from a TikTok user called Kenny, who simply wrote “I need his @” in response to the original video of Matthew. Kenny did not respond to multiple requests for comment on why they wanted to unmask Matthew.
The TikTok videos often include the original comment that spurred the doxing. Some of those requests include “plz we need your help,” “u know what has to be done,” and “find me this man.” The requests appear to come from a mix of voyeurism, attraction, and vague interest. In other words, people just felt like knowing more about these targets’ private lives.
The account has received seemingly hundreds of private messages too. In July the account posted a screenshot of their inbox with 317 requests. “Y’all need to calm down I’m only one person
,” they wrote. While many users are feeding the account people to target, other commentators are concerned by the practice. “That is so privacy invading tho…,” read one. “Should I be concerned?” read another.The owner of the account did not respond to multiple requests for comment sent over TikTok and an apparent related account on Instagram.
The account is not always correct in its doxing attempts, by its own admission. The caption of one video reads “correction, i was wrong
.”
A SCREENSHOT OF PIMEYES' UPLOAD INTERFACE. SCREENSHOT FROM PIMEYES' WEBSITE.
Pimeyes told me in an email that it only became aware of this account when I asked them about it. “We have already forwarded information to our data security unit and ur [sic] lawyers, to evaluate if the account has violated our terms of service, and if there is any violation of our terms of service, we will immediately take according actions.”
Those terms are vague. “User should use the Services solely for private, personal, and legitimate consumer purposes, in accordance with the principles of good manners and etiquette,” Pimeyes’ website reads. It then mentions that Pimeyes bans some illegal activities “including but not limited to threatening, stalking, spying, bullying and etc,” but none of those likely apply here, at least in a legal sense, because no crime is being committed. FaceCheckID did not respond to a request for comment.
Ultimately, a TikTok account using facial recognition tech to unmask people for clout is not really a legal question. It is a cultural one.
“I don’t immediately see anything illegal since folks are captured in public,” Whitney Merrill, a privacy attorney, told me. That’s not to say it isn’t invasive or creepy or anything else. This account shows “privacy by obscurity isn’t something folks can rely on in public places,” Merrill added. “Will this change the way that people act in public if this becomes a popular trend?”
ONE OF THE VIDEOS ON THE ACCOUNT. REDACTIONS BY 404 MEDIA. SCREENSHOT FROM TIKTOK.
The history of the facial recognition industry is a long one, with researchers and individuals experimenting with, and warning about, the technology for years, as Kashmir Hill’s new book Your Face Belongs to Us shows. What is different now to the early days of facial recognition is that strangers are able to dox one another with incredible ease; this capability is not just in the hands of governments. In one section of her book, Hill describes how a man used Pimeyes to discover the identity of sex workers from porn videos. The operator of the TikTok account is doing a similar thing, but rather than keeping the results to themselves, is blasting them to millions of viewers.
A broad trend on TikTok is people sharing information that even a few years ago would have been rarer on social media. In one ongoing example TikTok users hear people talking in public—they eavesdrop—about friends behind their back and then make a TikTok video about what they heard. These sometimes include personal information that make identifying the parties involved possible. Arguably, using Pimeyes or other facial recognition tech to unmask strangers is the natural clout chasing extension of that.
TikTok for its part has not removed the facial recognition account. Matthew told me he reported the account in July through TikTok’s normal mechanism but received no response. Since then, the account has uploaded at least a dozen more pieces of content.
Ben Rathe, a spokesperson from TikTok, told me TikTok has reviewed the account and concluded it does not violate the social network's terms of use. This is because in TikTok's eyes the account is only using publicly available information, rather than information which may be considered private such as a phone number.
One expert I spoke to pushed back against TikTok's assessment of the account. Danielle Citron, a Jefferson Scholars Foundation Schenck Distinguished Professor in Law at the University of Virginia School of Law, said “TikTok’s TOS [terms of service] bans doxing and this strikes me as precisely the kind of disclosure of public information that breaks context and raises risk of harm—economic and physical as well as mental.” Citron said that although the law may not cover this combination of facial recognition outing and personal information that is available online, “it is an error of the highest order given the way information travels and work and given expectations of obscurity.”
Citron said social media platforms, including TikTok, should reevaluate their current policies around this. “It is something I’ve talked to and advised companies about,” she added.
Arguably, social networks may need to grapple with the idea that facial recognition tech complicates the typical distinction between “public” and “private” information. The type of “public” information that society is used to, like someone's own social media posts, is qualitatively different to “public” information such as a search engine that collates every instance of someone's unique face it can find across the internet.
At least some of the commentators on the TikTok account’s videos continue to push back against the practice, albeit while still feeding it engagement. “This is genuinely scary,” reads one.
