DoNotPay and popular facial recognition tools
Legal tech company DoNotPay is best known for its army of “robot lawyers” — automated bots that tackle boringonline tasks like canceling TV subscriptions and requesting refunds from parking meters. Now, the company has published a new tool it says will help shield users’ photos from reverse image searches and facial recognition AI.
It’s called Photo Ninja and it’s one of dozens of DoNotPay widgets that subscribers can access for $36 a year. Photo Ninja operates like any image filter. Users can upload a picture they want to shield, and the software adds a layer of pixel-level perturbations that are barely noticeable to humans, but dramatically alter the image in the eyes of facial recognition AI.
The tool fools popular facial recognition software from Microsoft, Amazon and Google with a 99% success rate. This, combined with the anti-reverse-image search function, makes Photo Ninja handy in a range of scenarios, such as users wanting to upload a selfie to social media or a dating app. Running the image through Photo Ninja first will prevent people from connecting this image to other information about a specific person on the web.
However, the developers do not guarantee that Ninja will beat every facial recognition tool out there. When it comes to Clearview AI, for example, a controversial facial recognition service that is widely used by US law enforcement, the company ‘anticipates’ Photo Ninja will fool the company’s software but can’t guarantee it.
In part, this is because Clearview AI probably already has a picture of you in its databases, scraped from public sources long ago. As the company’s CEO Hoan Ton-That said in an interview with The New York Times last year: ‘There are billions of unmodified photos on the internet, all on different domain names. In practice, it’s almost certainly too late to perfect a technology [that hides you from facial recognition search] and deploy it at scale.’
The representatives of DoNotPay agree: “In a perfect world, all images released to the public from Day 1 would be altered. As that is clearly not the case for most people, we recognize this as a significant limitation to the efficacy of our pixel-level changes. Hence, the focal point and intended use case of our tool was to avoid detection from Google Reverse Image Search and TinEye.”
DoNotPay isn’t the first to build this sort of tool. In August 2020, researchers from the University of Chicago’s SAND Lab created an open-source program named Fawkes that performs the same task. Indeed, DoNotPay’s engineers referenced this work in their own research. But while Fawkes is a low-profile piece of software, very unlikely to be used by the average internet consumer, DoNotPay has a slightly larger reach, albeit one that is still limited to tech-savvy users who are happy to let bots litigate on their behalf.
Tools like this don’t provide a silver bullet to modern privacy intrusions, but as facial recognition and reverse image search tools become more commonly used, it makes sense to deploy at least some protections. Photo Ninja won’t hide you from law enforcement or an authoritarian state government, but it might fool an opportune stalker or two.