Summary: Reuters reported on April 20, 2026 that Clarifai deleted roughly 3 million OkCupid photos and the facial recognition models built from them. The deletion followed the FTC’s March settlement with Match Group over a 2014 transfer that violated OkCupid’s privacy policies. The settlement included no fine but imposed a permanent ban on false statements about data collection and sharing.
Reuters broke the news on April 20, 2026: Clarifai, the AI platform company, has deleted the roughly 3 million user photos it took in from the dating app OkCupid back in 2014, and with them went the facial recognition models built from that data. The move lands after the US Federal Trade Commission’s March 2026 settlement with Match Group, OkCupid’s parent company — one of the few FTC outcomes to reach all the way into the derived models.
If your models are trained on third-party data, the takeaway is stark: where that data came from and how solid the consent behind it is are no longer boilerplate in a compliance file — they are a legal liability with the power to decide whether the model lives.
The Photos Went; So Did the Models
Court filings that Reuters examined, together with TechCrunch’s follow-up coverage, show the erasure went beyond the images. OkCupid’s 2014 handover carried not only the photos users had uploaded but demographic and location information as well, and Clarifai turned it into a tool that read age, sex, and race from faces. Those models go too. Neither company answered requests for comment, though Clarifai’s confirmation of the deletion effectively admits it once held the photos and put them to use.
Where It Began: a 2014 Email
It opens with a single email in 2014. Matthew Zeiler, Clarifai’s founder, wrote to OkCupid co-founder Maxwell Krohn: “We’re collecting data now and just realized that OKCupid must have a HUGE amount of awesome data for this.” OkCupid’s executives were themselves investors in Clarifai, and user data — photos, location, demographics — moved to the startup through a transfer that ran against OkCupid’s own privacy policies. The deal surfaced in July 2019, when a New York Times investigation exposed several companies building facial recognition databases without users’ consent; the OkCupid-to-Clarifai pipeline appeared in that reporting, and the FTC began investigating that same year. From the first email to the deletion, twelve years passed — that is the gap between conduct and consequence.
What the Settlement Does — and Can’t
The FTC announced the settlement with Match Group and OkCupid in March 2026. Its allegations: the companies broke their own privacy policies by passing user data to a third party, hid that conduct from 2014 onward, and even tried to obstruct the investigation. The deal’s limits matter just as much — OkCupid admitted no deception, and current US law bars fines for a first-time offense of this kind. What actually binds is a permanent ban on making false statements about data collection and sharing — or helping others do so. Penalties: zero dollars. The conduct injunction: permanent.
Deleting the Model Is What Counts
Deleting data is nothing new; the scope is the story here. The raw photos went, and so did the models trained from them — the first time regulatory pressure has borne down on the training artifacts themselves. An asymmetry of scale is also at work: purging 3 million rows is routine engineering, but deleting a model quietly takes every product, fine-tune, or derivative built on it down with it — that is what gives this remedy its force. For teams that treat datasets as buy-once inputs and models as assets held forever, the risk math has changed: if the consent behind your training data is flawed, the model itself may be what you forfeit.
Three Lessons for Developers and Product Teams
One: keep records of where every batch of training data originated and how far the consent ran — someday you may have to prove both, then delete on request, which is hopeless if nothing was ever written down. Two: read a data partner’s terms clause by clause — OkCupid tripped over a privacy policy it wrote itself, and a vendor can take you down the same way; “we didn’t know what they did with it” protected no one in this case. Three: design so models can be deleted — when data lineage and training configurations can’t be reconstructed, destroying derived models on demand becomes close to impossible, and this case proves regulators will ask.