Legal services startup DoNotPay is best known for its army of “robot lawyers” — automated bots that tackle tedious online tasks like canceling TV subscriptions and requesting refunds from airlines. Now, the company has unveiled a new tool it says will help shield users’ photos from reverse image searches and facial recognition AI.

It’s called Photo Ninja and it’s one of dozens of DoNotPay widgets that subscribers can access for $36 a year. Photo Ninja operates like any image filter. Upload a picture you want to shield, and the software adds a layer of pixel-level perturbations that are barely noticeable to humans, but dramatically alter the image in the eyes of roving machines.

The end result, DoNotPay CEO Joshua Browder tells The Verge, is that any image shielded with Photo Ninja yields zero results when run through search tools like Google image search or TinEye. You can see this in the example below using pictures of Joe Biden:

Image: DoNotPay

Image: DoNotPay

The tool also fools popular facial recognition software from Microsoft and Amazon with a 99 percent success rate. This, combined with the anti-reverse-image search function, makes Photo Ninja handy in a range of scenarios. You might be uploading a selfie to social media, for example, or a dating app. Running the image through Photo Ninja first will prevent people from connecting this image to other information about you on the web.

Browder is careful to stress, though, that Photo Ninja isn’t guaranteed to beat every facial recognition tool out there. When it comes to Clearview AI, for example, a controversial facial recognition service that is widely used by US law enforcement, Browder says the company “anticipates” Photo Ninja will fool the company’s software but can’t guarantee it.

In part, this is because Clearview AI probably already has a picture of you in its databases, scraped from public sources long ago. As the company’s CEO Hoan Ton-That said in an interview with The New York Times last year: “There are billions of unmodified photos on the internet, all on different domain names. In practice, it’s almost certainly too late to perfect a technology [that hides you from facial recognition search] and deploy it at scale.”

Browder agrees: “In a perfect world, all images released to the public from Day 1 would be altered. As that is clearly not the case for most people, we recognize this as a significant limitation to the efficacy of our pixel-level changes. Hence, the focal point and intended use case of our tool was to avoid detection from Google Reverse Image Search and TinEye.”

DoNotPay isn’t the first to build this sort of tool. In August 2020, researchers from the University of Chicago’s SAND Lab created an open-source program named Fawkes that performs the same task. Indeed, Browder says DoNotPay’s engineers referenced this work in their own research. But while Fawkes is a low-profile piece of software, very unlikely to be used by the average internet consumer, DoNotPay has a slightly larger reach, albeit one that is still limited to tech-savvy users who are happy to let bots litigate on their behalf.

Tools like this don’t provide a silver bullet to modern privacy intrusions, but as facial recognition and reverse image search tools become more commonly used, it makes sense to deploy at least some protections. Photo Ninja won’t hide you from law enforcement or an authoritarian state government, but it might fool an opportune stalker or two.