Is it legal for a business to use discriminatory (and notoriously false-positive) fingerprinting algorithms that prevent me from loading their website purely on the basis of how I look (as opposed to how I act)?

Some time ago I opened an account on a website. For security reasons, I used Tor Browser. I loaded money onto my account and purchased their services. I used their services several times without issue.

Recently I tried to log-into my account, but I got stuck in an infinite loop on CloudFlare, so I could never access their website. It should go without saying that I'm not doing anything malicious, but I'll say it: this is reproducible when launching a fresh version of TAILS, opening the browser, typing the naked domain into the address bar and pressing <enter>. I'm never allowed into the store.

So it appears to me that this website is denying me access to their business services, my account, and the funds on my account for one reason: because they don't like the way I look.

Is this legal for them to do to their customers? I'm also curious if the same thing would be legal in the IRL analog, for example:

  1. Would it be legal for a brick-and-mortar store to deny me from entering their shop purely on the basis of the way that I look?

  2. Would it be legal for a bank (with whom I already have an open account in good-standing) to prevent me from accessing my safety deposit box because they don't like the way that I look?

Or, perhaps for a closer analogy:

  1. Would it be legal for a brick-and-mortar store to deny me from entering their shop because their SaaS CCTV facial recognition software (falsely) said that I "look" like a shoplifter?

  2. Would it be legal for a bank (with whom I already have an open account in good-standing) to prevent me from accessing my safety deposit box because I'm wearing the same T-Shirt from JC Penny that someone else wore who robbed their bank yesterday (and they do not permit me to attempt to prove my identity)?

I'm primarily interested in US and EU law, but I would be interested in any countries with strong consumer and data protection laws that would provide consumer protection from discrimination on the basis of "looks" on the Internet.

  • 2
    Does this answer your question? When is it okay as a retail store owner to refuse service to a customer?
    – AsheraH
    Jul 14, 2023 at 5:06
  • 10
    Please excuse my ignorance, but how does the website know what you look like? You mention fingerprints, but they have no correlation to facial features in accepted science.
    – user35069
    Jul 14, 2023 at 6:38
  • 6
    Interesting reading, thank you. Sorry if I seem a bit dim, but how does "information collected about the software and hardware" determine how you look..?
    – user35069
    Jul 14, 2023 at 7:33
  • 3
    You should also consult the ToS you agreed to for this service, as it may well have terms specifying that access requires a suitable/compatible browser (which would exclude Tor), among other things. It's hard to imagine one that would grant you access for wholly arbitrary access methods. Excluding Tor is a security measure for them at least as much as using it is one for you. Jul 14, 2023 at 13:10
  • 4
    I downvoted - not on the basis of how you look, but on the basis of conflating your personal appearance to arcane computer behavior in the question. Jul 14, 2023 at 14:17

2 Answers 2


You are mistaken: they deny you on your act

When you use Tor, your browser is not sending a lot of information. That makes Tor browsers hilariously easy to detect: nobody knows where the real browser is, but it is hilariously easy to block all Tor users for using Tor, or at least those that the server knows are Tor IPs. Using Tor is an action, not how you look.

The closest Brick and mortar equivalent would be "Show me your ID please" and you show them a paper cutout of something that has Sample stamped over it.

"No shirt, no shoes, no service" in the

Yes, most places can deny service based on how you dress or your state of hygine. These two would in most cases not extend to the protections under the Civil Rights Act, which protects some characteristics like race and sex, but not visual factors like "being dressed" or "smelling of cow". There can be a fine line where religious dress code is concerned, but in general and broad strokes, the restaurant can deny you for wearing the wrong clothes.

Actually, the slogan is much broader than it appears: as long as an establishment's dress code is not violating discrimination law (like the CRA), they can enforce it under their freedom to contract.

  • Comments have been moved to chat; please do not continue the discussion here. Before posting a comment below this one, please review the purposes of comments. Comments that do not request clarification or suggest improvements usually belong as an answer, on Law Meta, or in Law Chat. Comments continuing discussion may be removed.
    – feetwet
    Jul 14, 2023 at 22:39

"Looks" are not a protected characteristic in any anti-discrimination regime in Canada. It is not a violation of any provincial or federal Human Rights Code to deny services on the basis of looks per se. Only when this serves to discriminate on the basis of a protected characteristic would this discrimination be prohibited.

For example, under the Canadian Human Rights Act, these are: "race, national or ethnic origin, colour, religion, age, sex, sexual orientation, gender identity or expression, marital status, family status, genetic characteristics, disability and conviction for an offence for which a pardon has been granted or in respect of which a record suspension has been ordered."

Under the B.C. Human Rights Code, in relation to services, the prohibited grounds of discrimination are: "Indigenous identity, race, colour, ancestry, place of origin, religion, marital status, family status, physical or mental disability, sex, sexual orientation, gender identity or expression, or age."

Of course, if the way one is being discriminated on the basis of "looks" is to actually result in discrimination on the basis of "race" or "colour," for example, this would be prohibited discrimination.

These codes apply no matter whether the prohibited discrimination is due solely to the actions of a person, or mediated by the operation of an algorithm. They are written and applied in a technologically neutral manner.

  • As always, it will usually be hard to find the evidence for the real reason. E.g if someone doesn't want to serve black people, they might instead say that they're "dressed like rappers".
    – PMF
    Jul 14, 2023 at 10:38
  • Does Canada have any laws that regulate the use of discriminatory artificial intelligence algorithms that would be applicable here? Jul 14, 2023 at 15:51

Not the answer you're looking for? Browse other questions tagged .