Facial Recognition

Face recognition is the capability most requested and the one requiring the most justification. The technical, legal and ethical objections converge rather than trading off.

What it is technically

A template is computed from a face image — a mathematical representation.

It is compared against enrolled templates, producing a similarity score.

Above a threshold, a match is declared.

The template is biometric data, and it exists the moment it is computed, regardless of whether an image is stored.

One-to-one and one-to-many

Verification: the person claims an identity and the system checks it. Cooperative, single comparison, the person knows it is happening.

Identification: the system searches a gallery for a match. No cooperation, and the error behaviour is entirely different.

A one-to-many search across a large gallery generates false matches at a rate that scales with gallery size. A system with a low per-comparison error rate produces frequent false matches when run against thousands of templates.

Verification at a door with a badge is a materially different proposition from a search across a watchlist, and conflating them is the most common analytical error here.

Where the errors land

Independent evaluation has repeatedly found error rates varying substantially by skin tone, sex and age, with the largest gaps at intersections.

Products have improved and the variation persists, which means current measurements matter and vendor assurances do not substitute for them.

A false match results in someone being approached, questioned or refused. The burden falls on the same people repeatedly.

Documented cases of wrongful accusation following a false match exist, which is what distinguishes this from applications where an error costs an inspection.

The legal position, briefly

General orientation; the specifics of your jurisdiction require advice.

In the EU, biometric data used for identification is special-category data under the GDPR. The AI Act adds a layer: real-time remote biometric identification in publicly accessible spaces for law enforcement is prohibited with narrow exceptions, building or expanding facial recognition databases by untargeted scraping of internet or CCTV images is prohibited outright, and biometric identification systems are classified high-risk with obligations applying from August 2026.

In parts of the United States, state biometric privacy statutes impose consent and retention requirements with private rights of action, and several cities have restricted municipal use.

In the UK, data protection law applies and the regulator treats biometric recognition as high-risk processing requiring a strong necessity and proportionality case.

The direction of travel is toward more restriction, not less.

Before proposing it

Six questions, answered in writing.

What decision requires knowing which individual this is, that could not be made from detection or counting?

What is the legal basis, and does it survive the workplace consent problem if employees are involved?

What are the subgroup error rates, measured, on a representative set?

What happens on a false match — who is approached, by whom, with what training?

How does someone contest a match?

What is the retention, and who deletes it?

A proposal that cannot answer all six is not ready, and most proposals cannot answer the first.

The honest recommendation

For most commercial questions, the answer is that identification is not necessary.

Access control is better served by a credential the person chooses to present. Safety is served by detection. Operations are served by counting.

Where identification is genuinely required, the apparatus above is the minimum, and a human decision before any consequence is not optional.

Gallery size and false matches

The arithmetic that distinguishes verification from identification, and it is rarely presented.

A false match rate that is acceptable for one comparison becomes unacceptable across thousands.

Searching a gallery of ten thousand at a per-comparison false match rate of one in a hundred thousand still produces regular false matches.

The rate scales with gallery size, which means a system demonstrated on a small enrolment behaves differently in production.

Ask for the false match rate at your intended gallery size, and do the multiplication yourself.

The consequence procedure

If a match triggers an approach, the procedure matters as much as the accuracy.

Who is told, and what are they told? A score, not a certainty.

What are they trained to do? Approach, observe, or nothing.

What is said to the person? Not an accusation based on a probabilistic match.

What happens if the person disputes it, immediately and afterwards?

What is recorded about an encounter that turned out to be a false match?

Most deployments have the technology and none of this, which is where the documented harms have come from.