Cameras are everywhere, and AI makes it possible to analyze their footage automatically: recognizing faces, tracking people across cameras, reading license plates and detecting “unusual” behavior. These capabilities promise safer cities and faster investigations, but they also enable mass surveillance on a scale that was previously impossible.

How facial recognition works

A facial recognition system detects a face in an image, converts it into a numerical representation (an embedding), and compares it with embeddings in a database. Two main uses:

  • Verification (1:1): is this person who they claim to be? Used to unlock phones and at automated border gates.
  • Identification (1:N): who is this person? The image is compared against a database of many people, such as a watchlist or mugshot collection.

Identification in public spaces — scanning crowds in real time — is the most controversial use.

Accuracy and bias

The US National Institute of Standards and Technology (NIST) runs ongoing evaluations of face recognition algorithms. Its testing shows that the best algorithms have become extremely accurate in good conditions, but performance varies widely between vendors, and many algorithms show demographic differentials — different error rates across age, sex and race. Image quality, lighting, angle and the size of the database also strongly affect results.

Even a small false match rate matters at scale: scanning thousands of people a day can generate wrongful alerts. In the United States, several people have been wrongfully arrested after facial recognition matches that police treated as conclusive, prompting lawsuits and policy changes.

Uses by police and governments

  • comparing images from crime scenes with mugshot databases;
  • live facial recognition at events or transport hubs to find people on watchlists;
  • border control and identity verification;
  • license plate recognition;
  • video analytics for crowd monitoring.

Uses by businesses

Retailers use facial recognition against suspected shoplifters, stadiums and venues for entry, and employers for time tracking. These uses raise questions of consent, data protection and accuracy, and some have been challenged by regulators.

Clearview AI

Clearview AI built a facial recognition database by scraping billions of images from the web and social media, offering search services to law enforcement. Data protection authorities in several European countries, as well as in the UK, Canada and Australia, found its practices unlawful and imposed fines or orders to delete data, while in the US it settled a lawsuit under Illinois’ biometric privacy law.

The rules

  • The EU AI Act prohibits AI that creates facial recognition databases through untargeted scraping, and bans real-time remote biometric identification in publicly accessible spaces for law enforcement except in narrowly defined situations (such as searching for victims of serious crimes or preventing imminent threats), with prior authorization. Other biometric identification uses are high-risk.
  • Data protection laws such as the GDPR treat biometric data for identification as a special category requiring strong justification.
  • Some US cities and states restrict police use of facial recognition, while Illinois’ Biometric Information Privacy Act gives individuals the right to sue over unlawful biometric collection.

Questions to ask about any surveillance system

  1. What is the legal basis and specific purpose?
  2. How accurate is it in real conditions, and for which groups?
  3. Is a match treated only as a lead requiring human verification?
  4. How long is data kept, and who can access it?
  5. Is there independent oversight and public reporting?

Protecting your own privacy

Review privacy settings for photos on social media, be cautious about apps that ask for face scans, and use your data protection rights to ask companies whether they hold biometric data about you.

What to watch next

  • Implementation of the EU AI Act’s biometric prohibitions and exceptions.
  • Police use of live facial recognition in more countries.
  • Litigation over wrongful arrests linked to facial recognition.
  • Retail facial recognition and regulator responses.

Key takeaways

  • Facial recognition compares face embeddings for verification (1:1) or identification (1:N).
  • NIST testing shows high accuracy for top algorithms but wide variation and demographic differentials.
  • Wrongful arrests show the danger of treating matches as conclusive.
  • Clearview AI’s scraped database was found unlawful by several data protection authorities.
  • The EU AI Act bans untargeted face scraping and restricts real-time public biometric identification by police.

Frequently asked questions

It depends on the country, the user and the purpose. Unlocking your own phone is broadly accepted; police and commercial identification in public spaces is restricted in many places.

How accurate is facial recognition?

The best systems are very accurate in good conditions, but accuracy drops with poor images and varies between vendors and demographic groups.

Can I opt out of facial recognition?

In some places, data protection laws let you object or request deletion. Options are limited for government uses authorized by law.