Facial recognition moved into airports, phones, retail security, and police investigations faster than governments developed rules for each use. Regulation is now becoming more specific, replacing broad arguments about whether the technology is good or bad with questions about purpose, scale, consent, databases, error rates, and consequences.

That precision matters. A phone comparing its owner to an enrolled template is not the same system as police searching a crowd against a watchlist. One verifies a claimed identity with active participation; the other identifies an unknown person, potentially without their knowledge. The technical operation may look similar, but the civil-rights and due-process risks are substantially different.

Performance Depends on the Task

Face matching produces a score, not an identity. An operator selects a threshold and accepts a tradeoff between false negatives and false positives. In one-to-one verification, a false rejection may lead to another attempt. In one-to-many identification, even a very low false-positive rate can generate numerous candidates when a probe is compared with millions of records.

NIST's 2019 demographic study tested nearly 200 algorithms from almost 100 developers using more than 18 million images of over eight million people. It found demographic differentials in most algorithms, while also finding large performance differences among vendors (NIST). In some one-to-one tests, false-positive rates varied by factors of 10 to more than 100 across demographic groups. NIST's updated evaluation work stresses that image quality contributes strongly to some false-negative differences and that algorithms must be assessed for the actual task and operating conditions (NIST).

Those results argue against both complacency and blanket claims that all systems behave alike. Procurement should specify test populations, camera conditions, gallery size, thresholds, and acceptable error rates. Operational policy must then determine what a candidate list can justify. A match should rarely be treated as probable cause or a final decision without corroborating evidence.

Europe Draws Functional Boundaries

The European Union's AI Act created the most detailed cross-sector framework. Its prohibitions, applicable from February 2025, include untargeted scraping of internet or CCTV images to build facial-recognition databases and, subject to narrow exceptions, real-time remote biometric identification by law enforcement in public spaces (European Commission). Permitted remote biometric identification, biometric categorization involving protected traits, and emotion recognition can fall into the Act's high-risk category, triggering requirements for data governance, documentation, logging, human oversight, accuracy, robustness, and cybersecurity (EU AI Act Service Desk).

The Act deliberately excludes ordinary biometric verification whose sole purpose is confirming that a person is who they claim to be from the high-risk biometric-identification category. It also requires exceptional law-enforcement uses of real-time remote identification to be strictly necessary for defined objectives, such as finding an abduction victim or addressing an imminent threat (EU AI Act, Article 5). These distinctions give deployers a decision tree rather than one label for every face-enabled system.

U.S. Oversight Is Emerging Through Multiple Channels

Facial Recognition Rules Are Catching Up With Deployment — supporting image
Facial Recognition Rules Are Catching Up With Deployment — supporting image

The United States still lacks one comprehensive federal facial-recognition statute, so controls arise from agency policy, consumer-protection enforcement, procurement rules, and state or local law. The resulting coverage is uneven.

A 2023 Government Accountability Office review found that seven selected federal law-enforcement agencies had conducted about 60,000 searches using commercial services before requiring staff training. Only two required training by April 2023, and several lacked facial-recognition-specific civil-liberties policies (GAO). The Justice Department's December 2024 report consequently recommended documented authority, purpose restrictions, supervisory review, testing, training, and limits on databases built unlawfully (U.S. Department of Justice).

Consumer law can reach harmful deployments even without a biometric statute. In December 2023, the Federal Trade Commission alleged that Rite Aid used facial surveillance in hundreds of stores without reasonable safeguards, generated false alerts, and disproportionately affected people of color. The settlement imposed a five-year surveillance-use ban. The agency's assessment was blunt: “Rite Aid's reckless use of facial surveillance systems left its customers facing humiliation” (FTC).

Good Rules Govern the Whole Decision Chain

Accuracy testing alone cannot answer whether a use is legitimate. Effective rules should define permissible purposes; control enrollment and watchlist quality; require notice where feasible; minimize retention; log every search; separate operators from final decision-makers; require corroboration; and provide a route to challenge consequential errors. Independent audits should sample real operating conditions, not only vendor benchmarks.

Rules should also address function creep. Templates collected for building access should not quietly become a general employee-monitoring database. A police lead system should not allow unrestricted searches by untrained staff. Vendors should disclose material model or threshold changes that invalidate prior evaluation.

The regulatory trend is therefore less a universal ban than a move toward differentiated obligations. The closer a system comes to identifying people at a distance, across large databases, without consent, and with legal or economic consequences, the stronger the justification, testing, oversight, and remedy should be.

Sources