Your face is more searchable than you might think. Understanding how facial recognition works, and what privacy law says about it, is the first step toward deciding how much of your face data you are willing to share. A recent explainer from Safeguard walks through the technical basics and the three legal frameworks that matter most: BIPA, GDPR and the EU AI Act. This post summarizes those points in plain language.
How face matching turns your face into a score
Facial recognition does not store your face the way a photo album does. According to the explainer, face matching converts a face into a vector, which is a list of numbers describing the features the system has measured. Matching then becomes a math problem: the system compares one vector to another and produces a score showing how similar they are.
That score is where thresholds come in. A system has to decide how high a score must be before it calls two faces a match. Set the threshold low, and the system accepts more matches but also produces more false ones. Set it high, and it produces fewer false matches but may miss real ones. The choice of threshold is a policy decision as much as a technical one, because the cost of a wrong answer depends on the setting. A false match on a phone unlock is an inconvenience. A false match in a police context can have far heavier consequences.
The explainer also stresses bias testing. Systems can perform differently across groups of people, so measuring error rates across those groups matters before a system is deployed. A single headline accuracy figure can hide uneven results.
Where everyday people run into facial recognition
For most people, facial recognition shows up in several ordinary places: stores, phones, airports and public cameras. Each context works a little differently.
- Phones: Unlocking a device with your face is a one-to-one comparison, checking whether the person in front of the camera matches the enrolled owner.
- Stores: Retail cameras may be used to flag people against a watchlist or to analyze visitors.
- Airports: Face matching can be used to compare a traveler to an identity document or record.
- Public cameras: Matching a face in a crowd against a larger database is a different and more sensitive task than unlocking your own phone.
The larger the database and the less choice you have about being scanned, the higher the privacy stakes. These concerns are not abstract. Our reporting on India's facial recognition boom and the end of protest anonymity shows how camera networks can change what it means to attend a public gathering.
What BIPA, GDPR and the EU AI Act actually give you
The explainer points to three legal frameworks. Their protections are real, but they apply unevenly depending on where you live and who is collecting your data.
BIPA is the Illinois Biometric Information Privacy Act. It is a US state law that deals specifically with biometric data such as face geometry. Its protection reaches only people covered by Illinois law, which is one reason US protections are often described as a patchwork.
GDPR is the European Union's general data protection regulation. It treats biometric data used to identify a person as a special category of personal data, which comes with stricter conditions for processing than ordinary data. It applies broadly to organizations handling the data of people in the EU.
The EU AI Act adds rules aimed at the AI systems themselves, including facial recognition. Rather than focusing only on the data, it regulates how such systems are built and used, which ties back to the testing, thresholds and bias checks described above.
The key point is that these laws differ in scope and enforcement. Someone in Illinois or the EU may have rights that a person elsewhere does not. And none of these laws stops a camera from capturing your face in public; they govern what organizations may do with the data.
What This Means For You
Facial recognition is not one technology used in one way. Unlocking your phone, being scanned at a border and being matched against a public camera feed are different situations with different risks and different legal protections. Knowing which one you are dealing with helps you decide where to act.
It is also worth being clear about what privacy tools can and cannot do. A VPN protects your network traffic. It does nothing about a camera that sees your face, or a photo that has already been matched to a vector. Personal countermeasures are limited too: our piece on whether makeup can beat facial recognition explores why tricks aimed at fooling cameras raise more questions than they answer.
Practical ways to limit your exposure
You cannot control every camera, but you can control the data you hand over voluntarily.
- Review face settings on your phone. Check whether face unlock, photo face grouping and similar features are enabled, and turn off what you do not need.
- Audit your social accounts. Look for tagging, face recognition and photo visibility settings, and tighten them.
- Read consent notices. If a store, app or service asks to scan your face, check what it says about retention and sharing before agreeing.
- Use your legal rights. If you are covered by GDPR or a similar law, you may be able to ask what biometric data an organization holds and request its deletion.
- Share fewer public photos. Large collections of tagged images make it easier to build searchable face data.
The bottom line
How facial recognition works privacy law debates often come down to one idea: your face becomes a vector, a score and a threshold decision, and the law decides who gets to run that process. Take a few minutes this week to review the face-data settings on your devices and social accounts. For more context on the limits of personal countermeasures, read our coverage of camera-evasion myths and large-scale public surveillance, starting with the articles linked above.
