How does this code relate to the Home Office's facial recognition plans?

The Home Office intends to legislate on police use of facial recognition with a new regulator, while shops using the tools would get a separate code, suggesting a two-track approach.

UK Biometrics Code of Practice Planned for Face Scanning Firms

Q: Does the source specify the code's detailed rules, enforcement, or penalties?

No. The source does not set out the code's specific rules, a publication date, who will enforce it, or what penalties might apply.

Q: Which biometric technologies will the code cover?

The source does not say exactly which biometric technologies, beyond facial recognition, will fall within scope.

Q: What might businesses have to disclose or justify under the code?

The source gives no specifics, so it is not possible to say what businesses will have to do; the stated goals of clarity and consistency are the only confirmed details.

The UK government plans to introduce a legal code of practice for businesses that use facial recognition and other biometric technologies. The aim, according to the report, is to provide greater clarity and consistency around how these tools are deployed. For anyone who walks into a shop, visits a venue, or uses an app that scans faces, the planned UK biometrics code of practice could matter a great deal. But the source material is short on detail, so it is worth separating what is confirmed from what is still open.

What the planned UK biometrics code of practice covers

The confirmed part is simple. UK businesses using facial recognition and other biometric technologies will face a new legal code of practice under government plans. The stated purpose is to give greater clarity and consistency around deployment. A search snippet from a related report also describes the code as aimed at businesses using facial recognition to tackle crime, including retailers.

What the source does not tell us is just as important. It does not set out the code's specific rules, a publication date, who will enforce it, or what penalties might apply. It also does not say exactly which biometric technologies, beyond facial recognition, will fall within scope. Readers should treat any claims about detailed requirements as speculation until the government publishes more.

How it fits with the Home Office facial recognition plans

This code does not appear in isolation. The Home Office has said it intends to legislate on police use of facial recognition, creating a new regulator with injunction powers, while shops that use the tools would get a separate code. Our earlier coverage of the Home Office facial recognition law and new regulator explains that broader structure.

In practice, that suggests a two-track approach: statutory rules for policing on one side, and a code of practice for private-sector use on the other. Whether the same regulator would oversee both, and how the code would be backed up legally, is not made clear in the material we have. The word "legal" in the description signals that the code is meant to carry weight, but the mechanism is not spelled out.

What businesses may have to disclose or justify

Because the source gives no specifics, it is not possible to say what businesses will have to do. The stated goals of clarity and consistency point to a few areas where codes of this kind commonly focus, though none of these is confirmed for this one:

How clearly customers are told that facial recognition is in use
Whether a business can explain why the technology is necessary
How long biometric data is kept and who can access it
How errors, such as misidentification, are handled

Treat this list as questions to watch for when the full code appears, not as announced requirements. Businesses currently face a patchwork of expectations, and the promise of consistency suggests the government wants to reduce that uncertainty for both companies and the public.

What This Means For You

If you shop, work, or attend events in the UK, the code could eventually make it easier to know when your face is being scanned and what happens to the data. Nothing in the source says the rules are in force yet, so for now there is no new protection you can point to.

Biometric data is different from a password. You cannot change your face if a database is leaked or misused. That is why consistent standards matter, and why it is sensible to be cautious in the meantime.

How to limit biometric collection in daily life

You do not need to wait for the code to take practical steps:

Look for signage. Businesses using facial recognition should tell you. Read notices at entrances and in-store.
Read privacy notices. Check what an app or venue says about biometric data, retention, and sharing before agreeing.
Use opt-outs. If an app offers face unlock, face tagging, or face-based verification alongside a PIN or password, choose the alternative where you can.
Ask questions. You can ask a business how it uses face data and how to raise a concern.
Review app permissions. Disable camera access for apps that do not need it.

A VPN does not stop a camera in a shop from scanning your face, because it only protects your internet traffic. Limiting biometric collection comes down to the choices above.

Takeaways

The planned UK biometrics code of practice is a signal that the government wants clearer, more consistent rules for private-sector facial recognition, but the details are not yet public. Watch for the code's scope, enforcement, and disclosure rules. In the meantime, check signage and privacy notices, use opt-outs where they exist, and read our report on the Home Office facial recognition law and new regulator for the wider legislative context.