Earlier last month, Apple introduced a new feature in its flagship phones, a jump forward in biometric security that it calls “Face ID”.1. Instead of a numeric code or fingerprint, iPhone owners can use their face to unlock their phone for use. Although Apple has touted this technology as a step towards the future, facial recognition software has been in use for security purposes for over a decade.2 However, as Apple brings the technology to a greater user pool, it sheds light on concerns over the privacy of your own face. As the facial recognition technology becomes more pervasive, society will need to evaluate how this innovation reconciles with our values in privacy.
The concept of facial recognition is simple: a camera captures an image of a face that is then analyzed by software. The software identifies distinctive points on the face, and takes measurements to map them.3 More advanced recognition systems, like the one found on the new iPhone, recognize dimensions, photographs, and can even account for expressions.4 The information is then processed either internally, as on a phone, or externally through a database, for matches.5
In addition to biometric authentication, facial recognition systems serve several other purposes. The Department of Homeland Security has used facial recognition to strengthen checks at the border.6 Law enforcement has harnessed the technology to survey crowds at sports games to identify criminals.7 Facebook uses facial recognition in a seemingly more social manner, to identify faces in a photograph to make sharing pictures simpler.
The principal concern with facial recognition is that the data may be stored and used for purposes beyond unlocking your phone. While Apple promises that the data is processed internally and not collected, other facial recognition systems do not make the same promises.8 While some types of data like location information or fingerprints require physical action to collect, facial prints can be obtained without a physical interaction. A camera can easily take an image of a person without consent and without their awareness. In a digital age where closed-circuit television systems abound and cameras can be found on every smartphone, there are abundant opportunities for facial data to be captured. Further, with the internet, photos and videos can be distributed instantaneously, leaving a digital footprint that can be difficult to remove. Today’s photographs contain far more data than meets the eye. A picture or video from a smartphone contains metadata with locations, dates, and even the time.9 When combining this metadata with facial data, a harmless selfie taken with friends can reveal details akin to police surveillance.
The state of Illinois has been one of only five states that regulate the use of facial data.10 The Illinois Biometric Information Privacy Act attempts to address privacy concerns by requiring entities that collect biometric data to obtain consent before gathering, selling, or disclosing biometric data, which includes “a retina or iris scan, fingerprint, voiceprint, or scan of hand or face geometry.”11 The law goes as far as to raise a right of action for injured parties to sue violators.12 So far, courts have generally upheld an interest in the privacy of facial data.13
However, the Illinois Biometric Information Privacy Act is limited in application to private entities. The federal government has not yet addressed its collection and use of facial data, an issue complicated by the fact that a vast number of adults living and working in the U.S. have already handed their facial data over to the authorities. 14 In obtaining a driver’s license or passport, many law-abiding citizens have already added to a federal database containing over a 100 million records, accessible by over 18,000 law enforcement agencies.15
With Apple likely to clash again with the government on security matters, the future of the right to privacy will almost certainly need to address facial data.16 Whereas a password, home address, or credit card number can be altered easily, a face generally remains the same, barring costly surgery.
The Supreme Court in Katz v. United States, famously declared that “the Fourth Amendment protects people not places”.17 As facial recognition systems become commonplace in society, the law will need to adapt, striking a balance between a legitimate interest in investigation and the privacy of your face.