Facial Recognition & Identity Verification: Use Cases and Ethics

The European Union prohibited most real-time facial recognition in public spaces in February 2025. It did not prohibit unlocking your phone with your face, or matching a selfie against a passport photo during account opening. Both are facial recognition.

That split isn't a loophole, it reflects a real technical and ethical distinction that most public debate collapses. AI identity verification covers two operations with opposite risk profiles, and almost every meaningful question about use cases, accuracy, bias, and law depends on which one you're talking about.

The asymmetry in the failure row is the ethical crux. A false match in 1:1 verification inconveniences the person it happens to, who can retry or escalate. A false match in 1:N identification can place a stranger at a crime scene, and the person harmed usually has no idea it happened until consequences arrive.

Both operations share the same pipeline up to the final step. A detector locates faces in the image. An alignment step normalises pose and scale. An embedding model converts the face into a numerical vector, a few hundred numbers capturing geometric relationships, and it's this vector rather than the photograph that gets stored and compared. A similarity score is computed against the reference, and a threshold converts that score into a decision.

The threshold is where policy enters engineering. Set it strict and you reduce false matches while locking out more legitimate users; set it loose and the reverse. There is no setting that eliminates both errors, which is why any vendor quoting a single accuracy figure without stating the operating threshold is describing one point on a curve as though it were the whole curve.

Production verification systems add liveness detection, which confirms a real person is present rather than a photograph, screen replay, mask, or injected deepfake video. This has become the harder half of the problem as generative tools have improved, and it's a separate model from the matching itself.

The consented, participatory side of this technology is now routine infrastructure: device unlock, account recovery, airport e-gates, age assurance, and remote onboarding for regulated services.

Financial onboarding is the highest-volume commercial case. A typical flow captures an identity document, extracts and validates its data, captures a live selfie, confirms liveness, and matches the two. KYC automation with OCR covers the document extraction half of that pipeline, which does much of the work before any face matching happens. A document verification in practice deployment shows the same principle applied to catching fraudulent documentation that manual review would likely have missed.

What makes these deployments defensible is not the technology but the conditions around it: the subject knows it's happening, has chosen to participate, is matching against a reference they supplied, and has a fallback route if it fails.

This is genuinely contested, and both positions rest on the same body of evidence, NIST's Face Recognition Vendor Test programme. It's worth setting out each fairly.

Rules now track the 1:1 versus 1:N distinction closely rather than regulating "biometrics" as a single category.

European Union. Under the AI Act, a defined set of practices has been prohibited since February 2025: most real-time remote biometric identification in public spaces, untargeted scraping of facial images to build databases, biometric categorisation to infer protected characteristics, and emotion recognition in workplaces and schools. Narrow law enforcement exceptions exist for terrorist threats, trafficking victims, and missing persons, each requiring prior judicial authorisation and enabling domestic law. Retrospective identification is treated as high-risk rather than banned, and the Act becomes fully applicable in August 2026.

United States. No federal statute; a patchwork instead. Illinois's BIPA and Texas's CUBI impose consent requirements, with BIPA's private right of action driving substantial litigation. State laws continue to arrive: Virginia's takes effect July 2026, and Maryland's prohibits arrest based solely on a facial recognition result, requires defendants be notified when it was used, and mandates officer training.

United Kingdom. No dedicated statute, making it an outlier among comparable jurisdictions. London's Metropolitan Police scanned roughly one million faces in 2025 under general data protection law rather than purpose-built rules.

For organisations building verification rather than surveillance, a handful of commitments carry most of the ethical weight.

Store vectors, not photographs, and treat them as biometric data under whichever regime applies. Keep purpose narrow: a face captured for account opening should not later populate a search database, which is precisely the drift regulators are targeting. Provide a non-biometric fallback, since demographic error gaps mean a face-only path fails unevenly across your user base. Keep a human in the loop for consequential decisions, and never let a match alone drive an irreversible action.

The through-line is that most of what makes a facial recognition deployment acceptable or unacceptable is decided outside the model: who consented, what happens on failure, what else the data gets used for, and whether anyone reviews the result before it matters.