A council announces smarter cameras. What has changed? AI surveillance technology adds machine-learning analysis to camera and sensor data, so systems can identify and follow people, not just record them. How lawful that is depends on region and use.
The rest of this guide takes the common misunderstandings one by one and ties each to the rules that apply. For the wider legal landscape, see our overview of data privacy laws explained.
What AI surveillance technology covers
The first misunderstanding is that AI surveillance is just a camera with a new label. The Rutgers AI Ethics Lab glossary describes it as the use of AI systems to collect and process large volumes of data from various sources, including cameras and sensors. The camera is one input. The analysis layered on top is what changes the power of the system.
That analysis can draw on several streams at once. Brookings describes how social media monitoring, cameras and facial recognition can be combined so that authorities can track dissidents, using China as its example. It also lists data brokers, who buy and sell information, as part of the risky mix. The ACLU of Massachusetts says that Palantir and Babel Street apply machine learning algorithms to look for patterns in aggregated information.
In practice, it helps to think of three layers: collecting data, aggregating it, and finding patterns or identities in it. Each layer can be regulated, or left unregulated, separately.
Common misunderstandings at a glance
| Common assumption | What the evidence supports | Planning use |
|---|---|---|
| Facial recognition simply matches a face to a name. | It is a probabilistic technology designed to recognize individuals automatically from their face. | Treat any match as a likelihood that needs human checking, not as proof. |
| It only works on live video. | Live recognition compares CCTV footage with database images, while retrospective recognition uses past footage. | Ask which mode a system uses, because rules are often written around one mode. |
| The EU has banned it. | The AI Act prohibits real-time remote biometric identification in publicly accessible spaces for law enforcement, with limited scope and broad exemptions, and omits an outright ban on use in those spaces. | Read the exemptions before assuming a deployment is unlawful. |
| It works equally well for everyone. | Cited research reports lower accuracy for people aged 18–30, particularly women and people of colour. | Ask for accuracy evidence that covers the groups the system will actually scan. |
These points come from a scholarly review of facial recognition and the law and a Stanford working paper on the EU AI Act.
How the systems work
Facial recognition is the best-documented component. The scholarly review calls it a probabilistic technology built to recognize individuals from their face. Because the output is probabilistic, a result is a statistical judgement, which is why error rates and human review matter so much in any deployment.
The same review describes three operating modes:
- Live facial recognition (LFR): compares footage from CCTV with images held in databases as it arrives.
- Retrospective facial recognition (RFR): runs recognition on past footage after an event.
- Operator-initiated facial recognition (OIFR): a third mode named in the review, in which the recognition is triggered by an operator.
Video analytics products go further than matching single faces. A user guide for BriefCam obtained by the ACLU of Massachusetts, as the group reports, reveals extensive reliance on facial recognition technology and machine learning to automatically identify and follow individuals across multiple camera feeds. Following a person from camera to camera is a different act from checking one image against one list, and it raises different questions about proportionality.
The mode matters when reading the law. The EU prohibition, for example, is worded around real-time remote identification, so check which mode a system uses before assuming a given rule applies. That legal question connects directly to the harms below.
Privacy and civil liberties risks
The privacy risks fall into accuracy problems, behavioural effects and data aggregation. Each calls for a different safeguard.
- Misidentification: the ACLU of Massachusetts says facial recognition technology is far from perfect and has well-documented misidentification problems.
- Uneven accuracy: the scholarly review cites empirical research finding the technology less accurate for people aged 18–30, particularly women and people of colour. A system validated on one population cannot be assumed to perform equally on another.
- Chilling effects: the Rutgers glossary says AI-powered surveillance can chill individuals’ behaviour. The scholarly review links facial recognition to threats to freedom of speech, leading to a spiral of silence, and says research has established that its use undermines the right to privacy.
- Biased targeting: predictive policing has been criticized for reinforcing racial biases and targeting specific communities, according to the same glossary.
- Data aggregation: Brookings points to data brokers as one ingredient that makes AI-enabled surveillance riskier, because bought data can feed the analysis.
- Eroding protections: the ACLU of Massachusetts notes that in Carpenter the Supreme Court warned that privacy rights could be eroded by modern surveillance technology.
Individuals who want to understand their own position can start with Digital Rights And Responsibilities: Your Practical Guide To Staying Safe, Legal, And Empowered Online (2026) – Technopolicy. The next question is what the law actually requires, and the answer varies by region.
Regulation of biometric surveillance by region
Yes, AI surveillance is regulated, but unevenly. The European Union has specific rules for facial recognition, while US protections are narrower and more fragmented.
European Union
Two instruments matter. The first is the GDPR, which the Rutgers glossary describes as a legal framework that seeks to protect individuals’ rights and establish limitations on data collection and use. The second is the EU AI Act, which sets a risk-based regime. The scholarly review places real-time and remote biometric identification, such as facial recognition, among the Act’s unacceptable-risk categories. The Stanford analysis says the Act categorizes most facial recognition technologies as either a prohibited AI practice or high-risk AI.
The prohibition itself is narrower than the label suggests. It covers real-time remote biometric identification in publicly accessible spaces for law enforcement purposes, with limited scope and broad exemptions. The Stanford paper notes that the Act omits an outright ban on facial recognition use in publicly accessible spaces. High-risk systems must undergo a fundamental rights impact assessment prior to their first application. For organisations that hold surveillance data, Data Protection Compliance: A Practical 2026 Checklist To Keep Your Business Safe – Technopolicy covers the compliance side.
United States
The US has no comparable national framework. In April 2025 commentary, Brookings observed that in the absence of a national privacy bill there are few legal safeguards limiting workplace computer or network surveillance, and that these practices are perfectly legal in many states.
Constitutional protection exists but is tied to specific facts. The ACLU of Massachusetts says the Fourth Amendment and Massachusetts Article 14 guarantee the right to be free from warrantless government surveillance and tracking. It adds that, under the Augustine and Carpenter decisions, police cannot track people via their cell phone location for extended periods without a warrant. Those rulings concern phone location, not facial recognition.
License plate readers show the gap. The same organisation reports that more than 80 Massachusetts police departments have adopted automatic license plate reader systems, while no state laws regulate the use of this location tracking technology. The group’s document is dated February 12, 2026.
What to check before relying on or accepting a system
A few questions separate a defensible deployment from a risky one, whether you are buying a system, sitting on a oversight board or simply asked to consent.
- Which mode is in use: live, retrospective or operator-initiated recognition can fall under different rules, so confirm before relying on a legal conclusion.
- Whether an impact assessment exists: under the EU AI Act, high-risk facial recognition requires a fundamental rights impact assessment before first application. Elsewhere, asking for one is still a sensible test of seriousness.
- Who the accuracy evidence covers: given the reported gaps for younger people, women and people of colour, vendor claims should be tested against the population that will be scanned.
- Where the data comes from: bought or aggregated data can widen what a system knows, so ask whether data brokers or social media monitoring feed the analysis.
- What law actually applies: where no national or state rule exists, as in the US cases above, internal limits and public oversight carry more weight than legal compliance alone.
Frequently asked questions
| Question | Answer |
|---|---|
| Is facial recognition the same as AI surveillance? | No. Facial recognition identifies people from their face, while broader AI surveillance also draws on sensors and other data sources and applies machine learning to look for patterns. |
| Does GDPR cover surveillance data? | The Rutgers AI Ethics Lab glossary presents GDPR as an EU framework that seeks to protect individuals’ rights and limit data collection and use. The AI Act adds rules aimed at biometric identification specifically. |
| Are automatic license plate readers regulated in the US? | In Massachusetts, the ACLU says no state laws regulate this location tracking technology, as of its February 2026 document. |
| Can surveillance change how people behave? | Yes. Research summarised in the scholarly review links facial recognition to threats to freedom of speech and a spiral of silence, and the Rutgers glossary describes a chilling effect on behaviour. |
