| Use or effect | What the evidence shows | Planning use |
|---|---|---|
| One-to-one verification | Commonly used for unlocking a smartphone or checking a passport. A false negative is usually an inconvenience, often fixed by a second attempt. | Best fit for facial recognition. Provide a retry or an alternative way in. |
| One-to-many identification | Can be used to identify a person of interest. A false positive puts an incorrect match on a list of candidates that warrant further scrutiny. | Treat a match as a lead for human review, never as proof. |
| Convenience, security and efficiency | Cited together as the main upside, alongside privacy and civil liberties risks. | Weigh each claimed gain against the privacy cost before deploying. |
| Demographic error differences | Most tested algorithms show demographic differentials, often 10 to 100 times in one-to-one false positives, depending on the algorithm. | Ask for results by demographic group before choosing a system. |
These figures come from the NIST study of face recognition software and an ISACA analysis of facial recognition and privacy.
The benefits of facial recognition technology are real but depend on the task. One-to-one verification, such as unlocking a phone or checking a passport, carries lower stakes than one-to-many identification, where errors can lead to false accusations.
The legal side shapes how far those benefits can be used, so read this alongside our guide to data privacy laws explained.
Where the benefits show up
Facial recognition delivers its clearest value where a person is checking a claimed identity, and its weakest case where it searches a crowd. ISACA lists convenience, security and efficiency as the draw, with uses ranging from unlocking smartphones and tagging photos on social media to surveillance in public spaces and identity verification at airports.
Verification: phones, passports and airports
In verification, the system compares one face against one stored record. NIST describes this one-to-one matching as commonly used for unlocking a smartphone or checking a passport. The failure mode is forgiving: a false negative in a one-to-one search might be merely an inconvenience, and a second attempt often resolves it.
That makes verification the most defensible use for organizations that need to confirm who someone is. It suits a service where the person knows the camera is there and has taken part deliberately. It suits airport identity checks too, which ISACA names among common uses, provided travelers have another route when a scan fails.
Identification for security work
Identification works differently. The system searches a database for a possible match to an unknown face, and NIST notes it can be used for identification of a person of interest. According to a TechReg analysis, law enforcement authorities have used facial recognition technologies for many years in both the US and the EU.
The security upside is a shortlist of candidates that investigators can follow up. The cost sits in the errors: a false positive in this search puts an incorrect match on a list of candidates that warrant further scrutiny. The practical rule is that a hit should start a human check and should not justify action on its own.
How accurate facial recognition is
Accuracy varies by algorithm and by who is being matched, so a single headline figure would mislead. The most thorough public evidence is the NIST evaluation published on 19 December 2019, which evaluated 189 software algorithms from 99 developers.
What NIST measured
NIST found that the majority of face recognition algorithms exhibit demographic differentials. A differential means an algorithm’s ability to match two images of the same person varies from one demographic group to another.
- One-to-one matching: false positive differentials often ranged from a factor of 10 to 100 times, depending on the algorithm, when comparing Asian and African American faces with Caucasian faces.
- One-to-many matching: the team saw higher rates of false positives for African American females. Because this is the search type used to build candidate lists, NIST notes the consequences could include false accusations.
- Algorithm-to-algorithm variation: NIST states plainly that different algorithms perform differently, so a finding about one system does not carry over to another.
ISACA’s secondary account points the same way, reporting that false positive rates are significantly higher among women and people of color.
What this means when choosing a system
The encouraging finding is that the algorithms NIST found most equitable also rank among the most accurate. Fairness and accuracy are therefore not a trade-off, and a buyer can reasonably demand both. NIST also notes that it does not test the finalized commercial products that use these algorithms, so a strong algorithm result is a starting point and not a guarantee for a deployed product. Ask any supplier for group-by-group error results on the exact system you would run.
Privacy risks that offset the benefits
Facial data carries risks that a password does not, which is why the privacy cost belongs in any benefits assessment. ISACA’s analysis identifies several recurring problems:
- No reset: unlike passwords or credit card numbers, faces cannot be changed. A breach can enable identity theft or stalking with no remedy of the kind a new password provides.
- Weak protection: facial data is often not encrypted, which makes it easier for malicious actors to exploit.
- Hidden scanning: many systems operate without informing individuals that their faces are being scanned, so people cannot object or ask questions.
- Missing oversight: government and private entities often deploy the technology without independent review or accountability mechanisms.
Individuals who want to limit their exposure can start with the steps in Protect Your Online Privacy: A Practical 2026 Guide To Reclaim Your Data – Technopolicy. For the commercial side of the market, AI Surveillance Companies: Who’s Building The Surveillance State In 2026 — Key Players, Risks, And What You Need To Know – Technopolicy covers who builds these systems.
Legal limits on facial recognition
Facial recognition is regulated, but unevenly, and the rules depend on where and by whom it is used. No single global standard exists, so a deployment that is lawful in one jurisdiction may be restricted in another.
- United States, state level: BIPA and CCPA offer some protections, but ISACA notes these laws vary widely in scope and enforcement. BIPA is the Illinois biometric privacy statute, and biometric data such as a face template is the kind of information it addresses.
- United States, policy choices: the TechReg analysis finds that some US legislators adopted bans or moratoriums, while others chose more nuanced regulation.
- European Union: the EU has proposed restrictions under the AI Act, though ISACA says enforcement and compliance remain inconsistent. For law enforcement use of live facial recognition in public spaces, TechReg reports a partial ban with many broad exceptions.
The practical lesson is to check the rules for each place and each type of user before relying on a benefit. A ban with broad exceptions can still allow the use you assumed was prohibited, and a patchwork of state laws means one national rollout may face several different standards.
Deciding whether the benefits justify deployment
The benefits justify deployment when the task is verification, the people involved know about it, and the error consequences are minor. They justify it far less when the system searches the public for matches. A few decision rules follow from the evidence above:
- Match the method to the stakes: use one-to-one checks where a failed scan costs a retry. Reserve one-to-many search for cases with trained reviewers who can discard bad matches.
- Buy on measured results: prefer algorithms with documented performance across demographic groups, since NIST found accuracy and equity tend to go together.
- Make it opt-in: ISACA’s position is that facial recognition should be opt-in, not opt-out, which also answers the problem of people being scanned without being told.
- Protect the template: encrypt stored face data, because a leaked face cannot be replaced.
- Add independent review: build in the accountability mechanisms that ISACA says many deployments lack.
Frequently asked questions
What did Clearview AI do with social media images?
ISACA reports that Clearview AI scraped billions of images from social media to build a massive facial recognition database. It is a commercial example of faces being collected without the people involved being asked.
Is law enforcement use of facial recognition new?
No. The TechReg analysis notes that law enforcement authorities have been using facial recognition technologies for many years in both the US and the EU, so current debates concern limits on a long-running practice.
What data did NIST use for its demographic test?
NIST used operational government databases containing 18.27 million images of 8.49 million people. That scale is one reason its findings carry weight for algorithm-level comparisons.
