Background

Facial recognition technology is one of several biometric technologies,  which identify individuals by measuring and analyzing their physiological  or behavioral characteristics. Biometric technologies have been  developed to identify people using their faces, fingerprints, hands, eye  retinas and irises, voice, and gait, among other things. Unlike  conventional identification methods, such as a card to gain building  access or a password to log on to a computer system, biometric  technologies measure things that are generally distinct to each person  and cannot easily be changed.
There are generally four basic components to a facial recognition  technology system: a camera to capture an image, an algorithm to create  a faceprint (sometimes called a facial template), a database of stored  images, and an algorithm to compare the captured image to the database  of images or a single image in the database. The quality of these  components determines the effectiveness of the system. In addition, the  more similar the environments in which the images are compared—such  as the background, lighting conditions, camera distance, and size and  orientation of the head—the better a facial recognition technology system  will perform.
Facial recognition technologies can perform a number of functions,  including (1) detecting a face in an image; (2) estimating personal  characteristics, such as an individual’s age, race, or gender; (3) verifying  identity by accepting or denying the identity claimed by a person; and (4)  identifying an individual by matching an image of an unknown person to a  gallery of known people. According to FTC staff, academics, and industry  experts, most modern facial recognition systems generally follow the  steps shown in figure 1.
Facial recognition systems can generate two types of errors—false  positives (generating an incorrect match) or false negatives (not  generating a match when one exists). NIST has measured the  performance of companies’ facial recognition algorithms since 1993 and  has found that the technology has improved over time. Most recently,  NIST’s Face Recognition Vendor Test in 2014 found that the error rates  continued to decline and algorithms had improved at identifying  individuals from images of poor quality or captured under low light. In  addition, research supported by the Technical Support Working Group, a  federal interagency group, showed that in certain controlled tests, facial  recognition algorithms surpassed human accuracy in determining whether  pairs of face images, taken under different illumination conditions, were  pictures of the same person or of different people.
NTIA is the agency principally responsible for advising the President on  telecommunications and information policy issues, including those related  to privacy. In February 2014, NTIA began a “multistakeholder process”  that has convened various stakeholders to discuss protection of  consumer privacy in current and emerging commercial uses of facial  recognition technology. This process, which is ongoing, was outlined in a  2012 White House privacy framework, which directed NTIA to convene  multistakeholder processes that consist of open, transparent forums in  which stakeholders work toward consensus on voluntary, legally  enforceable codes of conduct for specific markets or business contexts.  The framework also presents privacy principles in the form of a proposed  Consumer Privacy Bill of Rights, and states that the codes of conduct  developed in NTIA’s multistakeholder processes should specify how  those principles would apply to different technologies or markets.
FTC is a law enforcement agency that plays a role in enforcing key  privacy and consumer protection laws. In December 2011, FTC hosted a  workshop—Face Facts: A Forum on Facial Recognition Technology—that  explored privacy issues associated with facial recognition technology. It  issued a staff report in October 2012 that synthesized those discussions  and recommended best practices for the use of the technology in the  context of protecting consumer privacy.

	Facial Recognition Technology Can Be Useful for Many Commercial Applications, but the Extent of Its Use Is Not Fully Known

Facial recognition technology is currently being used in a number of U.S.  commercial applications for functions including safety and security,  secure access, and marketing and customer service. However the full  extent of its present use is not known.

		Facial Recognition Technology Has Applications That Can Be Useful to Consumers and Businesses

Facial recognition technology offers applications beneficial to both  consumers and businesses, according to industry representatives and  other stakeholders. The International Biometrics & Identification  Association has noted that facial recognition and other biometric  technologies have until recently been used most prominently by  government and law enforcement agencies, such as to protect borders  and ports and to identify criminals. However, FTC staff and industry  sources have reported that commercial interest and investment in facial  recognition technology have grown as the technology has become more  accurate and less costly, with new applications being developed for  consumers and businesses. The Direct Marketing Association has said  that businesses are finding that facial recognition technology can be used  as a way to communicate with consumers and provide new tools,  products, and services. Industry trade organizations and companies that  use and develop facial recognition software have cited four major types of  functions that they say do or will benefit from facial recognition  technology: photograph identification and organization; safety and  security; secure access; and marketing and customer service.
Photograph identification and organization. One of the most well- known current uses of facial recognition technology is photograph  identification in social networking applications. For example, some of the  top social networking applications use facial recognition technology to  identify individuals in photographs. In testimony before Congress, a  representative of one such application noted that this allows users to  instantaneously link photographs from birthdays, vacations, and other  events with people who participated. In addition, several applications  use facial recognition technology to help individuals organize personal  photographs stored online or on computer drives. For example, several  photograph management software programs can detect individuals, such  as family members, which the user has asked to be identified. The  programs then automatically add new photographs of these individuals to  a photograph album created by the user.
Safety and security. Some retailers, casinos, financial institutions, and  apartment buildings use facial recognition technology for safety and  security purposes. According to the National Retail Federation, some  retailers in the United States are testing systems that use facial  recognition technology with closed-circuit television for theft prevention.  According to one vendor of such a system with whom we spoke, security  cameras in a retail location compare images of individuals who walk into  a store against a database of images of known shoplifters, members of  organized retail crime syndicates, or other persons of interest. If a match  is found, security personnel or management are alerted and provided  whatever information is known about the individual. Some casinos in the  United States similarly use facial recognition systems to help them  identify known or suspected gambling cheaters, members of organized  crime networks, or other known persons of concern. Facial recognition  technology has also been incorporated into the security systems of some  financial institutions to identify robbery suspects or accomplices.  According to a vendor of this technology, these systems deter crime and  help identify suspects much faster than traditional means, which require  staff to spend hours reviewing video recordings. Facial recognition  systems have also been used in large apartment buildings to help identify  perpetrators of crimes or other known persons of concern who seek to  enter the property, according to one software vendor with whom we met.
Secure access. Facial recognition technology can be used to provide  secure physical access control to buildings or other locked areas. For  example, some systems unlock a door after a camera confirms the user’s  identity through facial recognition. In addition, applications exist that allow  users to unlock personal computers and smartphones, log into video  game consoles, or record workplace time and attendance by recognizing  their face, in lieu of using a password or personal identification number.  Some systems can distinguish whether an image is live to prevent the  use of printed photographs to gain access. Industry representatives have  noted that these applications have the benefit of not requiring consumers  to remember a password and may eventually become an effective  voluntary alternative to the use of passwords to access online  transactions.
Marketing and customer service. Industry trade organizations have  said they envision retailers and others using facial recognition technology  to target marketing and advertising more effectively and improve  customer service. The Direct Marketing Association has stated that facial  recognition technology has the potential to help businesses provide more  customized and improved products and services, conduct market  research and product development, provide more tailored and relevant  messaging and advertising, and offer a more secure shopping  experience. Facial recognition technology is already used in digital  signs—usually televisions or kiosks displaying advertisements in stores— with cameras that recognize characteristics of the viewer, such as gender  or age range, and target advertisements accordingly. This allows retailers  and advertisers to show relevant products and deals in real time, possibly  leading to more sales, according to the Digital Signage Federation. In  the future, such signs may be used to identify customers by name and  target advertising to them based on past purchases or other personal  information available about them, according to FTC staff. Facial  recognition systems can also be designed to alert staff when known  customers enter the store, according to a software vendor with whom we  spoke. Representatives of the National Retail Federation told us they  could envision retailers using facial recognition systems to track customer  movements around the store to provide the customer with a better  shopping experience.
Other uses. Several other current or potential uses for facial recognition  technology have been cited by industry stakeholders:
Facial search engines. Internet search engines are being developed  to allow users to conduct a search using a facial image, or to enter a  name to search for images that match the name.
Online dating. Some online dating companies use facial recognition to  determine the facial features a user finds most attractive and search  their database for individuals with similar features.
Memory support. A memory support application for smartphones  assists people with prosopagnosia (face blindness) or other memory- related conditions by confirming the identities and providing the  names of family members, friends, caregivers, or others.
Hospitality. Facial recognition technology can be used by hotel and  guest services industries to identify guests and enable personalized  service without having to ask for a guest name or a room number.
NTIA staff told us that the next major expansion for facial recognition  technology could be in mobile applications for consumers. Industry  representatives and some experts and privacy advocacy organizations  have noted that the technology can be deployed in cell phone  applications to compare faces captured by the phone to a database of  facial images. Some academics have noted that in the future, these  types of applications could be integrated into wearable systems, such as  eyeglasses.

		The Extent of Commercial Use of Facial Recognition Technology Is Not Fully Known

Facial recognition technology is currently being used in a number of  commercial applications in the United States, but the full extent of its  present use is not known. The International Biometrics & Identification  Association, other industry trade organizations, and FTC staff told us they  knew of no comprehensive reliable information on the extent to which  U.S. businesses use facial recognition technology. Similarly, our review of  literature associated with the technology identified no such data.  Representatives of the National Retail Federation and Retail Industry  Leaders Association told us that their sense was that retailers are not  using the technology broadly. Several large companies contacted on  our behalf by trade associations declined to speak with us about their use  of the technology. An industry trade organization representative told us  that companies may be reluctant to discuss the technology for  competitive reasons.
Two applications in which facial recognition technology appears to now  be widely used are photograph identification and management and  security access. One large social networking service with more than 1  billion monthly users started using facial recognition technology in 2011 to  facilitate “tagging” users’ friends in photographs. Other large companies  have incorporated the technology into photograph management and  social networking applications. Representatives of six other top social  networking companies told us that they do not currently use facial  recognition technology. Facial recognition technology also has become  relatively widely used in providing secure access. For example, versions  of one major operating system allow users to unlock devices via facial  recognition, as do two of the best-selling home video game systems.  Many other companies also offer hardware, software programs, or mobile  phone applications using facial recognition technology for photograph  management or secure access.
In contrast, our review found that less is known about the current  prevalence of facial recognition for marketing and security uses.  According to the World Privacy Forum, some companies in Europe and  Asia currently use facial recognition technology to enhance marketing and  customer service, but such use in the United States is less common. A  representative of the National Retail Federation told us that U.S. retailers  were exploring facial recognition for such purposes, but were taking a  slower approach than their overseas counterparts because of concerns  over customer reaction. According to the Digital Signage Federation,  some digital signs in the United States, such as video monitors displaying  advertisements in stores, are used to detect a face or characteristics,  such as age and gender for targeted marketing.
Some safety and security applications using facial recognition technology  are marketed to retailers, casinos, financial institutions, and other  businesses, but the extent of their use is uncertain. A representative of  the National Retail Federation said that many retailers were at least in the  early stages of looking into facial recognition systems for security  purposes, but knew of no data on their current use. A representative of  the American Gaming Association told us that facial recognition does not  appear to be widely used in U.S. casinos, but that it did not have  comprehensive data on such use. Representatives from the American  Bankers Association and Financial Services Roundtable told us that they  were unaware of any data on the extent of use of facial recognition  technology by financial institutions. The American Bankers Association  representative said at least one major U.S. bank uses facial recognition  technology to identify robbery suspects, but two other major banks stated  the technology was not in broad use by financial institutions because of  concerns over its accuracy. The International Biometrics & Identification  Association told us that some businesses are reluctant to disclose use of  the technology because publicizing their specific security practices can  diminish their effectiveness.

	Stakeholders Have Raised Privacy Concerns Related to the Commercial Use of Facial Recognition Technology

A number of stakeholders—including federal agencies, privacy and  consumer groups, and some industry representatives—have identified  privacy issues related to commercial use of facial recognition technology.  In particular, concerns have been raised by the technology’s potential to  identify and track individuals in public without their knowledge, and  around the collection, use, and sharing of personal data associated with  the technology. However, some industry stakeholders have argued that  the technology does not present new or unusual privacy risks, or that  such risks can be mitigated.

		Privacy Concerns Have Been Raised Related to the Ability to Identify and Track Individuals in Public

While acknowledging the potential benefits of commercial use of facial  recognition technology, government agencies, privacy advocacy  organizations, academics, and others have raised a number of privacy  concerns about the technology and its future direction. As noted earlier,  facial recognition technology continues to rapidly improve in accuracy.  Further, individuals continue to upload billions of pictures to social  networking and other Internet sites, creating a vast repository of facial  images that are often linked to names or other personal information. The  convergence of these two trends may make it technically feasible one day  to identify almost any individual in a wide range of public spaces,  according to some privacy advocacy organizations and others. Key  privacy concerns related to the commercial application of facial  recognition technology have generally centered around (1) its effect on  the ability of individuals to remain relatively anonymous in public; (2) the  capacity to track individuals across locations; and (3) use of facial  recognition without individuals’ knowledge or consent.

			Reduction of Anonymity

During the NTIA multistakeholder process, some participants expressed  concern that facial recognition technology could affect personal privacy by  reducing individuals’ ability to be anonymous when in a public or  commercial space, such as a sidewalk or store. The Center for  Democracy & Technology has noted that when most individuals are in  public, they expect a few people or businesses to recognize their face,  but fewer to connect a name to their face, and even fewer to associate  their face with Internet behavior, travel patterns, or other profiles.
Commercial use of facial recognition technology for identification  purposes, the group states, has the potential to change this dynamic by  allowing companies or individuals to collect information on any individual  captured by a camera. Privacy advocacy organizations and academics  have expressed concern that as being remotely identified in commercial  settings becomes more common, some individuals may be uncomfortable  visiting certain places, shopping at certain establishments, or assembling  in public for a cause they support. Further, the Electronic Privacy  Information Center has stated that individuals lose some control over their  identity if they are not allowed to choose whether or not they want to  remain anonymous in public. The organization has also noted that  additional privacy concerns would be raised by use of the technology to  identify not just who someone is, but whom they are with.

			Tracking

Some participants in the NTIA multistakeholder process and others have  expressed concern that facial recognition technology could be used to  track individuals’ movements in public, which they said could erode  personal privacy. Industry sources told us that, at present, facial  recognition technology is not used in a commercial context to track  consumers on any widespread scale. However, the Center for Democracy  & Technology has stated that if use of the technology to identify  individuals in public were deployed widely enough in the future, and if  businesses shared facial recognition data with one another, the result  could be a network of cameras that readily tracked a consumer’s  movements from location to location. Further, it noted that unlike other  tracking methods, facial recognition does not require an individual to wear  a special device or tag, which reduces individuals’ ability to avoid  unwanted tracking. A representative of the World Privacy Forum told us  that most consumers would find it invasive of their privacy for security  cameras to be used to track their movements for marketing purposes.  Likewise, FTC staff have reported that the privacy risks for consumers  would increase if companies began using images gathered through digital  signs to track consumers across stores. These issues are underscored by  concerns consumers have expressed about being tracked in other  contexts. For example, a 2009 consumer survey on marketing found that  about two-thirds of respondents did not want online advertising targeted  to them if it involved having their offline activity tracked. Likewise, a  representative of the National Retail Federation told us that customers of  a major department store chain reacted negatively after the store posted  signs disclosing that customers’ movements within the store were being  tracked via their mobile phones.

			Knowledge and Consent

Another concern that has been raised is the commercial use of facial  recognition technology for identification or verification without individuals’  knowledge or consent. Unlike other biometrics, such as fingerprint  identification, facial recognition technology can be used to capture a face  remotely and without the individual’s knowledge. In addition, even if  consumers are notified and given the option to opt out of the technology,  that option may become less feasible as the use of this technology grows.  Some industry trade organizations have acknowledged these concerns  and expressed caution over deploying the technology in certain contexts  without consumer notification and consent. For example, the Software &  Information Industry Association said that firms may need to obtain  consent prior to deploying the technology in digital signs to identify  individuals and record their interests and preferences. The Computer and  Communications Industry Association stated that firms’ use of facial  recognition technology to match individuals’ names and other  biographical information with their faces should be transparent and  provide individuals the ability to opt out.

		Some Stakeholders Believe Facial Recognition Technology Raises Issues about the Use and Security of Personal Data

Privacy advocacy organizations, government agencies, academics, and  some industry representatives also have raised privacy and security  issues associated with personal data collected in conjunction with  commercial use of facial recognition technology. Many of these issues  mirror concerns about the collection, use, and sharing of personal data  more broadly by commercial entities. Key data privacy issues that have  been raised with regard to facial recognition technology in particular  include the following:
Consumer control over personal information. Some privacy  advocacy organizations and others have reported that, like other  forms of personal data, information that is collected or associated with  facial recognition technology could be used, shared, or sold in ways  that consumers do not understand, anticipate, or consent to.  Commenters to the FTC Face Facts Forum noted that the proliferation  in recent years of information resellers, and of data sharing among  third parties, raises questions about whether faceprints and  associated personal data may one day be sold or shared. Facial  recognition data may be particularly valuable to marketers because  they potentially could link a person’s online presence and offline  presence, according to two experts we spoke with. One privacy expert  told us that risks to consumer privacy would increase if retailers were  to develop relationships with social networking sites, which typically  possess consumers’ facial images and detailed personal information  that could be used for marketing. As we concluded in our September  2013 report on information resellers, consumers generally do not have  the right to prevent their personal information from being collected,  used, or shared for marketing purposes.
Data security. Industry trade organizations, government agencies,  and privacy advocacy organizations have noted that commercial use  of facial recognition technology raises the same security concerns as  those associated with any personal data. Participants in the NTIA  multistakeholder process noted that facial recognition data could be  subject to data breaches that result in sensitive biometric data being  revealed to unauthorized entities. Because a person’s face is unique,  permanent (absent surgery), and therefore irrevocable, a breach  involving data derived from or related to facial recognition technology  may have more serious consequences than the breach of other  information, such as passwords or credit card numbers, which can be  changed. The Electronic Privacy Information Center has stated that  the risk of theft of data associated with the technology could increase  the possibility of identity theft, harassment, and stalking. The  International Biometrics & Identification Association has said that  faceprints, when stored with other identity data, should be considered  personally identifiable information and provided all the security and  privacy protections bestowed upon these personal data. At the same  time, industry representatives have noted that security concerns are  mitigated, to some extent, because at present faceprint algorithms are  specific to a vendor and of little use outside that vendor’s system if  obtained through a breach.
Misidentification. Industry and other stakeholders have said that  facial recognition technology may generate more matching errors than  other forms of biometric identification because facial recognition  technology systems are currently less accurate than other biometrics.  Representatives of the Electronic Privacy Information Center have  expressed concern that if someone’s image is captured and  misidentified, adverse information—such as an incorrect identification  of an individual as a shoplifter—could propagate in the long-term  throughout different commercial systems, sometimes without the  individual’s knowledge.
Disparate treatment. Some stakeholders in the NTIA  multistakeholder process expressed concerns about disparate  treatment for certain groups based on information derived from facial  recognition systems. They also noted that individuals who declined to  consent to a retailer’s request for facial recognition could be denied  access to certain products or services. The World Privacy Forum  expressed the view that digital signage networks have the potential to  create a new form of marketing surveillance that it believes raises the  possibility of unfairness, discrimination, and abuses of personal  information. In addition, the Center for Democracy & Technology has  expressed concerns about the use of facial recognition technology for  classification purposes, such as to detect gender, race, and age  range. The organization expressed the view that this could lead to  profiling—the use of personal characteristics or behavior patterns to  make generalizations about a person—that could lead to, for example,  price discrimination for certain groups.

		Other Stakeholders Believe That the Technology Does Not Present New or Unusual Privacy Risks

In contrast, some industry representatives have argued that commercial  use of facial recognition technology does not present new or unusual  privacy risks, that risks that do exist can be mitigated, and that any  potential loss of privacy should be weighed against the benefits the  technology confers. In position papers, other written materials, or in  interviews we conducted, some industry stakeholders have expressed the  following views:  Individuals should not expect complete anonymity in public. The  National Retail Federation and the International Biometrics &  Identification Association have argued that individuals effectively give  up some of their anonymity when they make their faces public. The  latter has contended that privacy and anonymity are not the same and  that losing complete anonymity is not tantamount to a surrender of  privacy. Further, the organization has argued that capturing a facial  image or faceprint in public does not necessarily remove an  individual’s anonymity because it does not directly reveal a name,  Social Security number, or any other personal information.
Surveillance is already part of our daily life. The International  Biometrics & Identification Association has noted that commercial  entities already routinely have security cameras and that facial  recognition does not increase their use. Further, it says that privacy  advocacy organizations may have overstated the capabilities of facial  recognition technology systems, noting that cameras generally are not  interconnected and that it is not practical to conceive of a commercial  application that would use multiple cameras to track individuals’  movements.
Consumers have shown a willingness to give up some privacy  for the benefits technology offers. Industry stakeholders have  generally noted that there are inherent trade-offs between some loss  of privacy and the benefits that new technologies confer to consumers  and businesses, and to economic growth in general. As we noted in  our September 2013 report on information resellers, representatives  of the marketing and information technology industries, among others,  have argued that consumers’ expectations and notion of privacy have  changed in an era of innovative technologies. For example, they  said, consumers have shown they are willing to share private  information in public settings—such as by posting to social networking  sites in order to gain such benefits as photograph sharing and  management.
The need for consent should depend on the context. Industry  trade organizations including the Software & Information Industry  Association, Computer and Communications Industry Association,  and National Retail Federation have stated that the need for  consumer consent should depend on the context under which facial  recognition technology is used. For example, two of the trade  organizations say that businesses that use the technology for security  may not need to obtain consent before using the technology, as  opposed to social networking sites that have repositories of facial  images to identify individuals more broadly.
Facial recognition technology should not be singled out. Some  industry representatives have stated that the privacy issues  associated with facial recognition technology are largely the same as  those for any biometric technologies—particularly for emerging  technologies like voice or gait recognition, which also can identify  individuals from afar without their knowledge. Several facial  recognition technology companies have said that policymakers should  focus on protecting personal information, which would include all  biometrics, not just facial recognition technology.

	Several Stakeholders Have Suggested Privacy Guidelines, and Company Privacy Policies Vary in Addressing Facial Recognition

Several government, industry, and privacy organizations have proposed  or are developing suggested privacy guidelines for commercial use of  facial recognition technology. Firms may describe how they collect, use,  and store data in published privacy policies, and the policies we reviewed  varied in whether and how they addressed facial recognition technology.

		Privacy Guidelines Have Been Proposed by Several Organizations

Several different groups, including a government agency, industry trade  organizations, and a privacy advocacy organization have proposed, or  are in the process of developing, privacy guidelines or best practices for  commercial use of facial recognition technology. Most of these guidelines  are based at least to some extent on the Fair Information Practice  Principles, a set of internationally recognized principles for balancing the  privacy and security of personal information with other interests. Our  review found some areas of agreement in the different organizations’  recommended practices—for example, all recommended that users of  facial recognition technology publish a privacy policy describing their data  collection practices. However, the guidelines differed in other key areas,  such as if and when firms should obtain individuals’ consent prior to using  the technology to identify them.

			NTIA Multistakeholder Process

As of June 2015, NTIA’s multistakeholder process for facial recognition  was ongoing. As noted previously, the goal of the process is to develop a  voluntary, enforceable code of conduct for facial recognition technology  that incorporates privacy principles outlined in the 2012 White House  privacy framework. Once the process is complete, companies for which  the code is relevant may commit to abide by the code, and that  company’s adherence to the code, after having made such a  commitment, is enforceable by FTC.
The process is open to the public and has involved a series of meetings  held in Washington, D.C., with remote access via teleconference and  webcasting. At the 11 meetings that NTIA had convened as of June 2015,  stakeholders have discussed the privacy and technical issues related to  current and potential uses of facial recognition technology, and how a  code of conduct might address those issues. Topics of discussion have  included issues to be considered in drafting a code of conduct, who its  provisions should apply to, the circumstances under which informed  consent should be obtained from consumers, and the impact of a code of  conduct. The participants with whom we spoke had mixed views on the  process. One industry participant said that the meetings had provided a  good forum for discussing concerns about the technology, while other  participants expressed concern that the process was moving slowly or  that any resulting code of conduct would not be widely adopted or provide  real privacy protections. Some participants expressed disappointment  that there has not been greater involvement by social networking  services, given that they are major users of the technology and possess  large numbers of faceprints. In June 2015, nine privacy and consumer  groups issued a joint statement announcing that they were withdrawing  from the multistakeholder process, stating that the process was unlikely to  yield a set of privacy rules that offers adequate protections for the use of  facial recognition technology. Other stakeholders decided to continue  the discussions toward a code of conduct, and the next meeting was  scheduled for July 28, 2015.

			International Biometrics & Identification Association

In August 2014, the International Biometrics & Identification Association  released “Privacy Best Practice Recommendations for Commercial  Biometric Use,” which it also submitted as part of the NTIA process. Key  elements of these recommendations for businesses include the following:
Users of biometric technologies, which include facial recognition  technology, should publish privacy policies, which should specify the  types and purposes of the biometric data captured, the nonbiometric  data that are being associated with the biometric data, and the  amount of time that biometric data will be stored.
When using biometrics to detect or classify an individual, businesses  should post a general notice. When using biometrics to identify an  individual, whether to provide notice depends on the context; for  example, universal notification may be impractical, the association  said, if the technology is used to identify every person entering an  office building.
Firms should use good cybersecurity practices to protect any  information collected or retained; provide a mechanism for consumers  to obtain a record of data maintained on them and have that data  corrected if necessary or removed; restrict third-party access to  biometrics unless that access is disclosed as a purpose of the data  collection; and maintain an appropriate audit trail for accountability.
The International Biometrics & Identification Association does not  currently track implementation of these recommendations and refers to  them as “general guidelines.” It also says that it leaves it to those using  the technology to determine what is most appropriate given the  application and its purpose, the risk and consequence of abuse, and the  nonbiometric data used. The American Civil Liberties Union and the  Center for Digital Democracy have been critical of these best practices,  objecting, for example, to the statement that it is impractical to obtain  consent for use of facial recognition from consumers entering buildings.

			American Civil Liberties Union

The American Civil Liberties Union issued “An Ethical Framework for  Facial Recognition” in May 2014, and provided it for discussion during the  NTIA multistakeholder process. The framework recommends stricter  standards for use, notice, and consent than those recommended by the  International Biometrics & Identification Association, including that users  of facial recognition technology should not use the technology to determine an individual’s race, color,  religion, sex, national origin, disability, or age; prominently notify individuals when facial recognition is in operation; obtain specific consent from an individual before storing a photograph  or faceprint of that person or sharing any facial recognition data with a  third party; allow individuals to access, correct, and delete their faceprint  information; and  consider what special precautions might be needed when using a  facial recognition system with teenagers.

			Digital Signage Federation

In February 2011, the Digital Signage Federation issued privacy  standards for its members that it developed in collaboration with the  Center for Democracy & Technology. Among other things, the standards  state that companies should disclose in privacy policies the data collected by digital signs and the  purpose of the data; obtain affirmative consent before using facial recognition to identify an notify consumers at the physical location of the sign when using facial  recognition (or other means) to collect other information about an  individual, such as age range or gender; not share data for any uses incompatible with those specified in the allow consumers to submit complaints and request to access their  data.
The Digital Signage Federation has a process to certify that member firms  are abiding by these standards, and the federation reported that 28 of its  221 member firms had been certified as of May 2015.

			Federal Trade Commission

FTC issued a staff report in October 2012 that included recommended  best practices for commercial uses of facial recognition technology to  protect consumer privacy. The report synthesized the discussions and  comments from FTC’s December 2011 Face Facts Forum to explore  advances in facial recognition technologies, current and possible future  commercial uses, ways consumers can benefit from these uses, and  privacy and security concerns. FTC staff said the best practices are  intended to provide guidance to commercial entities that are using or plan  to use facial recognition technologies in their products and services, while  promoting innovation. The best practices were based on core principles  outlined in FTC’s March 2012 report on consumer data privacy. These  principles included providing consumers with meaningful choices about  use of their data at a relevant time and context, ensuring that practices  related to information collection and use are transparent, and building in  privacy protections during product development. Among the best  practices recommended for companies using facial recognition  technology were obtaining individuals’ affirmative consent before identifying them in  anonymous images to someone who could not otherwise identify  them; providing clear notice to individuals when using facial recognition to providing individuals with a choice about whether any data collected  with facial recognition technology are shared with third parties; and  implementing a specified retention period for personal data and  disposing of stored images once they are no longer necessary for the  purpose for which they were collected.
One FTC commissioner issued a dissenting statement with the staff  report, stating there was little evidence that facial recognition technology  was likely to cause tangible injuries to consumers in the near future, and  that following the staff report’s recommendations would create a burden  on businesses in many contexts. Representatives of several privacy  advocacy organizations told us they believed the FTC staff report  provided a good summary of the issues but had not resulted in noticeable  changes in industry practices.

			Privacy by Design

In addition to best practices and codes of conduct, some stakeholders  have advocated addressing consumer privacy through “privacy by  design”—the practice of building in consumer privacy protections at every  stage of product development. For example, FTC staff and the Privacy  Rights Clearinghouse have both noted that systems can be designed to  ensure that data collected by facial recognition technology are not used  beyond specified purposes, either by automatically deleting the data after  they are used, or ensuring the data cannot be repurposed. The  International Biometrics & Identification Association has cited the need for  systems that block “web-crawlers,” which seek to surreptitiously gather  images and other information from websites containing facial images and  other personal data. Firms that develop facial recognition technology  also told us that some measures can be taken to build privacy controls  into facial recognition systems. These include segregating biometric data  from other personal data, as well as encrypting data, which can be  especially important for entities that possess large numbers of  photographs matched with other identifying information. However, some  representatives of industry and privacy advocacy organizations have  argued that privacy by design has limitations. Industry representatives  noted that facial recognition technology systems generally are built to be  flexible and provide users with the option to choose among different  levels of privacy protection. This may allow users to bypass privacy  protections, such as a data retention time frame, that have been included  in the system’s design.

		Some Companies Address Facial Recognition Technology in Their Privacy Policies

We reviewed the written privacy policies, as of May 2015, of selected  businesses in three industries—social networking, retail, and gaming—to  identify whether and how these policies expressly addressed facial  recognition technology. In published privacy policies, firms may describe  the data they collect, their uses for these data and circumstances under  which they may be shared with third parties, and how these data are  stored. Firms that publish a privacy policy may not be required to describe  their use of facial recognition technology, if any. Therefore, some firms  may be using facial recognition technology even if they do not address  the technology in their privacy policies. However, because we were  unable to determine whether most companies we selected used facial  recognition technology, their failure to mention it in their privacy policies  could also mean that they do not use the technology.
Two companies operating social networking applications that use facial  recognition technology expressly address how they use the technology in  their privacy policies and associated documents. One of these  companies automatically uses facial recognition technology to facilitate  tagging a user’s friends in photographs unless the user opts out. The user  can turn off the facial recognition feature, at which time the user’s facial  templates are deleted. Users can also “untag” themselves in  photographs. Company representatives told us that the firm’s approach to  privacy is to provide multiple opportunities for users to exercise control  over their data—for example, through privacy settings and tools that allow  users to select who can see their personal information and content.  Company representatives told us that the firm has no plans at this time to  share facial recognition faceprints with third parties and that personal  information associated with facial recognition technology would not be  shared without user consent.
In contrast, the second company requires users to approve the use of its  face tagging feature before it is enabled, which company representatives  told us is in accordance with the FTC staff report’s suggested best  practices. That company told us it does not share and has no plans to  share personal information associated with facial recognition technology  without user consent, except in very limited circumstances as described  in its privacy policy (i.e., with domain administrators, for external  processing by company affiliates or trusted parties, or for legal reasons).
This company has also developed a digital eyeglass product. In a June  2013 letter to a Member of Congress, the company said it would not  provide facial recognition capabilities for that product, or allow third-party  developers to do so, until it had strong privacy protections in place. The  letter also stated that the company would prohibit developers from  disabling a feature that would alert the public when the digital eyeglass  product was being used to take a photograph or video. The firm also  stated that the product was covered by the company’s privacy policy and  that no changes were contemplated for its privacy policy to specifically  address the product.
The five major retail chains and four large casino companies that we  selected did not expressly address facial recognition technology in their  written privacy policies, although as indicated earlier, we were unable to  determine whether these firms use the technology. A representative  from the National Retail Federation told us that retailers’ privacy policies  are written broadly enough to address facial recognition technology, even  if they do not expressly mention it. The privacy policies of three of the five  retailers we reviewed did address their stores’ use of video cameras  (which can be a component of facial recognition systems). All three  policies specified that the cameras are used for security purposes or to  measure store traffic, while one policy noted that the cameras were used  for collecting information about their customers. None of the five policies  made reference to the use of digital signs, which, as noted earlier, can  incorporate facial recognition technology. Similarly, none of the privacy  policies of the four large U.S.-based casino companies we reviewed  made reference to the use of facial recognition technology in the United  States.

	Some Federal Laws May Potentially Apply to Facial Recognition Technology, but Do Not Fully Address Stakeholder Privacy Issues

Some federal laws may potentially be applicable to the commercial use of  facial recognition technology, but these laws do not fully address the  privacy concerns that have been raised about facial recognition  technology by some stakeholders. Views differ on the need for additional  legislation.

		Federal Law Does Not Expressly Regulate the Commercial Use of Facial Recognition Technology, but Some Laws May Potentially Apply in Certain Circumstances

The United States does not have a comprehensive privacy law governing  the collection, use, and sale of personal information by private-sector  companies. In addition, we did not identify any federal laws that  expressly regulate commercial uses of facial recognition technology in  particular. However, there are three areas in which certain federal laws  that address privacy and consumer protection may potentially apply to  commercial uses of facial recognition technology: (1) the capture of facial  images; (2) the collection, use, and sharing of personal data; and (3)  unfair or deceptive acts or practices, such as failure to comply with a  company’s stated privacy policies.

			Capture of Facial Images

Generally, individuals can take pictures while on public property and in  commercial spaces open to the public unless prohibited by the business  or property owner. We did not identify federal laws that generally restrict  the capture of facial images. One federal law, the Video Voyeurism  Prevention Act of 2004, prohibits the taking of certain types of pictures in  limited circumstances. The act makes it a crime to intentionally capture  an image of a “private area” of an individual without his or her consent, or  to knowingly do so under circumstances in which that individual has a  reasonable expectation of privacy. While the definition of a private area  does not include a person’s face, the act could affect the specific  placement of cameras in certain parts of commercial spaces, such as  retail stores’ dressing rooms.

			Collection, Use, and Storage of Personal Information

Federal laws addressing privacy issues in the private sector are generally  tailored to specific purposes, situations, types of information, or sectors or  entities. In general, these laws, among other things, limit the disclosure of  certain types of information to a third party without an individual’s  consent, or prohibit certain types of data collection. Some of these laws  also set standards for how certain personal data should be stored and  disposed of securely. These laws may potentially apply to facial  recognition technology in two ways. First, they may potentially limit some  firms’ ability to share data collected with facial recognition technology,  such as a person’s image and faceprint, or a person’s location at a given  time. Second, these laws may potentially limit firms’ access to personal  information that could be used in connection with the technology, such as  a person’s photograph, name, age, address, or purchase history. As  shown in table 1, the general applicability of these laws depends on some  combination of the source of the data, the means of collection, the entity  collecting the data, the type of data being collected, and the purpose for  which the data are being used. For additional details on these federal  laws and their potential applicability to facial recognition technology, see  appendix II.
Table I: Federal Laws Specifically Addressing the Collection, Use, and Storage of  Personal Information  Federal law  Driver’s Privacy Protection Act  Addresses the use and disclosure of personal  Applicability to collection, use, and storage of  personal information   information contained in state motor vehicle records.
Governs the disclosure of nonpublic information  collected by financial institutions, and sets standards  for data security.
Applicability to collection, use, and storage of  personal information   Governs the disclosure of individually identifiable  health information collected by covered health care  entities, and sets standards for data security.
Governs the disclosure of personal information  collected or used for eligibility determinations for such  things as credit, insurance, or employment.
Governs the disclosure of personally identifiable  information from education records.
Generally prohibits the online collection of personal  information from children under 13 without verifiable  parental consent.
Prohibits the interception and disclosure of electronic  communications by third parties unless a specified  exception applies.
Computer Fraud and Abuse Act  Prohibits obtaining information from a protected  computer through the intentional access of a  computer without authorization or exceeding  authorized access.

			Unfair or Deceptive Acts or Practices

Section 5 of the Federal Trade Commission Act (FTC Act) authorizes  FTC to take action against unfair or deceptive acts or practices in or  affecting commerce. Although the act does not explicitly grant FTC the  authority to protect privacy, FTC has interpreted it to apply to deceptions  or violations of written privacy policies. For example, if a retailer has a  written privacy policy stating it does not use facial recognition technology  to identify customers and later breaches the policy by doing so, FTC staff  have stated the agency could prosecute the retailer if it determined such  violation constituted a deceptive practice. Likewise, FTC staff told us that  the act could apply if firms violate written privacy policies on how they use  or share personal information that was collected in conjunction with facial  recognition technology. In addition, according to FTC staff, the FTC Act’s  “unfairness” authority could apply even in the absence of a privacy policy,  in situations where an act or practice causes or is likely to cause  substantial injury to consumers that is not reasonably avoidable by  consumers themselves and not outweighed by countervailing benefits to  consumers or to competition. FTC staff told us that as of June 2015, the  agency had not taken any enforcement actions on privacy issues  specifically with regard to the use of facial recognition technology or other  biometrics. However, more generally, the agency had brought more than  40 cases related to privacy, and more than 50 cases related to data  security, against companies that had engaged in unfair or deceptive  practices.

			Selected State Laws

Two states—Texas and Illinois—have adopted privacy laws that  expressly address commercial uses of biometric identifiers, including  scans of face geometry such as those gathered through facial recognition  technology. A report by a committee of the Texas House of  Representatives noted that there were concerns that biometric data were  increasingly becoming a target of identity theft and needed to be  safeguarded. Similarly, the Illinois General Assembly noted that use of  biometrics was growing in the business and security screening sectors  and that the ramifications of this technology were not fully known. Both  the Texas and Illinois laws  require that before collecting a biometric identifier of an individual, a  private entity must obtain that individual’s consent; prohibit an entity in possession of a biometric identifier from sharing  that person’s biometric identifier with a third party, unless the  disclosure meets an exception, such as for law enforcement or to  complete a financial transaction that the individual requested or  authorized; and govern the retention of biometric records, including requirements for  protecting biometric information and destroying such information after  a certain period of time.
In addition, according the National Conference of State Legislatures, most  states have general privacy laws applicable to personal data, which may  also potentially apply to information collected with, or otherwise  connected to, facial recognition technology. As of January 2015,  according to the organization, 47 states, the District of Columbia, Guam,  Puerto Rico, and the Virgin Islands had enacted legislation requiring  companies to notify residents if their personal information in the  companies’ custody was compromised. Further, at least 32 states and  Puerto Rico have enacted laws that require entities to destroy, dispose of,  or otherwise make personal information unreadable or undecipherable  after it is no longer being used or after a specified amount of time,  according to the National Conference of State Legislatures.

		Federal Laws Do Not Fully Address Stakeholder Privacy Concerns about Facial Recognition Technology, but Views Differ on the Need for Additional Legislation

Federal laws do not fully address the privacy issues that stakeholders  have identified with commercial uses of facial recognition technology. As  previously discussed, no federal law expressly regulates commercial use  of facial recognition technology. This means that federal law does not  expressly regulate the circumstances under which facial recognition  technology may be used by commercial entities to identify and track  someone with whom they have no prior relationship. Further, federal law  does not expressly regulate whether and when firms should notify  consumers of their use of facial recognition technology, or seek an  individual’s consent prior to identifying them, which has been an area of  concern to privacy advocacy organizations and others.
Certain federal laws do address the collection, use, and sale of personal  information by private-sector companies, as discussed earlier. These  laws could potentially restrict, in certain circumstances, the collection of  facial images, which are used to build a database for use with facial  recognition technology. For example, provisions in the Driver’s Privacy  Protection Act restrict state motor vehicle bureaus from selling drivers’  license photographs and associated information to private parties. In  addition, the Gramm-Leach-Bliley Act and Health Insurance Portability  and Accountability Act potentially could restrict the ability of banks and  health care providers to share data collected with facial recognition  technology if those data were to fall within the laws’ definitions of  protected information. However, the reach of these laws is limited  because they generally apply only for specific purposes, in certain  situations, to certain sectors, or to certain types of entities. As a result,  they do not comprehensively address how commercial entities other than  those explicitly covered by the specific laws may collect, use, or share  personal data in conjunction with facial recognition technology.
Additionally, depending on the context, federal law does not require firms  that collect personal information to follow detailed standards for verifying  the accuracy of data developed through computer matching. As noted  earlier, facial recognition algorithms may misidentify individuals and may  not be as accurate as other forms of biometric identifiers because of  technological challenges in accurately matching photographs and  because users typically can adjust settings for the degree of accuracy  required for a match. In a 2012 report, FTC stated that measures to  ensure the accuracy of the consumer data that companies collect and  maintain should be scaled to the intended use and sensitivity of the  information. One privacy expert we met with stated that in some  commercial contexts facial recognition technology is used to identify  criminals, such as shoplifters. As such, misidentifying an innocent  individual could be detrimental. In most contexts, federal law may not  provide consumers with the right to correct or delete inaccurate personal  information collected by commercial firms.
Some privacy advocacy organizations have argued for new legislation or  regulation to address privacy issues associated with facial recognition  technology. The American Civil Liberties Union has contended that  government intervention and statutorily created legal protections are  needed to protect against the negative effects of this technology. In  testimony before the Senate in 2012, the Electronic Frontier Foundation  stated that because of the risk that faceprints will be collected without  individuals’ knowledge, rules should define clear notice requirements to  alert people that a faceprint has been collected and include information  on how to request that data collected on them be removed. One  academic has argued specifically for legislation that would require  individuals’ explicit consent before a company could capture or use their  faceprint, and would require companies to provide individuals with  information about the uses of their biometric data. The Center for Digital  Democracy has urged FTC to recommend new safeguards for  adolescents relating to facial recognition. The Center for Democracy &  Technology has stated that the technology poses complex privacy issues  that do not fit squarely with present laws because these laws apply only  indirectly to facial recognition and offer consumers no real choices with  regard to the technology.
Views vary on the approach that additional privacy legislation or  regulation, if any, should take to address these issues. The Center for  Democracy & Technology argues that current federal privacy law is a  confusing patchwork targeting discrete economic sectors with different  rules. Therefore, it contends that Congress should not pass privacy  legislation for facial recognition technology alone, but rather as a  comprehensive framework that protects all personal information. One  industry representative told us he believed that federal privacy legislation  could benefit firms by clearly defining acceptable practices, but that any  legislation should focus comprehensively on personal data rather than a  specific technology. In February 2015, the White House proposed draft  legislation to establish baseline protections for individual privacy in the  commercial arena. However, one academic privacy expert told us he  believed that legal protections specific to facial recognition technology are  needed because, as a practical matter, comprehensive privacy legislation  is unlikely to be enacted in the foreseeable future. In comments submitted  to FTC, several industry groups noted that facial recognition technology  should not be regulated in a “one size fits all” manner. One company also  noted that the privacy issues that arise from using facial recognition to  surreptitiously identify a person in public are very different from the issues  involved in using the technology to organize personal photographs, and  that privacy regulations should be designed with respect to these different  uses.
However, most industry representatives have argued that new legislation  or regulation is not necessary to address privacy issues associated with  facial recognition technology, contending that self-regulation—such as  voluntary codes of conduct and best practices—and privacy by design are  effective alternatives. Industry trade organizations have urged caution in  expanding privacy law in general, arguing that absent any identifiable  harm in the marketplace, privacy issues are best addressed through  industry self-regulatory programs and best practices. In a 2012 Senate  Committee hearing, a representative of the Digital Advertising Alliance  said that industry self-regulation is flexible and could adapt to rapid  changes in technology and consumer expectations, whereas legislation  and government regulation could be inflexible and quickly become  outdated in an era of rapidly evolving technologies. Specifically with  regard to facial recognition technology, the industry association  TechAmerica has contended that self-regulation based on the Fair  Information Practice Principles, coupled with privacy by design, has  provided consumers with the necessary privacy protections. The  National Retail Federation and others have argued that it may be too  early to consider additional regulation of facial recognition technology  because the technology is still in the early stages of development and  thus the privacy issues raised are mostly speculative. The group argued  that such regulation could inhibit innovation and deny businesses and  consumers beneficial products, while protecting against harms that might  never have occurred.
In contrast, some consumer and privacy advocacy organizations have  argued that self-regulation is not sufficient to fully address privacy  concerns because it may be limited in scope, limited in coverage to those  entities that choose to participate, and subject to change. For example, a  study of industry privacy self-regulatory programs from 1997 through  2007 by the World Privacy Forum argued that these programs often  lacked a meaningful ability to enforce their own rules or maintain  memberships, and covered only a fraction of an industry or an industry  subgroup. The Center for Digital Democracy questioned the  effectiveness of the NTIA’s multistakeholder process for developing  voluntary industry standards, contending that a previous process covering  mobile applications did not lead to any significant changes in that  industry’s privacy practices. One former industry representative told us  that firms using facial recognition technology would not abide by voluntary  codes of conduct if those codes damaged their commercial interests. In  contrast, he believes that privacy legislation can provide firms with a  financial incentive to abide by privacy principles because of the reputation  risk caused by a public violation of privacy law. The White House  framework for consumer data privacy, while supporting industry-wide  codes of conduct, also suggested that Congress enact legislation to  provide FTC with the ability to enforce the Consumer Privacy Bill of  Rights independently. Similarly, in its 2012 report on protecting consumer  privacy, FTC noted that while it has supported self-regulatory efforts,  privacy self-regulation had not gone far enough and that Congress should  consider enacting baseline privacy legislation.
In our September 2013 report on personal information collected for  marketing purposes, we suggested that Congress consider strengthening  the consumer privacy framework to reflect the effects of changes in  technology and the marketplace, a suggestion that is underscored by the  privacy issues associated with facial recognition technology. We  identified how advances in technology and marketplace practices had  resulted in vast changes in the amount and type of personal information  collected. We also found that gaps existed in federal privacy law because  it had not adapted to new technologies. As of July 2015, Congress has  not passed legislation addressing our 2013 suggestion.

	Concluding Observations

Facial recognition technology may be employed in a wide range of useful  commercial applications, but the future trajectory of the technology raises  questions about consumer privacy. Federal law does not expressly  address the circumstances under which commercial entities can use  facial recognition technology to identify or track individuals, or when  consumer knowledge or consent should be required for the technology’s  use. Further, in most contexts federal law does not address how personal  data derived from the technology may be used or shared. NTIA’s  multistakeholder process to develop a voluntary code of conduct is a  positive step toward incorporating privacy considerations into the  development and use of facial recognition technology. However, views  vary on the efficacy of voluntary and self-regulatory approaches versus  legislation and regulation to protect privacy. The privacy issues  stakeholders have raised about facial recognition technology and other  biometric technologies serve as yet another example of the need to adapt  federal privacy law to reflect new technologies. As such, we reiterate our  2013 suggestion that Congress strengthen the current consumer privacy  framework to reflect the effects of changes in technology and the  marketplace.

	Agency Comments

We provided a draft of this report for review and comment to the  Department of Commerce and the Federal Trade Commission. We  received technical comments from them, which we incorporated as  appropriate. We also provided relevant excerpts of the draft for technical  review to selected private parties cited in our report, and included their  technical comments as appropriate.
We are sending copies of this report to Commerce, FTC, appropriate  congressional committees and members, and other interested parties.  The report also is available at no charge on the GAO website at  http://www.gao.gov.
Should you or your staff have questions concerning this report, please  contact me at (202) 512-8678 or cackleya@gao.gov. Contact points for  our Offices of Congressional Relations and Public Affairs may be found  on the last page of this report. Key contributors to this report are listed in  appendix III.

Appendix I: Objectives, Scope, and Methodology

This report examines (1) the uses of facial recognition technology for  consumers and businesses, (2) privacy issues that have been raised in  connection with commercial uses of facial recognition technology, (3)  proposed best privacy practices and industry privacy policies related to  facial recognition technology, and (4) privacy protections under federal  law that may potentially apply to facial recognition technology. The scope  of this report includes use of the technology by companies and other  private entities and does not include use by federal, state, or local  government agencies. This report covers use of the technology in the  United States and not in other countries. It focuses primarily on use of the  technology to identify or verify an individual and not on facial detection  (which simply detects when a face is present).
To address the first two objectives, we identified and reviewed relevant  studies and reports, congressional testimony, position papers, and other  documents from industry stakeholders, privacy and consumer advocacy  organizations, federal agencies, and academic and industry experts.  These included, among others, the Federal Trade Commission’s (FTC)  2012 staff report on facial recognition technology; transcripts and written  comments stemming from FTC’s 2011 facial recognition technology  forum; agendas, meeting summaries, and documents submitted by  participants from the Department of Commerce’s (Commerce) National  Telecommunications and Information Administration’s (NTIA)  multistakeholder process on facial recognition technology in 2014 and  2015; and testimony and written statements from a 2012 congressional  hearing on facial recognition technology. In addition, we reviewed  product information and marketing material from selected companies that  develop and sell products using facial recognition technology. We  conducted a literature search to identify academic and trade articles on  commercial applications of facial recognition technology, as well as  privacy issues raised by the technology. We used these articles to  corroborate information we obtained from industry stakeholders, privacy  and consumer advocacy groups, and federal agencies. In conducting this  search, we generally obtained information from various online research  sources such as Proquest, Nexis, and Dialogue. We also used Internet  search techniques and key word search terms to identify additional  sources and types of available information about how facial recognition  technology works, how it is used in commercial applications, and what  privacy issues are raised by its use.
To address the third objective, we reviewed the Fair Information Practice  Principles and White House Consumer Privacy Bill of Rights, as well as  privacy guidelines and best practices with specific application to facial  recognition and biometric technologies issued by the American Civil  Liberties Union, Digital Signage Federation, FTC staff, and the  International Biometrics & Information Association. We also reviewed the  privacy policies of selected companies in the social networking, retail, and  casino industries, which we obtained from company websites. We chose  those industries because they were widely cited among government and  industry stakeholders as among the most significant users, or potential  users, of facial recognition technology. Specifically, we reviewed the  privacy policies of (1) two U.S. companies that currently use facial  recognition technology and are ranked number one and number five,  respectively, of the most popular social networking websites, based on  estimated unique monthly visitors as of December 2014; (2) the five  largest retail companies in the United States based on 2013 retail sales;  and (3) the four largest U.S. casino companies, based on worldwide  revenue in 2013. We reviewed each privacy policy and relevant  supporting documents for key words such as “facial recognition  technology,” “photos,” “video,” and “surveillance cameras” to determine  whether and how they addressed the use of facial recognition technology.  While we identified whether and how the privacy policies addressed facial  recognition technology specifically, we did not conduct a broad evaluation  or assessment of these policies more generally because that was outside  the scope of this engagement. We also met with representatives of two  companies that provide social networking applications to discuss, among  other things, how facial recognition technology was addressed in their  privacy policies. We also inquired with trade organization representatives  about meeting with major retailers and casinos to discuss facial  recognition technology, but the trade organizations told us that these  companies declined to speak to us.
To examine privacy protections under federal law that may potentially  apply to commercial uses of facial recognition technology, we reviewed  and analyzed relevant federal laws and regulations to examine their  potential applicability to the commercial use of facial recognition or other  biometric technologies. We then reviewed laws, as well as relevant  agency regulations, in terms of their general purpose and potential  applicability to facial recognition or other biometric technologies. We also  reviewed prior work we had conducted on federal privacy law as it relates  to commercial entities. We also reviewed state laws in Illinois and Texas  that expressly addressed privacy issues related to commercial use of  facial recognition technology or other biometric identifiers. We selected  these laws for review because Illinois and Texas were the two states we  identified as having such laws, based on our interviews and a review of  relevant law review articles and information from the National Conference  of State Legislatures. This review was intended to provide illustrative  examples and was not exhaustive, and thus may not have identified all  state laws that may exist addressing privacy and biometrics. In addition,  we reviewed the previously mentioned congressional testimony,  comments submitted to FTC’s 2011 forum, and documents submitted to  NTIA’s multistakeholder process that addressed the applicability of  federal law to facial recognition technology.
To address all four objectives, we conducted interviews with, and  obtained documentation from, representatives of federal agencies,  including FTC and Commerce’s NTIA and National Institute of Standards  and Technology; companies that use facial recognition technology;  companies that develop facial recognition products; trade associations,  including the American Bankers Association, American Gaming  Association, Interactive Advertising Bureau, National Retail Federation,  and Retail Industry Leaders Association; privacy or consumer advocacy  organizations, including the American Civil Liberties Union, Center for  Democracy & Technology, Electronic Frontier Foundation, Electronic  Privacy Information Center, and World Privacy Forum; and two  academics who have participated in the FTC FaceFacts Forum or NTIA  multistakeholder process and who have studied these issues. We also  interviewed the International Biometrics & Information Association and  conducted a group interview with seven of its member companies that it  had invited to participate.
We conducted this performance audit from July 2014 to July 2015 in  accordance with generally accepted government auditing standards.  Those standards require that we plan and perform the audit to obtain  sufficient, appropriate evidence to provide a reasonable basis for our  findings and conclusions based on our audit objectives. We believe that  the evidence obtained provides a reasonable basis for our findings and  conclusions based on our audit objectives.

Appendix II: Federal Laws Specifically Addressing the Collection, Use, and Storage of Personal Information

This appendix describes the federal laws that specifically address the  collection, use, and storage of personal information by private entities,  and these laws’ potential applicability to commercial uses of facial  recognition technology.
Driver’s Privacy Protection Act. Enacted in 1994, the Driver’s Privacy  Protection Act generally prohibits the use and disclosure of certain  personal information contained in state motor vehicle records for  commercial purposes, with some exceptions. The act’s definition of  personal information includes the driver’s license photograph, as well as  any other information that identifies an individual, including Social  Security number, driver identification number, name, address (except 5- digit zip code), telephone number, and medical or disability information.
Gramm-Leach-Bliley Act (GLBA). Enacted in 1999, the Gramm-Leach- Bliley Act contains provisions that restrict, with some exceptions, the  disclosure of nonpublic information by entities that fall under GLBA’s  definition of a “financial institution” or that receive nonpublic personal  information from such a financial institution. GLBA generally requires  financial institutions to provide notice and an opportunity for consumers to  opt out before sharing their nonpublic information with nonaffiliated third  parties, other than for certain purposes such as processing a financial  service authorized by the consumer. Regulations implementing GLBA do  not specifically cite facial images or biometric identifiers—which are used  by some financial institutions to verify customers—in the definition of  nonpublic personal information. However, the definition does include  personally identifiable financial information, which is defined to include  any information that financial institutions obtain about a consumer in  connection with providing a financial product or service to that consumer,  such as the fact that an individual is a consumer or customer of a  particular financial institution.
Health Insurance Portability and Accountability Act. Enacted in  1996, the Health Insurance Portability and Accountability Act establishes  a set of national standards for the protection and safeguarding of  individually identifiable health information. With some exceptions, rules  implementing the act require an individual’s written authorization before a  covered entity—a health care provider that transmits health information  electronically in connection with covered transactions, health care  clearinghouse, or health plan—may use or disclose that individual’s  individually identifiable health information, including for commercial  purposes. The rules also give individuals the right to have a covered  entity amend their protected health information if it is not accurate and  complete. Additionally, the rules include full-face images and biometric  identifiers among the personal identifiers that must be removed before  protected health information is no longer considered individually  identifiable health information and therefore generally can be disclosed.
Fair Credit Reporting Act. The act, which was enacted in 1970,  protects the security and confidentiality of personal information collected  or used for eligibility determinations for such products as credit,  insurance, or employment. The Fair Credit Reporting Act applies to those  meeting the definition of “consumer reporting agency” under the act,  which includes the three nationwide consumer reporting agencies  (commonly called credit bureaus) and other businesses that collect or  disclose information for consumer reports for use by others. The act  limits the use and distribution of personal data collected for consumer  reports to permissible purposes specified in the act and also gives  consumers certain rights to opt out of allowing their personal information  to be shared for certain marketing purposes. The act also allows  individuals to access and dispute the accuracy of personal data held on  them and imposes safeguarding requirements for such data.
Children’s Online Privacy Protection Act. Enacted in 1998, the  Children’s Online Privacy Protection Act requires covered website and  online service operators to obtain verifiable parental consent before  collecting personal information from children under 13, with certain  exceptions. Regulations implementing the act define “personal  information” to include a photograph or video containing a child’s image,  as well as other information such as full name and e-mail address. In its  2013 final rule amending its regulations implementing the act, FTC  expressly addressed facial recognition technology in the discussion of its  decision to incorporate photographs of a child under 13 into the definition  of “personal information,” noting the inherently personal nature of  photographs and the possibility of them being paired with facial  recognition technology.
Electronic Communications Privacy Act. Enacted in 1986, this act  prohibits the interception and disclosure of electronic communications by  third parties unless an exception applies, such as one of the parties to the  communication having consented to the interception or disclosure. For  example, unless an exception applies, such as customers having given  their consent, the act would prohibit an Internet service provider from  selling the content of its customers’ e-mails and text messages—which  could include facial images—to a third party.
Family Educational Rights and Privacy Act. Enacted in 1974, the act  generally prohibits federal funds from being made available to any school  or institution that has a policy of releasing students’ education records or  personally identifiable information contained in such records without the  prior written consent of the parent or eligible student, with certain  exceptions. The Department of Education’s regulations implementing the  Family Educational Rights and Privacy Act include biometric records— including facial characteristics—in the definition of personally identifiable  information.
Computer Fraud and Abuse Act. Enacted in 1986, the Computer  Fraud and Abuse Act prohibits obtaining information from a protected  computer through the intentional access of a computer without  authorization or through exceeding authorized access. Some courts  have held that using a website for a purpose in violation of the site’s  terms of use or terms of service exceeds authorized access and therefore  violates the act. Other courts, however, have read the act more  narrowly, holding that it prohibits the unauthorized procurement of  information rather than its misuse. To the extent that the collection of  images online related to facial recognition technology is found to  constitute obtaining information from a protected computer through  access without authorization or exceeding authorized access, such  collection may be a violation of the Computer Fraud and Abuse Act.

Appendix III: GAO Contact and Staff Acknowledgments

	GAO Contact

Alicia Puente Cackley, 202-512-8678 or cackleya@gao.gov.

	Staff Acknowledgments

In addition to the contact named above, Jason Bromberg (Assistant  Director), José R. Peña (Analyst-in-Charge), William R. Chatlos, Jeremy  Conley, Richard Hung, Patricia Moye, and Jennifer Schwartz made key  contributions to this report.

Summary:
Why GAO Did This Study

Facial recognition technology—which can verify or identify an individual from a facial image—has rapidly improved in performance and now can surpass human performance in some cases. The Department of Commerce has convened stakeholders to review privacy issues related to commercial use of this technology, which GAO was also asked to examine.
This report examines (1) uses of facial recognition technology, (2) privacy issues that have been raised, (3) proposed best practices and industry privacy policies, and (4) potentially applicable privacy protections under federal law. The scope of this report includes use of the technology in commercial settings but not by government agencies. To address these objectives, GAO analyzed laws, regulations, and documents; interviewed federal agencies; and interviewed officials and reviewed privacy policies and proposals of companies, trade groups, and privacy groups. Companies were selected because they were among the largest in industries identified as potential major users of the technology, and privacy groups were selected because they had written on this issue.

What GAO Found

Facial recognition technology can be used in numerous consumer and business applications, but the extent of its current use in commercial settings is not fully known. The technology is commonly used in software that manages personal photographs and in social networking applications to identify friends. In addition, several companies use the technology to provide secure access to computers, phones, and gaming systems in lieu of a password. Facial recognition technology can have applications for customer service and marketing, but at present, use in the United States of the technology for such purposes appears to be largely for detecting characteristics (such as age or gender) to tailor digital advertising, rather than identifying unique individuals. Some security systems serving retailers, banks, and casinos incorporate facial recognition technology, but the extent of such use at present is not fully known.
Privacy advocacy organizations, government agencies, and others have cited several privacy concerns related to the commercial use of facial recognition technology. They say that if its use became widespread, it could give businesses or individuals the ability to identify almost anyone in public without their knowledge or consent and to track people's locations, movements, and companions. They have also raised concerns that information collected or associated with facial recognition technology could be used, shared, or sold in ways that consumers do not understand, anticipate, or consent to. Some stakeholders disagree that the technology presents new or unusual privacy risks, noting, among other things, that individuals should not expect complete anonymity in public and that some loss of privacy is offset by the benefits the technology offers consumers and businesses.
Several government, industry, and privacy organizations have proposed or are developing voluntary privacy guidelines for commercial use of facial recognition technology. Suggested best practices vary, but most call for disclosing the technology's use and obtaining consent before using it to identify someone from anonymous images. The privacy policies of companies GAO reviewed varied in whether and how they addressed facial recognition technology.
No federal privacy law expressly regulates commercial uses of facial recognition technology, and laws do not fully address key privacy issues stakeholders have raised, such as the circumstances under which the technology may be used to identify individuals or track their whereabouts and companions. Laws governing the collection, use, and storage of personal information may potentially apply to the commercial use of facial recognition in specific contexts, such as information collected by health care entities and financial institutions. In addition, the Federal Trade Commission Act has been interpreted to require companies to abide by their stated privacy policies. Stakeholder views vary on the efficacy of voluntary and self-regulatory approaches versus legislation and regulation to protect privacy. GAO has previously concluded that gaps exist in the consumer privacy framework, and the privacy issues that have been raised by facial recognition technology serve as yet another example of the need to adapt federal privacy law to reflect new technologies.

What GAO Recommends

GAO makes no recommendations in this report. However, GAO suggested in GAO-13-663 that Congress consider strengthening the consumer privacy framework to reflect changes in technology and the marketplace, and facial recognition technology is such a change. GAO maintains that the current privacy framework in commercial settings warrants reconsideration.