Facial Recognition Technology: Commercial Uses, Privacy Issues, and Applicable Federal Law
Released: 2015-07-30T00:00:00

Letter

Background

Facial recognition technology is one of several biometric technologies, which identify individuals by measuring and analyzing their physiological or behavioral characteristics. Biometric technologies have been developed to identify people using their faces, fingerprints, hands, eye retinas and irises, voice, and gait, among other things. Unlike conventional identification methods, such as a card to gain building access or a password to log on to a computer system, biometric technologies measure things that are generally distinct to each person and cannot easily be changed.

There are generally four basic components to a facial recognition technology system: a camera to capture an image, an algorithm to create a faceprint (sometimes called a facial template), a database of stored images, and an algorithm to compare the captured image to the database of images or a single image in the database. The quality of these components determines the effectiveness of the system. In addition, the more similar the environments in which the images are compared—such as the background, lighting conditions, camera distance, and size and orientation of the head—the better a facial recognition technology system will perform.

Facial recognition technologies can perform a number of functions, including (1) detecting a face in an image; (2) estimating personal characteristics, such as an individual’s age, race, or gender; (3) verifying identity by accepting or denying the identity claimed by a person; and (4) identifying an individual by matching an image of an unknown person to a gallery of known people. According to FTC staff, academics, and industry experts, most modern facial recognition systems generally follow the steps shown in figure 1.

Facial recognition systems can generate two types of errors—false positives (generating an incorrect match) or false negatives (not generating a match when one exists). NIST has measured the performance of companies’ facial recognition algorithms since 1993 and has found that the technology has improved over time. Most recently, NIST’s Face Recognition Vendor Test in 2014 found that the error rates continued to decline and algorithms had improved at identifying individuals from images of poor quality or captured under low light. In addition, research supported by the Technical Support Working Group, a federal interagency group, showed that in certain controlled tests, facial recognition algorithms surpassed human accuracy in determining whether pairs of face images, taken under different illumination conditions, were pictures of the same person or of different people.

NTIA is the agency principally responsible for advising the President on telecommunications and information policy issues, including those related to privacy. In February 2014, NTIA began a “multistakeholder process” that has convened various stakeholders to discuss protection of consumer privacy in current and emerging commercial uses of facial recognition technology. This process, which is ongoing, was outlined in a 2012 White House privacy framework, which directed NTIA to convene multistakeholder processes that consist of open, transparent forums in which stakeholders work toward consensus on voluntary, legally enforceable codes of conduct for specific markets or business contexts. The framework also presents privacy principles in the form of a proposed Consumer Privacy Bill of Rights, and states that the codes of conduct developed in NTIA’s multistakeholder processes should specify how those principles would apply to different technologies or markets.

FTC is a law enforcement agency that plays a role in enforcing key privacy and consumer protection laws. In December 2011, FTC hosted a workshop—Face Facts: A Forum on Facial Recognition Technology—that explored privacy issues associated with facial recognition technology. It issued a staff report in October 2012 that synthesized those discussions and recommended best practices for the use of the technology in the context of protecting consumer privacy.

Facial Recognition Technology Can Be Useful for Many Commercial Applications, but the Extent of Its Use Is Not Fully Known

Facial recognition technology is currently being used in a number of U.S. commercial applications for functions including safety and security, secure access, and marketing and customer service. However the full extent of its present use is not known.

Facial Recognition Technology Has Applications That Can Be Useful to Consumers and Businesses

Facial recognition technology offers applications beneficial to both consumers and businesses, according to industry representatives and other stakeholders. The International Biometrics & Identification Association has noted that facial recognition and other biometric technologies have until recently been used most prominently by government and law enforcement agencies, such as to protect borders and ports and to identify criminals. However, FTC staff and industry sources have reported that commercial interest and investment in facial recognition technology have grown as the technology has become more accurate and less costly, with new applications being developed for consumers and businesses. The Direct Marketing Association has said that businesses are finding that facial recognition technology can be used as a way to communicate with consumers and provide new tools, products, and services. Industry trade organizations and companies that use and develop facial recognition software have cited four major types of functions that they say do or will benefit from facial recognition technology: photograph identification and organization; safety and security; secure access; and marketing and customer service.

Photograph identification and organization. One of the most well- known current uses of facial recognition technology is photograph identification in social networking applications. For example, some of the top social networking applications use facial recognition technology to identify individuals in photographs. In testimony before Congress, a representative of one such application noted that this allows users to instantaneously link photographs from birthdays, vacations, and other events with people who participated. In addition, several applications use facial recognition technology to help individuals organize personal photographs stored online or on computer drives. For example, several photograph management software programs can detect individuals, such as family members, which the user has asked to be identified. The programs then automatically add new photographs of these individuals to a photograph album created by the user.

Safety and security. Some retailers, casinos, financial institutions, and apartment buildings use facial recognition technology for safety and security purposes. According to the National Retail Federation, some retailers in the United States are testing systems that use facial recognition technology with closed-circuit television for theft prevention. According to one vendor of such a system with whom we spoke, security cameras in a retail location compare images of individuals who walk into a store against a database of images of known shoplifters, members of organized retail crime syndicates, or other persons of interest. If a match is found, security personnel or management are alerted and provided whatever information is known about the individual. Some casinos in the United States similarly use facial recognition systems to help them identify known or suspected gambling cheaters, members of organized crime networks, or other known persons of concern. Facial recognition technology has also been incorporated into the security systems of some financial institutions to identify robbery suspects or accomplices. According to a vendor of this technology, these systems deter crime and help identify suspects much faster than traditional means, which require staff to spend hours reviewing video recordings. Facial recognition systems have also been used in large apartment buildings to help identify perpetrators of crimes or other known persons of concern who seek to enter the property, according to one software vendor with whom we met.

Secure access. Facial recognition technology can be used to provide secure physical access control to buildings or other locked areas. For example, some systems unlock a door after a camera confirms the user’s identity through facial recognition. In addition, applications exist that allow users to unlock personal computers and smartphones, log into video game consoles, or record workplace time and attendance by recognizing their face, in lieu of using a password or personal identification number. Some systems can distinguish whether an image is live to prevent the use of printed photographs to gain access. Industry representatives have noted that these applications have the benefit of not requiring consumers to remember a password and may eventually become an effective voluntary alternative to the use of passwords to access online transactions.

Marketing and customer service. Industry trade organizations have said they envision retailers and others using facial recognition technology to target marketing and advertising more effectively and improve customer service. The Direct Marketing Association has stated that facial recognition technology has the potential to help businesses provide more customized and improved products and services, conduct market research and product development, provide more tailored and relevant messaging and advertising, and offer a more secure shopping experience. Facial recognition technology is already used in digital signs—usually televisions or kiosks displaying advertisements in stores— with cameras that recognize characteristics of the viewer, such as gender or age range, and target advertisements accordingly. This allows retailers and advertisers to show relevant products and deals in real time, possibly leading to more sales, according to the Digital Signage Federation. In the future, such signs may be used to identify customers by name and target advertising to them based on past purchases or other personal information available about them, according to FTC staff. Facial recognition systems can also be designed to alert staff when known customers enter the store, according to a software vendor with whom we spoke. Representatives of the National Retail Federation told us they could envision retailers using facial recognition systems to track customer movements around the store to provide the customer with a better shopping experience.

Other uses. Several other current or potential uses for facial recognition technology have been cited by industry stakeholders:

Facial search engines. Internet search engines are being developed to allow users to conduct a search using a facial image, or to enter a name to search for images that match the name.

Online dating. Some online dating companies use facial recognition to determine the facial features a user finds most attractive and search their database for individuals with similar features.

Memory support. A memory support application for smartphones assists people with prosopagnosia (face blindness) or other memory- related conditions by confirming the identities and providing the names of family members, friends, caregivers, or others.

Hospitality. Facial recognition technology can be used by hotel and guest services industries to identify guests and enable personalized service without having to ask for a guest name or a room number.

NTIA staff told us that the next major expansion for facial recognition technology could be in mobile applications for consumers. Industry representatives and some experts and privacy advocacy organizations have noted that the technology can be deployed in cell phone applications to compare faces captured by the phone to a database of facial images. Some academics have noted that in the future, these types of applications could be integrated into wearable systems, such as eyeglasses.

The Extent of Commercial Use of Facial Recognition Technology Is Not Fully Known

Facial recognition technology is currently being used in a number of commercial applications in the United States, but the full extent of its present use is not known. The International Biometrics & Identification Association, other industry trade organizations, and FTC staff told us they knew of no comprehensive reliable information on the extent to which U.S. businesses use facial recognition technology. Similarly, our review of literature associated with the technology identified no such data. Representatives of the National Retail Federation and Retail Industry Leaders Association told us that their sense was that retailers are not using the technology broadly. Several large companies contacted on our behalf by trade associations declined to speak with us about their use of the technology. An industry trade organization representative told us that companies may be reluctant to discuss the technology for competitive reasons.

Two applications in which facial recognition technology appears to now be widely used are photograph identification and management and security access. One large social networking service with more than 1 billion monthly users started using facial recognition technology in 2011 to facilitate “tagging” users’ friends in photographs. Other large companies have incorporated the technology into photograph management and social networking applications. Representatives of six other top social networking companies told us that they do not currently use facial recognition technology. Facial recognition technology also has become relatively widely used in providing secure access. For example, versions of one major operating system allow users to unlock devices via facial recognition, as do two of the best-selling home video game systems. Many other companies also offer hardware, software programs, or mobile phone applications using facial recognition technology for photograph management or secure access.

In contrast, our review found that less is known about the current prevalence of facial recognition for marketing and security uses. According to the World Privacy Forum, some companies in Europe and Asia currently use facial recognition technology to enhance marketing and customer service, but such use in the United States is less common. A representative of the National Retail Federation told us that U.S. retailers were exploring facial recognition for such purposes, but were taking a slower approach than their overseas counterparts because of concerns over customer reaction. According to the Digital Signage Federation, some digital signs in the United States, such as video monitors displaying advertisements in stores, are used to detect a face or characteristics, such as age and gender for targeted marketing.

Some safety and security applications using facial recognition technology are marketed to retailers, casinos, financial institutions, and other businesses, but the extent of their use is uncertain. A representative of the National Retail Federation said that many retailers were at least in the early stages of looking into facial recognition systems for security purposes, but knew of no data on their current use. A representative of the American Gaming Association told us that facial recognition does not appear to be widely used in U.S. casinos, but that it did not have comprehensive data on such use. Representatives from the American Bankers Association and Financial Services Roundtable told us that they were unaware of any data on the extent of use of facial recognition technology by financial institutions. The American Bankers Association representative said at least one major U.S. bank uses facial recognition technology to identify robbery suspects, but two other major banks stated the technology was not in broad use by financial institutions because of concerns over its accuracy. The International Biometrics & Identification Association told us that some businesses are reluctant to disclose use of the technology because publicizing their specific security practices can diminish their effectiveness.

Stakeholders Have Raised Privacy Concerns Related to the Commercial Use of Facial Recognition Technology

A number of stakeholders—including federal agencies, privacy and consumer groups, and some industry representatives—have identified privacy issues related to commercial use of facial recognition technology. In particular, concerns have been raised by the technology’s potential to identify and track individuals in public without their knowledge, and around the collection, use, and sharing of personal data associated with the technology. However, some industry stakeholders have argued that the technology does not present new or unusual privacy risks, or that such risks can be mitigated.

Privacy Concerns Have Been Raised Related to the Ability to Identify and Track Individuals in Public

While acknowledging the potential benefits of commercial use of facial recognition technology, government agencies, privacy advocacy organizations, academics, and others have raised a number of privacy concerns about the technology and its future direction. As noted earlier, facial recognition technology continues to rapidly improve in accuracy. Further, individuals continue to upload billions of pictures to social networking and other Internet sites, creating a vast repository of facial images that are often linked to names or other personal information. The convergence of these two trends may make it technically feasible one day to identify almost any individual in a wide range of public spaces, according to some privacy advocacy organizations and others. Key privacy concerns related to the commercial application of facial recognition technology have generally centered around (1) its effect on the ability of individuals to remain relatively anonymous in public; (2) the capacity to track individuals across locations; and (3) use of facial recognition without individuals’ knowledge or consent.

Reduction of Anonymity

During the NTIA multistakeholder process, some participants expressed concern that facial recognition technology could affect personal privacy by reducing individuals’ ability to be anonymous when in a public or commercial space, such as a sidewalk or store. The Center for Democracy & Technology has noted that when most individuals are in public, they expect a few people or businesses to recognize their face, but fewer to connect a name to their face, and even fewer to associate their face with Internet behavior, travel patterns, or other profiles.

Commercial use of facial recognition technology for identification purposes, the group states, has the potential to change this dynamic by allowing companies or individuals to collect information on any individual captured by a camera. Privacy advocacy organizations and academics have expressed concern that as being remotely identified in commercial settings becomes more common, some individuals may be uncomfortable visiting certain places, shopping at certain establishments, or assembling in public for a cause they support. Further, the Electronic Privacy Information Center has stated that individuals lose some control over their identity if they are not allowed to choose whether or not they want to remain anonymous in public. The organization has also noted that additional privacy concerns would be raised by use of the technology to identify not just who someone is, but whom they are with.

Tracking

Some participants in the NTIA multistakeholder process and others have expressed concern that facial recognition technology could be used to track individuals’ movements in public, which they said could erode personal privacy. Industry sources told us that, at present, facial recognition technology is not used in a commercial context to track consumers on any widespread scale. However, the Center for Democracy & Technology has stated that if use of the technology to identify individuals in public were deployed widely enough in the future, and if businesses shared facial recognition data with one another, the result could be a network of cameras that readily tracked a consumer’s movements from location to location. Further, it noted that unlike other tracking methods, facial recognition does not require an individual to wear a special device or tag, which reduces individuals’ ability to avoid unwanted tracking. A representative of the World Privacy Forum told us that most consumers would find it invasive of their privacy for security cameras to be used to track their movements for marketing purposes. Likewise, FTC staff have reported that the privacy risks for consumers would increase if companies began using images gathered through digital signs to track consumers across stores. These issues are underscored by concerns consumers have expressed about being tracked in other contexts. For example, a 2009 consumer survey on marketing found that about two-thirds of respondents did not want online advertising targeted to them if it involved having their offline activity tracked. Likewise, a representative of the National Retail Federation told us that customers of a major department store chain reacted negatively after the store posted signs disclosing that customers’ movements within the store were being tracked via their mobile phones.

Knowledge and Consent

Another concern that has been raised is the commercial use of facial recognition technology for identification or verification without individuals’ knowledge or consent. Unlike other biometrics, such as fingerprint identification, facial recognition technology can be used to capture a face remotely and without the individual’s knowledge. In addition, even if consumers are notified and given the option to opt out of the technology, that option may become less feasible as the use of this technology grows. Some industry trade organizations have acknowledged these concerns and expressed caution over deploying the technology in certain contexts without consumer notification and consent. For example, the Software & Information Industry Association said that firms may need to obtain consent prior to deploying the technology in digital signs to identify individuals and record their interests and preferences. The Computer and Communications Industry Association stated that firms’ use of facial recognition technology to match individuals’ names and other biographical information with their faces should be transparent and provide individuals the ability to opt out.

Some Stakeholders Believe Facial Recognition Technology Raises Issues about the Use and Security of Personal Data

Privacy advocacy organizations, government agencies, academics, and some industry representatives also have raised privacy and security issues associated with personal data collected in conjunction with commercial use of facial recognition technology. Many of these issues mirror concerns about the collection, use, and sharing of personal data more broadly by commercial entities. Key data privacy issues that have been raised with regard to facial recognition technology in particular include the following:

Consumer control over personal information. Some privacy advocacy organizations and others have reported that, like other forms of personal data, information that is collected or associated with facial recognition technology could be used, shared, or sold in ways that consumers do not understand, anticipate, or consent to. Commenters to the FTC Face Facts Forum noted that the proliferation in recent years of information resellers, and of data sharing among third parties, raises questions about whether faceprints and associated personal data may one day be sold or shared. Facial recognition data may be particularly valuable to marketers because they potentially could link a person’s online presence and offline presence, according to two experts we spoke with. One privacy expert told us that risks to consumer privacy would increase if retailers were to develop relationships with social networking sites, which typically possess consumers’ facial images and detailed personal information that could be used for marketing. As we concluded in our September 2013 report on information resellers, consumers generally do not have the right to prevent their personal information from being collected, used, or shared for marketing purposes.

Data security. Industry trade organizations, government agencies, and privacy advocacy organizations have noted that commercial use of facial recognition technology raises the same security concerns as those associated with any personal data. Participants in the NTIA multistakeholder process noted that facial recognition data could be subject to data breaches that result in sensitive biometric data being revealed to unauthorized entities. Because a person’s face is unique, permanent (absent surgery), and therefore irrevocable, a breach involving data derived from or related to facial recognition technology may have more serious consequences than the breach of other information, such as passwords or credit card numbers, which can be changed. The Electronic Privacy Information Center has stated that the risk of theft of data associated with the technology could increase the possibility of identity theft, harassment, and stalking. The International Biometrics & Identification Association has said that faceprints, when stored with other identity data, should be considered personally identifiable information and provided all the security and privacy protections bestowed upon these personal data. At the same time, industry representatives have noted that security concerns are mitigated, to some extent, because at present faceprint algorithms are specific to a vendor and of little use outside that vendor’s system if obtained through a breach.

Misidentification. Industry and other stakeholders have said that facial recognition technology may generate more matching errors than other forms of biometric identification because facial recognition technology systems are currently less accurate than other biometrics. Representatives of the Electronic Privacy Information Center have expressed concern that if someone’s image is captured and misidentified, adverse information—such as an incorrect identification of an individual as a shoplifter—could propagate in the long-term throughout different commercial systems, sometimes without the individual’s knowledge.

Disparate treatment. Some stakeholders in the NTIA multistakeholder process expressed concerns about disparate treatment for certain groups based on information derived from facial recognition systems. They also noted that individuals who declined to consent to a retailer’s request for facial recognition could be denied access to certain products or services. The World Privacy Forum expressed the view that digital signage networks have the potential to create a new form of marketing surveillance that it believes raises the possibility of unfairness, discrimination, and abuses of personal information. In addition, the Center for Democracy & Technology has expressed concerns about the use of facial recognition technology for classification purposes, such as to detect gender, race, and age range. The organization expressed the view that this could lead to profiling—the use of personal characteristics or behavior patterns to make generalizations about a person—that could lead to, for example, price discrimination for certain groups.

Other Stakeholders Believe That the Technology Does Not Present New or Unusual Privacy Risks

In contrast, some industry representatives have argued that commercial use of facial recognition technology does not present new or unusual privacy risks, that risks that do exist can be mitigated, and that any potential loss of privacy should be weighed against the benefits the technology confers. In position papers, other written materials, or in interviews we conducted, some industry stakeholders have expressed the following views: Individuals should not expect complete anonymity in public. The National Retail Federation and the International Biometrics & Identification Association have argued that individuals effectively give up some of their anonymity when they make their faces public. The latter has contended that privacy and anonymity are not the same and that losing complete anonymity is not tantamount to a surrender of privacy. Further, the organization has argued that capturing a facial image or faceprint in public does not necessarily remove an individual’s anonymity because it does not directly reveal a name, Social Security number, or any other personal information.

Surveillance is already part of our daily life. The International Biometrics & Identification Association has noted that commercial entities already routinely have security cameras and that facial recognition does not increase their use. Further, it says that privacy advocacy organizations may have overstated the capabilities of facial recognition technology systems, noting that cameras generally are not interconnected and that it is not practical to conceive of a commercial application that would use multiple cameras to track individuals’ movements.

Consumers have shown a willingness to give up some privacy for the benefits technology offers. Industry stakeholders have generally noted that there are inherent trade-offs between some loss of privacy and the benefits that new technologies confer to consumers and businesses, and to economic growth in general. As we noted in our September 2013 report on information resellers, representatives of the marketing and information technology industries, among others, have argued that consumers’ expectations and notion of privacy have changed in an era of innovative technologies. For example, they said, consumers have shown they are willing to share private information in public settings—such as by posting to social networking sites in order to gain such benefits as photograph sharing and management.

The need for consent should depend on the context. Industry trade organizations including the Software & Information Industry Association, Computer and Communications Industry Association, and National Retail Federation have stated that the need for consumer consent should depend on the context under which facial recognition technology is used. For example, two of the trade organizations say that businesses that use the technology for security may not need to obtain consent before using the technology, as opposed to social networking sites that have repositories of facial images to identify individuals more broadly.

Facial recognition technology should not be singled out. Some industry representatives have stated that the privacy issues associated with facial recognition technology are largely the same as those for any biometric technologies—particularly for emerging technologies like voice or gait recognition, which also can identify individuals from afar without their knowledge. Several facial recognition technology companies have said that policymakers should focus on protecting personal information, which would include all biometrics, not just facial recognition technology.

Several Stakeholders Have Suggested Privacy Guidelines, and Company Privacy Policies Vary in Addressing Facial Recognition

Several government, industry, and privacy organizations have proposed or are developing suggested privacy guidelines for commercial use of facial recognition technology. Firms may describe how they collect, use, and store data in published privacy policies, and the policies we reviewed varied in whether and how they addressed facial recognition technology.

Privacy Guidelines Have Been Proposed by Several Organizations

Several different groups, including a government agency, industry trade organizations, and a privacy advocacy organization have proposed, or are in the process of developing, privacy guidelines or best practices for commercial use of facial recognition technology. Most of these guidelines are based at least to some extent on the Fair Information Practice Principles, a set of internationally recognized principles for balancing the privacy and security of personal information with other interests. Our review found some areas of agreement in the different organizations’ recommended practices—for example, all recommended that users of facial recognition technology publish a privacy policy describing their data collection practices. However, the guidelines differed in other key areas, such as if and when firms should obtain individuals’ consent prior to using the technology to identify them.

NTIA Multistakeholder Process

As of June 2015, NTIA’s multistakeholder process for facial recognition was ongoing. As noted previously, the goal of the process is to develop a voluntary, enforceable code of conduct for facial recognition technology that incorporates privacy principles outlined in the 2012 White House privacy framework. Once the process is complete, companies for which the code is relevant may commit to abide by the code, and that company’s adherence to the code, after having made such a commitment, is enforceable by FTC.

The process is open to the public and has involved a series of meetings held in Washington, D.C., with remote access via teleconference and webcasting. At the 11 meetings that NTIA had convened as of June 2015, stakeholders have discussed the privacy and technical issues related to current and potential uses of facial recognition technology, and how a code of conduct might address those issues. Topics of discussion have included issues to be considered in drafting a code of conduct, who its provisions should apply to, the circumstances under which informed consent should be obtained from consumers, and the impact of a code of conduct. The participants with whom we spoke had mixed views on the process. One industry participant said that the meetings had provided a good forum for discussing concerns about the technology, while other participants expressed concern that the process was moving slowly or that any resulting code of conduct would not be widely adopted or provide real privacy protections. Some participants expressed disappointment that there has not been greater involvement by social networking services, given that they are major users of the technology and possess large numbers of faceprints. In June 2015, nine privacy and consumer groups issued a joint statement announcing that they were withdrawing from the multistakeholder process, stating that the process was unlikely to yield a set of privacy rules that offers adequate protections for the use of facial recognition technology. Other stakeholders decided to continue the discussions toward a code of conduct, and the next meeting was scheduled for July 28, 2015.

International Biometrics & Identification Association

In August 2014, the International Biometrics & Identification Association released “Privacy Best Practice Recommendations for Commercial Biometric Use,” which it also submitted as part of the NTIA process. Key elements of these recommendations for businesses include the following:

Users of biometric technologies, which include facial recognition technology, should publish privacy policies, which should specify the types and purposes of the biometric data captured, the nonbiometric data that are being associated with the biometric data, and the amount of time that biometric data will be stored.

When using biometrics to detect or classify an individual, businesses should post a general notice. When using biometrics to identify an individual, whether to provide notice depends on the context; for example, universal notification may be impractical, the association said, if the technology is used to identify every person entering an office building.

Firms should use good cybersecurity practices to protect any information collected or retained; provide a mechanism for consumers to obtain a record of data maintained on them and have that data corrected if necessary or removed; restrict third-party access to biometrics unless that access is disclosed as a purpose of the data collection; and maintain an appropriate audit trail for accountability.

The International Biometrics & Identification Association does not currently track implementation of these recommendations and refers to them as “general guidelines.” It also says that it leaves it to those using the technology to determine what is most appropriate given the application and its purpose, the risk and consequence of abuse, and the nonbiometric data used. The American Civil Liberties Union and the Center for Digital Democracy have been critical of these best practices, objecting, for example, to the statement that it is impractical to obtain consent for use of facial recognition from consumers entering buildings.

American Civil Liberties Union

The American Civil Liberties Union issued “An Ethical Framework for Facial Recognition” in May 2014, and provided it for discussion during the NTIA multistakeholder process. The framework recommends stricter standards for use, notice, and consent than those recommended by the International Biometrics & Identification Association, including that users of facial recognition technology should not use the technology to determine an individual’s race, color, religion, sex, national origin, disability, or age; prominently notify individuals when facial recognition is in operation; obtain specific consent from an individual before storing a photograph or faceprint of that person or sharing any facial recognition data with a third party; allow individuals to access, correct, and delete their faceprint information; and consider what special precautions might be needed when using a facial recognition system with teenagers.

Digital Signage Federation

In February 2011, the Digital Signage Federation issued privacy standards for its members that it developed in collaboration with the Center for Democracy & Technology. Among other things, the standards state that companies should disclose in privacy policies the data collected by digital signs and the purpose of the data; obtain affirmative consent before using facial recognition to identify an notify consumers at the physical location of the sign when using facial recognition (or other means) to collect other information about an individual, such as age range or gender; not share data for any uses incompatible with those specified in the allow consumers to submit complaints and request to access their data.

The Digital Signage Federation has a process to certify that member firms are abiding by these standards, and the federation reported that 28 of its 221 member firms had been certified as of May 2015.

Federal Trade Commission

FTC issued a staff report in October 2012 that included recommended best practices for commercial uses of facial recognition technology to protect consumer privacy. The report synthesized the discussions and comments from FTC’s December 2011 Face Facts Forum to explore advances in facial recognition technologies, current and possible future commercial uses, ways consumers can benefit from these uses, and privacy and security concerns. FTC staff said the best practices are intended to provide guidance to commercial entities that are using or plan to use facial recognition technologies in their products and services, while promoting innovation. The best practices were based on core principles outlined in FTC’s March 2012 report on consumer data privacy. These principles included providing consumers with meaningful choices about use of their data at a relevant time and context, ensuring that practices related to information collection and use are transparent, and building in privacy protections during product development. Among the best practices recommended for companies using facial recognition technology were obtaining individuals’ affirmative consent before identifying them in anonymous images to someone who could not otherwise identify them; providing clear notice to individuals when using facial recognition to providing individuals with a choice about whether any data collected with facial recognition technology are shared with third parties; and implementing a specified retention period for personal data and disposing of stored images once they are no longer necessary for the purpose for which they were collected.

One FTC commissioner issued a dissenting statement with the staff report, stating there was little evidence that facial recognition technology was likely to cause tangible injuries to consumers in the near future, and that following the staff report’s recommendations would create a burden on businesses in many contexts. Representatives of several privacy advocacy organizations told us they believed the FTC staff report provided a good summary of the issues but had not resulted in noticeable changes in industry practices.

Privacy by Design

In addition to best practices and codes of conduct, some stakeholders have advocated addressing consumer privacy through “privacy by design”—the practice of building in consumer privacy protections at every stage of product development. For example, FTC staff and the Privacy Rights Clearinghouse have both noted that systems can be designed to ensure that data collected by facial recognition technology are not used beyond specified purposes, either by automatically deleting the data after they are used, or ensuring the data cannot be repurposed. The International Biometrics & Identification Association has cited the need for systems that block “web-crawlers,” which seek to surreptitiously gather images and other information from websites containing facial images and other personal data. Firms that develop facial recognition technology also told us that some measures can be taken to build privacy controls into facial recognition systems. These include segregating biometric data from other personal data, as well as encrypting data, which can be especially important for entities that possess large numbers of photographs matched with other identifying information. However, some representatives of industry and privacy advocacy organizations have argued that privacy by design has limitations. Industry representatives noted that facial recognition technology systems generally are built to be flexible and provide users with the option to choose among different levels of privacy protection. This may allow users to bypass privacy protections, such as a data retention time frame, that have been included in the system’s design.

Some Companies Address Facial Recognition Technology in Their Privacy Policies

We reviewed the written privacy policies, as of May 2015, of selected businesses in three industries—social networking, retail, and gaming—to identify whether and how these policies expressly addressed facial recognition technology. In published privacy policies, firms may describe the data they collect, their uses for these data and circumstances under which they may be shared with third parties, and how these data are stored. Firms that publish a privacy policy may not be required to describe their use of facial recognition technology, if any. Therefore, some firms may be using facial recognition technology even if they do not address the technology in their privacy policies. However, because we were unable to determine whether most companies we selected used facial recognition technology, their failure to mention it in their privacy policies could also mean that they do not use the technology.

Two companies operating social networking applications that use facial recognition technology expressly address how they use the technology in their privacy policies and associated documents. One of these companies automatically uses facial recognition technology to facilitate tagging a user’s friends in photographs unless the user opts out. The user can turn off the facial recognition feature, at which time the user’s facial templates are deleted. Users can also “untag” themselves in photographs. Company representatives told us that the firm’s approach to privacy is to provide multiple opportunities for users to exercise control over their data—for example, through privacy settings and tools that allow users to select who can see their personal information and content. Company representatives told us that the firm has no plans at this time to share facial recognition faceprints with third parties and that personal information associated with facial recognition technology would not be shared without user consent.

In contrast, the second company requires users to approve the use of its face tagging feature before it is enabled, which company representatives told us is in accordance with the FTC staff report’s suggested best practices. That company told us it does not share and has no plans to share personal information associated with facial recognition technology without user consent, except in very limited circumstances as described in its privacy policy (i.e., with domain administrators, for external processing by company affiliates or trusted parties, or for legal reasons).

This company has also developed a digital eyeglass product. In a June 2013 letter to a Member of Congress, the company said it would not provide facial recognition capabilities for that product, or allow third-party developers to do so, until it had strong privacy protections in place. The letter also stated that the company would prohibit developers from disabling a feature that would alert the public when the digital eyeglass product was being used to take a photograph or video. The firm also stated that the product was covered by the company’s privacy policy and that no changes were contemplated for its privacy policy to specifically address the product.

The five major retail chains and four large casino companies that we selected did not expressly address facial recognition technology in their written privacy policies, although as indicated earlier, we were unable to determine whether these firms use the technology. A representative from the National Retail Federation told us that retailers’ privacy policies are written broadly enough to address facial recognition technology, even if they do not expressly mention it. The privacy policies of three of the five retailers we reviewed did address their stores’ use of video cameras (which can be a component of facial recognition systems). All three policies specified that the cameras are used for security purposes or to measure store traffic, while one policy noted that the cameras were used for collecting information about their customers. None of the five policies made reference to the use of digital signs, which, as noted earlier, can incorporate facial recognition technology. Similarly, none of the privacy policies of the four large U.S.-based casino companies we reviewed made reference to the use of facial recognition technology in the United States.

Some Federal Laws May Potentially Apply to Facial Recognition Technology, but Do Not Fully Address Stakeholder Privacy Issues

Some federal laws may potentially be applicable to the commercial use of facial recognition technology, but these laws do not fully address the privacy concerns that have been raised about facial recognition technology by some stakeholders. Views differ on the need for additional legislation.

Federal Law Does Not Expressly Regulate the Commercial Use of Facial Recognition Technology, but Some Laws May Potentially Apply in Certain Circumstances

The United States does not have a comprehensive privacy law governing the collection, use, and sale of personal information by private-sector companies. In addition, we did not identify any federal laws that expressly regulate commercial uses of facial recognition technology in particular. However, there are three areas in which certain federal laws that address privacy and consumer protection may potentially apply to commercial uses of facial recognition technology: (1) the capture of facial images; (2) the collection, use, and sharing of personal data; and (3) unfair or deceptive acts or practices, such as failure to comply with a company’s stated privacy policies.

Capture of Facial Images

Generally, individuals can take pictures while on public property and in commercial spaces open to the public unless prohibited by the business or property owner. We did not identify federal laws that generally restrict the capture of facial images. One federal law, the Video Voyeurism Prevention Act of 2004, prohibits the taking of certain types of pictures in limited circumstances. The act makes it a crime to intentionally capture an image of a “private area” of an individual without his or her consent, or to knowingly do so under circumstances in which that individual has a reasonable expectation of privacy. While the definition of a private area does not include a person’s face, the act could affect the specific placement of cameras in certain parts of commercial spaces, such as retail stores’ dressing rooms.

Collection, Use, and Storage of Personal Information

Federal laws addressing privacy issues in the private sector are generally tailored to specific purposes, situations, types of information, or sectors or entities. In general, these laws, among other things, limit the disclosure of certain types of information to a third party without an individual’s consent, or prohibit certain types of data collection. Some of these laws also set standards for how certain personal data should be stored and disposed of securely. These laws may potentially apply to facial recognition technology in two ways. First, they may potentially limit some firms’ ability to share data collected with facial recognition technology, such as a person’s image and faceprint, or a person’s location at a given time. Second, these laws may potentially limit firms’ access to personal information that could be used in connection with the technology, such as a person’s photograph, name, age, address, or purchase history. As shown in table 1, the general applicability of these laws depends on some combination of the source of the data, the means of collection, the entity collecting the data, the type of data being collected, and the purpose for which the data are being used. For additional details on these federal laws and their potential applicability to facial recognition technology, see appendix II.

Table I: Federal Laws Specifically Addressing the Collection, Use, and Storage of Personal Information Federal law Driver’s Privacy Protection Act Addresses the use and disclosure of personal Applicability to collection, use, and storage of personal information information contained in state motor vehicle records.

Governs the disclosure of nonpublic information collected by financial institutions, and sets standards for data security.

Applicability to collection, use, and storage of personal information Governs the disclosure of individually identifiable health information collected by covered health care entities, and sets standards for data security.

Governs the disclosure of personal information collected or used for eligibility determinations for such things as credit, insurance, or employment.

Governs the disclosure of personally identifiable information from education records.

Generally prohibits the online collection of personal information from children under 13 without verifiable parental consent.

Prohibits the interception and disclosure of electronic communications by third parties unless a specified exception applies.

Computer Fraud and Abuse Act Prohibits obtaining information from a protected computer through the intentional access of a computer without authorization or exceeding authorized access.

Unfair or Deceptive Acts or Practices

Section 5 of the Federal Trade Commission Act (FTC Act) authorizes FTC to take action against unfair or deceptive acts or practices in or affecting commerce. Although the act does not explicitly grant FTC the authority to protect privacy, FTC has interpreted it to apply to deceptions or violations of written privacy policies. For example, if a retailer has a written privacy policy stating it does not use facial recognition technology to identify customers and later breaches the policy by doing so, FTC staff have stated the agency could prosecute the retailer if it determined such violation constituted a deceptive practice. Likewise, FTC staff told us that the act could apply if firms violate written privacy policies on how they use or share personal information that was collected in conjunction with facial recognition technology. In addition, according to FTC staff, the FTC Act’s “unfairness” authority could apply even in the absence of a privacy policy, in situations where an act or practice causes or is likely to cause substantial injury to consumers that is not reasonably avoidable by consumers themselves and not outweighed by countervailing benefits to consumers or to competition. FTC staff told us that as of June 2015, the agency had not taken any enforcement actions on privacy issues specifically with regard to the use of facial recognition technology or other biometrics. However, more generally, the agency had brought more than 40 cases related to privacy, and more than 50 cases related to data security, against companies that had engaged in unfair or deceptive practices.

Selected State Laws

Two states—Texas and Illinois—have adopted privacy laws that expressly address commercial uses of biometric identifiers, including scans of face geometry such as those gathered through facial recognition technology. A report by a committee of the Texas House of Representatives noted that there were concerns that biometric data were increasingly becoming a target of identity theft and needed to be safeguarded. Similarly, the Illinois General Assembly noted that use of biometrics was growing in the business and security screening sectors and that the ramifications of this technology were not fully known. Both the Texas and Illinois laws require that before collecting a biometric identifier of an individual, a private entity must obtain that individual’s consent; prohibit an entity in possession of a biometric identifier from sharing that person’s biometric identifier with a third party, unless the disclosure meets an exception, such as for law enforcement or to complete a financial transaction that the individual requested or authorized; and govern the retention of biometric records, including requirements for protecting biometric information and destroying such information after a certain period of time.

In addition, according the National Conference of State Legislatures, most states have general privacy laws applicable to personal data, which may also potentially apply to information collected with, or otherwise connected to, facial recognition technology. As of January 2015, according to the organization, 47 states, the District of Columbia, Guam, Puerto Rico, and the Virgin Islands had enacted legislation requiring companies to notify residents if their personal information in the companies’ custody was compromised. Further, at least 32 states and Puerto Rico have enacted laws that require entities to destroy, dispose of, or otherwise make personal information unreadable or undecipherable after it is no longer being used or after a specified amount of time, according to the National Conference of State Legislatures.

Federal Laws Do Not Fully Address Stakeholder Privacy Concerns about Facial Recognition Technology, but Views Differ on the Need for Additional Legislation

Federal laws do not fully address the privacy issues that stakeholders have identified with commercial uses of facial recognition technology. As previously discussed, no federal law expressly regulates commercial use of facial recognition technology. This means that federal law does not expressly regulate the circumstances under which facial recognition technology may be used by commercial entities to identify and track someone with whom they have no prior relationship. Further, federal law does not expressly regulate whether and when firms should notify consumers of their use of facial recognition technology, or seek an individual’s consent prior to identifying them, which has been an area of concern to privacy advocacy organizations and others.

Certain federal laws do address the collection, use, and sale of personal information by private-sector companies, as discussed earlier. These laws could potentially restrict, in certain circumstances, the collection of facial images, which are used to build a database for use with facial recognition technology. For example, provisions in the Driver’s Privacy Protection Act restrict state motor vehicle bureaus from selling drivers’ license photographs and associated information to private parties. In addition, the Gramm-Leach-Bliley Act and Health Insurance Portability and Accountability Act potentially could restrict the ability of banks and health care providers to share data collected with facial recognition technology if those data were to fall within the laws’ definitions of protected information. However, the reach of these laws is limited because they generally apply only for specific purposes, in certain situations, to certain sectors, or to certain types of entities. As a result, they do not comprehensively address how commercial entities other than those explicitly covered by the specific laws may collect, use, or share personal data in conjunction with facial recognition technology.

Additionally, depending on the context, federal law does not require firms that collect personal information to follow detailed standards for verifying the accuracy of data developed through computer matching. As noted earlier, facial recognition algorithms may misidentify individuals and may not be as accurate as other forms of biometric identifiers because of technological challenges in accurately matching photographs and because users typically can adjust settings for the degree of accuracy required for a match. In a 2012 report, FTC stated that measures to ensure the accuracy of the consumer data that companies collect and maintain should be scaled to the intended use and sensitivity of the information. One privacy expert we met with stated that in some commercial contexts facial recognition technology is used to identify criminals, such as shoplifters. As such, misidentifying an innocent individual could be detrimental. In most contexts, federal law may not provide consumers with the right to correct or delete inaccurate personal information collected by commercial firms.

Some privacy advocacy organizations have argued for new legislation or regulation to address privacy issues associated with facial recognition technology. The American Civil Liberties Union has contended that government intervention and statutorily created legal protections are needed to protect against the negative effects of this technology. In testimony before the Senate in 2012, the Electronic Frontier Foundation stated that because of the risk that faceprints will be collected without individuals’ knowledge, rules should define clear notice requirements to alert people that a faceprint has been collected and include information on how to request that data collected on them be removed. One academic has argued specifically for legislation that would require individuals’ explicit consent before a company could capture or use their faceprint, and would require companies to provide individuals with information about the uses of their biometric data. The Center for Digital Democracy has urged FTC to recommend new safeguards for adolescents relating to facial recognition. The Center for Democracy & Technology has stated that the technology poses complex privacy issues that do not fit squarely with present laws because these laws apply only indirectly to facial recognition and offer consumers no real choices with regard to the technology.

Views vary on the approach that additional privacy legislation or regulation, if any, should take to address these issues. The Center for Democracy & Technology argues that current federal privacy law is a confusing patchwork targeting discrete economic sectors with different rules. Therefore, it contends that Congress should not pass privacy legislation for facial recognition technology alone, but rather as a comprehensive framework that protects all personal information. One industry representative told us he believed that federal privacy legislation could benefit firms by clearly defining acceptable practices, but that any legislation should focus comprehensively on personal data rather than a specific technology. In February 2015, the White House proposed draft legislation to establish baseline protections for individual privacy in the commercial arena. However, one academic privacy expert told us he believed that legal protections specific to facial recognition technology are needed because, as a practical matter, comprehensive privacy legislation is unlikely to be enacted in the foreseeable future. In comments submitted to FTC, several industry groups noted that facial recognition technology should not be regulated in a “one size fits all” manner. One company also noted that the privacy issues that arise from using facial recognition to surreptitiously identify a person in public are very different from the issues involved in using the technology to organize personal photographs, and that privacy regulations should be designed with respect to these different uses.

However, most industry representatives have argued that new legislation or regulation is not necessary to address privacy issues associated with facial recognition technology, contending that self-regulation—such as voluntary codes of conduct and best practices—and privacy by design are effective alternatives. Industry trade organizations have urged caution in expanding privacy law in general, arguing that absent any identifiable harm in the marketplace, privacy issues are best addressed through industry self-regulatory programs and best practices. In a 2012 Senate Committee hearing, a representative of the Digital Advertising Alliance said that industry self-regulation is flexible and could adapt to rapid changes in technology and consumer expectations, whereas legislation and government regulation could be inflexible and quickly become outdated in an era of rapidly evolving technologies. Specifically with regard to facial recognition technology, the industry association TechAmerica has contended that self-regulation based on the Fair Information Practice Principles, coupled with privacy by design, has provided consumers with the necessary privacy protections. The National Retail Federation and others have argued that it may be too early to consider additional regulation of facial recognition technology because the technology is still in the early stages of development and thus the privacy issues raised are mostly speculative. The group argued that such regulation could inhibit innovation and deny businesses and consumers beneficial products, while protecting against harms that might never have occurred.

In contrast, some consumer and privacy advocacy organizations have argued that self-regulation is not sufficient to fully address privacy concerns because it may be limited in scope, limited in coverage to those entities that choose to participate, and subject to change. For example, a study of industry privacy self-regulatory programs from 1997 through 2007 by the World Privacy Forum argued that these programs often lacked a meaningful ability to enforce their own rules or maintain memberships, and covered only a fraction of an industry or an industry subgroup. The Center for Digital Democracy questioned the effectiveness of the NTIA’s multistakeholder process for developing voluntary industry standards, contending that a previous process covering mobile applications did not lead to any significant changes in that industry’s privacy practices. One former industry representative told us that firms using facial recognition technology would not abide by voluntary codes of conduct if those codes damaged their commercial interests. In contrast, he believes that privacy legislation can provide firms with a financial incentive to abide by privacy principles because of the reputation risk caused by a public violation of privacy law. The White House framework for consumer data privacy, while supporting industry-wide codes of conduct, also suggested that Congress enact legislation to provide FTC with the ability to enforce the Consumer Privacy Bill of Rights independently. Similarly, in its 2012 report on protecting consumer privacy, FTC noted that while it has supported self-regulatory efforts, privacy self-regulation had not gone far enough and that Congress should consider enacting baseline privacy legislation.

In our September 2013 report on personal information collected for marketing purposes, we suggested that Congress consider strengthening the consumer privacy framework to reflect the effects of changes in technology and the marketplace, a suggestion that is underscored by the privacy issues associated with facial recognition technology. We identified how advances in technology and marketplace practices had resulted in vast changes in the amount and type of personal information collected. We also found that gaps existed in federal privacy law because it had not adapted to new technologies. As of July 2015, Congress has not passed legislation addressing our 2013 suggestion.

Concluding Observations

Facial recognition technology may be employed in a wide range of useful commercial applications, but the future trajectory of the technology raises questions about consumer privacy. Federal law does not expressly address the circumstances under which commercial entities can use facial recognition technology to identify or track individuals, or when consumer knowledge or consent should be required for the technology’s use. Further, in most contexts federal law does not address how personal data derived from the technology may be used or shared. NTIA’s multistakeholder process to develop a voluntary code of conduct is a positive step toward incorporating privacy considerations into the development and use of facial recognition technology. However, views vary on the efficacy of voluntary and self-regulatory approaches versus legislation and regulation to protect privacy. The privacy issues stakeholders have raised about facial recognition technology and other biometric technologies serve as yet another example of the need to adapt federal privacy law to reflect new technologies. As such, we reiterate our 2013 suggestion that Congress strengthen the current consumer privacy framework to reflect the effects of changes in technology and the marketplace.

Agency Comments

We provided a draft of this report for review and comment to the Department of Commerce and the Federal Trade Commission. We received technical comments from them, which we incorporated as appropriate. We also provided relevant excerpts of the draft for technical review to selected private parties cited in our report, and included their technical comments as appropriate.

We are sending copies of this report to Commerce, FTC, appropriate congressional committees and members, and other interested parties. The report also is available at no charge on the GAO website at http://www.gao.gov.

Should you or your staff have questions concerning this report, please contact me at (202) 512-8678 or cackleya@gao.gov. Contact points for our Offices of Congressional Relations and Public Affairs may be found on the last page of this report. Key contributors to this report are listed in appendix III.

Appendix I: Objectives, Scope, and Methodology

This report examines (1) the uses of facial recognition technology for consumers and businesses, (2) privacy issues that have been raised in connection with commercial uses of facial recognition technology, (3) proposed best privacy practices and industry privacy policies related to facial recognition technology, and (4) privacy protections under federal law that may potentially apply to facial recognition technology. The scope of this report includes use of the technology by companies and other private entities and does not include use by federal, state, or local government agencies. This report covers use of the technology in the United States and not in other countries. It focuses primarily on use of the technology to identify or verify an individual and not on facial detection (which simply detects when a face is present).

To address the first two objectives, we identified and reviewed relevant studies and reports, congressional testimony, position papers, and other documents from industry stakeholders, privacy and consumer advocacy organizations, federal agencies, and academic and industry experts. These included, among others, the Federal Trade Commission’s (FTC) 2012 staff report on facial recognition technology; transcripts and written comments stemming from FTC’s 2011 facial recognition technology forum; agendas, meeting summaries, and documents submitted by participants from the Department of Commerce’s (Commerce) National Telecommunications and Information Administration’s (NTIA) multistakeholder process on facial recognition technology in 2014 and 2015; and testimony and written statements from a 2012 congressional hearing on facial recognition technology. In addition, we reviewed product information and marketing material from selected companies that develop and sell products using facial recognition technology. We conducted a literature search to identify academic and trade articles on commercial applications of facial recognition technology, as well as privacy issues raised by the technology. We used these articles to corroborate information we obtained from industry stakeholders, privacy and consumer advocacy groups, and federal agencies. In conducting this search, we generally obtained information from various online research sources such as Proquest, Nexis, and Dialogue. We also used Internet search techniques and key word search terms to identify additional sources and types of available information about how facial recognition technology works, how it is used in commercial applications, and what privacy issues are raised by its use.

To address the third objective, we reviewed the Fair Information Practice Principles and White House Consumer Privacy Bill of Rights, as well as privacy guidelines and best practices with specific application to facial recognition and biometric technologies issued by the American Civil Liberties Union, Digital Signage Federation, FTC staff, and the International Biometrics & Information Association. We also reviewed the privacy policies of selected companies in the social networking, retail, and casino industries, which we obtained from company websites. We chose those industries because they were widely cited among government and industry stakeholders as among the most significant users, or potential users, of facial recognition technology. Specifically, we reviewed the privacy policies of (1) two U.S. companies that currently use facial recognition technology and are ranked number one and number five, respectively, of the most popular social networking websites, based on estimated unique monthly visitors as of December 2014; (2) the five largest retail companies in the United States based on 2013 retail sales; and (3) the four largest U.S. casino companies, based on worldwide revenue in 2013. We reviewed each privacy policy and relevant supporting documents for key words such as “facial recognition technology,” “photos,” “video,” and “surveillance cameras” to determine whether and how they addressed the use of facial recognition technology. While we identified whether and how the privacy policies addressed facial recognition technology specifically, we did not conduct a broad evaluation or assessment of these policies more generally because that was outside the scope of this engagement. We also met with representatives of two companies that provide social networking applications to discuss, among other things, how facial recognition technology was addressed in their privacy policies. We also inquired with trade organization representatives about meeting with major retailers and casinos to discuss facial recognition technology, but the trade organizations told us that these companies declined to speak to us.

To examine privacy protections under federal law that may potentially apply to commercial uses of facial recognition technology, we reviewed and analyzed relevant federal laws and regulations to examine their potential applicability to the commercial use of facial recognition or other biometric technologies. We then reviewed laws, as well as relevant agency regulations, in terms of their general purpose and potential applicability to facial recognition or other biometric technologies. We also reviewed prior work we had conducted on federal privacy law as it relates to commercial entities. We also reviewed state laws in Illinois and Texas that expressly addressed privacy issues related to commercial use of facial recognition technology or other biometric identifiers. We selected these laws for review because Illinois and Texas were the two states we identified as having such laws, based on our interviews and a review of relevant law review articles and information from the National Conference of State Legislatures. This review was intended to provide illustrative examples and was not exhaustive, and thus may not have identified all state laws that may exist addressing privacy and biometrics. In addition, we reviewed the previously mentioned congressional testimony, comments submitted to FTC’s 2011 forum, and documents submitted to NTIA’s multistakeholder process that addressed the applicability of federal law to facial recognition technology.

To address all four objectives, we conducted interviews with, and obtained documentation from, representatives of federal agencies, including FTC and Commerce’s NTIA and National Institute of Standards and Technology; companies that use facial recognition technology; companies that develop facial recognition products; trade associations, including the American Bankers Association, American Gaming Association, Interactive Advertising Bureau, National Retail Federation, and Retail Industry Leaders Association; privacy or consumer advocacy organizations, including the American Civil Liberties Union, Center for Democracy & Technology, Electronic Frontier Foundation, Electronic Privacy Information Center, and World Privacy Forum; and two academics who have participated in the FTC FaceFacts Forum or NTIA multistakeholder process and who have studied these issues. We also interviewed the International Biometrics & Information Association and conducted a group interview with seven of its member companies that it had invited to participate.

We conducted this performance audit from July 2014 to July 2015 in accordance with generally accepted government auditing standards. Those standards require that we plan and perform the audit to obtain sufficient, appropriate evidence to provide a reasonable basis for our findings and conclusions based on our audit objectives. We believe that the evidence obtained provides a reasonable basis for our findings and conclusions based on our audit objectives.

Appendix II: Federal Laws Specifically Addressing the Collection, Use, and Storage of Personal Information

This appendix describes the federal laws that specifically address the collection, use, and storage of personal information by private entities, and these laws’ potential applicability to commercial uses of facial recognition technology.

Driver’s Privacy Protection Act. Enacted in 1994, the Driver’s Privacy Protection Act generally prohibits the use and disclosure of certain personal information contained in state motor vehicle records for commercial purposes, with some exceptions. The act’s definition of personal information includes the driver’s license photograph, as well as any other information that identifies an individual, including Social Security number, driver identification number, name, address (except 5- digit zip code), telephone number, and medical or disability information.

Gramm-Leach-Bliley Act (GLBA). Enacted in 1999, the Gramm-Leach- Bliley Act contains provisions that restrict, with some exceptions, the disclosure of nonpublic information by entities that fall under GLBA’s definition of a “financial institution” or that receive nonpublic personal information from such a financial institution. GLBA generally requires financial institutions to provide notice and an opportunity for consumers to opt out before sharing their nonpublic information with nonaffiliated third parties, other than for certain purposes such as processing a financial service authorized by the consumer. Regulations implementing GLBA do not specifically cite facial images or biometric identifiers—which are used by some financial institutions to verify customers—in the definition of nonpublic personal information. However, the definition does include personally identifiable financial information, which is defined to include any information that financial institutions obtain about a consumer in connection with providing a financial product or service to that consumer, such as the fact that an individual is a consumer or customer of a particular financial institution.

Health Insurance Portability and Accountability Act. Enacted in 1996, the Health Insurance Portability and Accountability Act establishes a set of national standards for the protection and safeguarding of individually identifiable health information. With some exceptions, rules implementing the act require an individual’s written authorization before a covered entity—a health care provider that transmits health information electronically in connection with covered transactions, health care clearinghouse, or health plan—may use or disclose that individual’s individually identifiable health information, including for commercial purposes. The rules also give individuals the right to have a covered entity amend their protected health information if it is not accurate and complete. Additionally, the rules include full-face images and biometric identifiers among the personal identifiers that must be removed before protected health information is no longer considered individually identifiable health information and therefore generally can be disclosed.

Fair Credit Reporting Act. The act, which was enacted in 1970, protects the security and confidentiality of personal information collected or used for eligibility determinations for such products as credit, insurance, or employment. The Fair Credit Reporting Act applies to those meeting the definition of “consumer reporting agency” under the act, which includes the three nationwide consumer reporting agencies (commonly called credit bureaus) and other businesses that collect or disclose information for consumer reports for use by others. The act limits the use and distribution of personal data collected for consumer reports to permissible purposes specified in the act and also gives consumers certain rights to opt out of allowing their personal information to be shared for certain marketing purposes. The act also allows individuals to access and dispute the accuracy of personal data held on them and imposes safeguarding requirements for such data.

Children’s Online Privacy Protection Act. Enacted in 1998, the Children’s Online Privacy Protection Act requires covered website and online service operators to obtain verifiable parental consent before collecting personal information from children under 13, with certain exceptions. Regulations implementing the act define “personal information” to include a photograph or video containing a child’s image, as well as other information such as full name and e-mail address. In its 2013 final rule amending its regulations implementing the act, FTC expressly addressed facial recognition technology in the discussion of its decision to incorporate photographs of a child under 13 into the definition of “personal information,” noting the inherently personal nature of photographs and the possibility of them being paired with facial recognition technology.

Electronic Communications Privacy Act. Enacted in 1986, this act prohibits the interception and disclosure of electronic communications by third parties unless an exception applies, such as one of the parties to the communication having consented to the interception or disclosure. For example, unless an exception applies, such as customers having given their consent, the act would prohibit an Internet service provider from selling the content of its customers’ e-mails and text messages—which could include facial images—to a third party.

Family Educational Rights and Privacy Act. Enacted in 1974, the act generally prohibits federal funds from being made available to any school or institution that has a policy of releasing students’ education records or personally identifiable information contained in such records without the prior written consent of the parent or eligible student, with certain exceptions. The Department of Education’s regulations implementing the Family Educational Rights and Privacy Act include biometric records— including facial characteristics—in the definition of personally identifiable information.

Computer Fraud and Abuse Act. Enacted in 1986, the Computer Fraud and Abuse Act prohibits obtaining information from a protected computer through the intentional access of a computer without authorization or through exceeding authorized access. Some courts have held that using a website for a purpose in violation of the site’s terms of use or terms of service exceeds authorized access and therefore violates the act. Other courts, however, have read the act more narrowly, holding that it prohibits the unauthorized procurement of information rather than its misuse. To the extent that the collection of images online related to facial recognition technology is found to constitute obtaining information from a protected computer through access without authorization or exceeding authorized access, such collection may be a violation of the Computer Fraud and Abuse Act.

Appendix III: GAO Contact and Staff Acknowledgments

GAO Contact

Alicia Puente Cackley, 202-512-8678 or cackleya@gao.gov.

Staff Acknowledgments

In addition to the contact named above, Jason Bromberg (Assistant Director), José R. Peña (Analyst-in-Charge), William R. Chatlos, Jeremy Conley, Richard Hung, Patricia Moye, and Jennifer Schwartz made key contributions to this report.