Government and private use of face recognition technology each present a wealth of concerns. Privacy, safety, and amplification of carceral bias are just some of the reasons why we must ban government use.
But what about private use? It also can exacerbate injustice, including its use by police contractors, retail establishments, business improvement districts, and homeowners.
Still, EFF does not support banning private use of the technology. Some users may choose to deploy it to lock their mobile devices or to demonstrate the hazards of the tech in government hands. So instead of a prohibition on private use, we support strict laws to ensure that each of us is empowered to choose if and by whom our faceprints may be collected. This requires mandating informed opt-in consent and data minimization, enforceable through a robust private right of action.
Illinois has had such a law for more than a decade. This approach properly balances the human right to control technology—both to use and develop it, and to be free from other people’s use of it.
The menace of all face recognition technology
Face recognition technology requires us to confront complicated questions in the context of centuries-long racism and oppression within and beyond the criminal system.
Eighteenth-century “lantern laws” requiring Black and indigenous people to carry lanterns to illuminate themselves at night are one of the earliest examples of a useful technology twisted into a force multiplier of oppression. Today, face recognition technology has the power of covert bulk collection of biometric data that was inconceivable less than a generation ago.
Unlike our driver’s licenses, credit card numbers, or even our names, we cannot easily change our faces. So once our biometric data is captured and stored as a face template, it is largely indelible. Furthermore, as a CBP vendor found out when the face images of approximately 184,000 travelers were stolen, databases of biometric information are ripe targets for data thieves.
Face recognition technology chills fundamental freedoms. As early as 2015, the Baltimore police used it to target protesters against police violence. Its threat to essential liberties extends far beyond political rallies. Images captured outside houses of worship, medical facilities, community centers, or our homes can be used to infer our familial, political, religious, and sexual relationships.
Police have unparalleled discretion to use violence and intrude on liberties. From our nation’s inception, essential freedoms have not been equally available to all, and the discretion vested in law enforcement only accentuates these disparities. One need look no further than the Edward Pettus Bridge or the Church Committee. In 2020, as some people took to the streets to protest police violence against Black people, and others came out to protest COVID-19 mask mandates, police enforced their authority in starkly different manners.
Face recognition amplifies these police powers and aggravates these racial disparities.
Each step of the way, the private sector has contributed. Microsoft, Amazon, and IBM are among the many vendors that have built face recognition for police (though in response to popular pressure they have temporarily ceased doing so). Clearview AI continues to process faceprints of billions of people without their consent in order to help police identify suspects. Such companies ignore the human right to make informed choices over the collection and use of biometric data, and join law enforcement in exacerbating long-established inequities.
The fight to end government use of face recognition technology
In the hands of government, face recognition technology is simply too threatening. The legislative solution is clear: ban government use of this technology.
EFF has fought to do so, alongside our members, Electronic Frontier Alliance allies, other national groups like the ACLU, and a broad range of concerned community-based groups. We supported the effort to pass San Francisco’s historic 2018 ordinance. We’ve also advocated before city councils in California (Berkeley and Oakland), Massachusetts (Boston, Brookline, and Somerville), and Oregon (Portland).
Likewise, we helped pass California’s AB 1215. It establishes a three-year moratorium on the use of face recognition technology with body worn police cameras. AB 1215 is the nation’s first state-level face recognition prohibition. We also joined with the ACLU and others in demanding that manufacturers stop selling the technology to law enforcement.
In 2019, we launched our About Face campaign. The campaign supplies model language for an effective ban on government use of face recognition, tools to prepare for meeting with local officials, and a library of existing ordinances. Members of EFF’s organizing team also work with community-based members of the Electronic Frontier Alliance to build local coalitions, deliver public comment at City Council hearings, and build awareness in their respective communities.
The promise of emerging technologies
EFF works to ensure that technology supports freedom, justice, and innovation for all the people of the world. In our experience, when government tries to take technology out of the hands of the public, it is often serving the interests of the strong against the weak. Thus, while it is clear that we must ban government use of face recognition technology, we support a different approach to private use.
As Malkia Cyril wrote in a 2019 piece for McSweeney’s The End of Trust titled “Watching the Black Body”: “Our twenty-first-century digital environment offers Black communities a constant pendulum swing between promise and peril.” High-tech profiling, policing, and punishment exacerbate the violence of America’s race-based caste system. Still, other technologies have facilitated the development of intersectional and Black-led movements for change, including encrypted communication, greater access to video recording, and the ability to circumvent the gatekeepers of traditional media.
Encryption and Tor secure our private communications from snooping by stalkers and foreign nations. Our camera phones help us to document police misconduct against our neighbors. The Internet allows everyone to (in the words of the U.S. Supreme Court) “become a town crier with a voice that resonates farther than it could from any soapbox.” Digital currency holds the promise of greater financial privacy and independence from financial censorship.
EFF has long resisted government efforts to ban or hobble the development of such novel technologies. We stand with police observers against wrongful arrest for recording on-duty officers, with sex workers against laws that stop them from using the Internet to share safety information with peers, and with cryptographers against FBI attempts to weaken encryption. Emerging technologies are for everyone.
Private sector uses of face recognition
There are many menacing ways for private entities to use face recognition. Clearview AI, for example, uses it to help police departments identify and arrest protesters.
It does not follow that all private use of face recognition technology undermines human rights. For example, many people use face recognition to lock their smartphones. While passwords provide stronger protection, without this option some users might not secure their devices at all.
Research and anti-surveillance scholars have made good use of the technology. 2018 saw groundbreaking work from then-MIT researcher Joy Boulamwini and Dr. Timnit Gebru, exposing face recognition’s algorithmic bias. That same year, the ACLU utilized Amazon’s Rekognition system to demonstrate the disparate inefficacy of a technology that disproportionately misidentified congressional representatives of color as individuals in publicly accessible arrest photos. U.S. Sen. Edward Markey (D-MA), one of the lawmakers erroneously matched despite being part of the demographic the technology identifies most accurately, went on to introduce the Facial Recognition and Biometric Technology Moratorium Act of 2020.
These salutary efforts would be illegal in a state or city that banned private use of face recognition. Even a site-specific ban—for example, just in public forums like parks, or public accommodations like cafes—would limit anti-surveillance activism in those sites. For example, it would bar a live demonstration at a rally or lecture of how face recognition works on a volunteer.
Strict limits on private use of face recognition
While EFF does not support a ban on private use of face recognition, we do support strict limits. Specifically, laws should subject private parties to the following rules:
- Do not collect a faceprint from a person without their prior written opt-in consent.
- Likewise, do not disclose a person’s faceprint without their consent.
- Do not retain a faceprint after the purpose of collection is satisfied, or after a fixed period of time, whichever is sooner.
- Do not sell faceprints, period.
- Securely store faceprints to prevent their theft or misuse.
All privacy laws need effective enforcement. Most importantly, a person who discovers that their privacy rights are being violated must have a “private right of action” so they can sue the rule-breaker.
In 2008, Illinois enacted the first law of this kind: the Illinois Biometric Information Privacy Act (BIPA). A new federal bill sponsored by U.S. Senators Jeff Merkley and Bernie Sanders seeks to implement BIPA on a nationwide basis.
We’d like this kind of law to contain two additional limits. First, private entities should be prohibited from collecting, using, or disclosing a person’s faceprint except as necessary to give them something they asked for. This privacy principle is often called “minimization.” Second, if a person refuses to consent to faceprinting, a private entity should be prohibited from retaliating against them by, for example, charging a higher price or making them stand in a longer line. EFF opposes “pay for privacy” schemes that pressure everyone to surrender their privacy rights, and contribute to an income-based society of privacy “haves” and “have nots.” Such laws should also have an exemption for newsworthy information.
EFF has long worked to enact more BIPA-type laws, including in Congress and Montana. We regularly advocate in Illinois to protect BIPA from legislative backsliding. We have filed amicus briefs in a federal appellate court and the Illinois Supreme Court to ensure strong enforcement of BIPA, and in an Illinois trial court against an ill-conceived challenge to the law’s constitutionality.
Illinois’ BIPA enjoys robust enforcement. For example, Facebook agreed to pay its users $650 million to settle a case challenging non-consensual faceprinting under the company’s “tag suggestions” feature. Also, the ACLU recently sued Clearview AI for its non-consensual faceprinting of billions of people. Illinoisans have filed dozens of other BIPA suits.
Government entanglement in private use of face recognition
EFF supports one rule for government use of face surveillance (ban it) and another for private use (strictly limit it). What happens when government use and private use overlap?
Some government agencies purchase faceprints or faceprinting services from private entities. Government should be banned from doing so. Indeed, most bans on government use of face recognition properly include a ban on government obtaining or using information derived from a face surveillance system.
Some government agencies own public forums, like parks and sidewalks, that private entities use for their own expressive activities, like protests and festivals. If community members wish to incorporate consensual demonstrations of facial recognition into their expressive activity, subject to the strict limits above, they should not be deprived of the right to do so in the public square. Thus, when a draft of Boston’s recently enacted ban on government use of face recognition also prohibited issuance of permits to third parties to use the technology, EFF requested and received language limiting this to when third parties are acting on behalf of the city.
Some government agencies own large restricted spaces, like airports, and grant other entities long-term permission to operate there. EFF opposes government use of face recognition in airports. This includes by the airport authority itself; by other government agencies operating inside the airport, including federal, state, and local law enforcement; and by private security contractors. This also includes a ban on government access to information derived from private use of face recognition. On the other hand, EFF does not support a ban on private entities making their own use of face recognition inside airports, subject to the strict limits above. This includes use by travelers and airport retailers. Some anti-surveillance advocates have sought more expansive bans on private use.
Private use of face recognition in places of public accommodation
A growing number of retail stores and other places of public accommodation are deploying face recognition to identify all people entering the establishment. EFF strongly opposes this practice. When used for theft prevention, it has a racially disparate impact: the photo libraries of supposedly “suspicious” people are often based upon unfair encounters between people of color and law enforcement or corporate security. When used to micro-target sales to customers, this practice intrudes on privacy: the photo libraries of consumers, correlated to their supposed preferences, are based on corporate surveillance of online and offline activity.
The best way to solve this problem is with the strict limits above. For example, the requirement of written opt-in consent would bar a store from conducting face recognition on everyone who walks in.
On the other hand, EFF does not support bans on private use of face recognition within public accommodations. The anti-surveillance renter of an assembly hall, or the anti-surveillance owner of a café, might wish to conduct a public demonstration of how face recognition works, to persuade an audience to support legislation that bans government use of face recognition. Thus, while EFF supported the recently enacted ban on government use of face recognition in Portland, Oregon, we did not support that city’s simultaneously enacted ban on private use of face recognition within public accommodations.
U.S. businesses selling face recognition to authoritarian regimes
Corporations based in the United States have a long history of selling key surveillance technology, used to aid in oppression, to authoritarian governments. This has harmed journalists, human rights defenders, ordinary citizens, and democracy advocates. The Chinese tech corporation Huawei reportedly is building face recognition software to notify government authorities when a camera identifies a Uyghur person. There is risk that, without effective accountability measures, U.S. corporations will sell face recognition technology to authoritarian governments.
In collaboration with leading organizations tracking the sale of surveillance technology, we recently filed a brief asking the U.S. Supreme Court to uphold the ability of non-U.S. residents to sue U.S. corporations that aid and abet human rights abuses abroad. The case concerns the Alien Torts Statute, which allows foreign nationals to hold U.S.-based corporations accountable for their complicity in human rights violations.
To prevent such harms before they occur, businesses selling surveillance technologies to governments should implement a “Know Your Customer” framework of affirmative investigation before any sale is executed or service provided. Significant portions of this framework are already required through the Foreign Corrupt Practices Act and export regulations. Given the inherent risks associated with face recognition, U.S. companies should be especially wary of selling this technology to foreign states.
Fight back
EFF will continue to advocate for bans on government use of face recognition, and adoption of legislation that protects each of us from non-consensual collection of our biometric information by private entities. You can join us in this fight by working with others in your area to advocate for stronger protections and signing our About Face petition to end face government use of face recognition technology.
