A proposal to ban New York City businesses from using facial recognition software to identify customers marks an outlier in the so-far-tepid US policy response to the fast-moving technology.
People’s faces are increasingly becoming an access key, whether to unlock a mobile phone, pass through airport security, or enter an office building. But privacy and civil liberties advocates are worried about over-monitoring and bias in who gets recognized or tracked because few federal, state, or local rules have curbed the technology’s reach.
If enacted, New York City’s ban would be only the nation’s second in effect today, and the first adopted in nearly three years.
While surveillance cameras have become ubiquitous in America and are often easily spotted, facial recognition software that can be linked to those cameras isn’t noticeable. But if you’re an adult in the US, your face is likely in a searchable database already, according to researchers.
“In many cases, you wouldn’t know,” said Katie Kinsey, chief of staff for the Policing Project at New York University’s School of Law.
Kinsey calls the current state of facial recognition a “Wild West” and urges lawmakers to require transparency into its deployment and its effectiveness for public safety.
“If we keep kicking the can down the road, we could end up in a place that feels more dystopian than you might think,” Kinsey said.
Focus on Policing
Twenty of 42 federal agencies that employ law enforcement officers use facial recognition technology, according to the US Government Accountability Office. Bills in Congress that would regulate government use of the tech have failed to gain momentum.
While most states have no restrictions, about a dozen, including Washington, Vermont, and Maine, have imposed limits or are considering limits on facial recognition’s use by government agencies, law enforcement, or schools. These regulations typically require a search warrant for using the technology in investigations or they ban it from police-worn body cameras.
Some state and local-level regulation efforts have focused on policing, and restricting law enforcement’s ability to use the tool for attempting to identify suspects in robberies and other offenses. Mismatches have led to wrongful arrests of men of color in at least a few cases, though the extent of such errors is unknown due to limited transparency into how the technology is used in policing.
A handful of cities and municipalities like San Francisco and Boston block their local governments from using such systems, but the restrictions are not extended to businesses.
The New York City ban would target the private sector, and prohibit stadiums, retail stores, apartment buildings, and other businesses from using facial recognition software to identify their customers or residents. The proposal follows backlash over
Graphic: Jonathan Hurtarte/Bloomberg Law; Photos: Getty Images
A 2016 study by Georgetown University’s Center on Privacy and Technology found that pictures of half of all American adults already were stored in a facial-recognition database that was searchable by police. And artificial intelligence technology—including the use of biometrics like facial recognition—has become even more widespread and sophisticated in the seven years since the study.
Applications of facial recognition may not be obvious, especially if paired with surveillance cameras and the tech’s use isn’t disclosed. Cameras don’t need special equipment for a still image to be run through face-matching software after it’s recorded. Today, even home security cameras can be equipped with technology to recognize the faces of residents, neighbors, or guests.
Pro-privacy groups including Amnesty International and Fight for the Future have organized movements to prohibit the technology.
Baltimore Could Be Next
The New York proposal, if passed, would make the city just the second jurisdiction in the US, after Portland, Ore., to currently limit the technology’s use in the private sector. It’s scheduled to be introduced Thursday.
Baltimore City Council Member Kristerfer Burnett also wants to limit facial recognition use for law enforcement and private businesses in Maryland’s biggest city. His bill would require businesses to delete biometric data three years after collecting it, prohibit them from selling the data, and ban police from conducting face scans at protests.
Burnett plans to introduce the bill on May 1, after a monthslong delay as the Maryland General Assembly debated whether the council had the authority to regulate the city police department.
“I knew either way that the technology itself was an issue, whether we were talking about the government use or private sector use,” Burnett said in an interview with Bloomberg Law. “It became very apparent to me, with more research showing that even the private sector use could lead to a lot of problems.”
Unlike the New York City measure, Burnett’s bill wouldn’t outright ban businesses and residential buildings from using the tech.
The bill also would allow citizens to seek a court-issued injunction against police for violating their rights under the law.
“If we required government to be the sole entity for enforcement, the law would likely go unenforced,” Burnett said.
A Search Engine for Faces
Technology vendors argue that facial recognition can be implemented responsibly, as long as face-matching algorithms are designed to minimize bias and watchlists are populated in an ethical way.
Watchlists may be built on law enforcement databases that include images of known felons or sex offenders, for example. Retail stores could add serial shoplifters to their watchlist, while a casino could include registered gambling addicts or even VIP customers.
“When we roll out technology to customers, we give them a watchlist of zero,” said Dean Nicolls, chief marketing officer at Oosto, which sells real-time facial recognition technology. “Other companies have different philosophies” on compiling databases of faces to search, Nicolls added.
Clearview AI Inc. has drawn scrutiny from privacy advocates and regulators for pulling billions of public images from the internet to build a searchable facial recognition database. The company defends its data collection, likening its approach to a search engine for faces.
Law enforcement is the primary user of Clearview AI’s technology. The company agreed to prohibit most businesses from accessing its facial recognition database as part of a legal settlement with the American Civil Liberties Union over privacy concerns. Clearview AI recently launched another offering meant for public defenders that so far has helped prove the innocence of a Florida man accused of vehicular homicide.
Clearview AI’s CEO Hoan Ton-That said the public defender tool has received “great initial interest,” and it already has some paying customers.
“It can be used by public defenders for quick identifications of potential witnesses, correction of misidentifications, and the identification of exculpatory evidence—all of which can ultimately exonerate those wrongly accused of a crime,” Ton-That said in a statement.
Convenience Factor
As some US airports and airlines give travelers the option to use facial recognition to progress through security and onto their flights, the tech is a popular choice for its convenience, according to
Aside from these identity verification kiosks that compare images from a traveler’s ID card to their face, the Transportation Security Administration also can search video recordings from surveillance cameras inside airports, though there’s no facial recognition applied, according to the agency.
A Credential Authentication Technology identity verification machine is demonstrated at a Transportation Security Administration security checkpoint at the Baltimore-Washington Airport.
Photographer: Ting Shen/Bloomberg via Getty Images
Implementing facial recognition as a convenience factor can create a slippery slope that “normalizes” the privacy risks posed by the technology, said Leila Nashashibi, a campaigner at digital rights advocacy group Fight for the Future.
The group has spearheaded several successful campaigns to ban the technology, including in some retail giants like
“When a city chooses to ban this technology they are taking an enormous step and stand for people’s rights, privacy, and freedom of speech,” Nashashibi said. “This technology as it spreads in public will have an enormous chilling effect on, for example, social movements.”
Facial recognition was used to investigate suspected criminal activity associated with protests following the 2020 death of George Floyd in police custody and in the aftermath of the 2021 US Capitol riot, according to a report from the Government Accountability Office.
Portland’s Ban
The nation’s first outright ban on use of facial recognition was enacted by Portland, Ore., in September 2020, following months of protests nationwide over police brutality and Floyd’s murder. The ban was designed to shield city residents from privacy invasions and protect minority groups from discrimination, Portland Mayor Ted Wheeler said at the time.
It remains the only outright ban in the nation.
Despite some initial protests from tech industry groups, Portland’s ban remains in effect and had little impact on businesses because of how few were using the software in 2020, according to Hector Dominguez-Aguirre, who has led much of Portland’s surveillance policy work as open data and privacy coordinator for Smart City PDX.
The city is now working to implement the broader surveillance technologies policy it passed in February, which requires creating an inventory of surveillance technology the city uses and implementing privacy impact assessments of any new methods into the city’s procurement process.
“The intention of this surveillance policy was to start building public trust on technology by working around the transparency portion of how we use technology, and we are actually adding some due diligence to understand the impacts, the risks, and then taking the steps towards mitigating those at the same time,” Dominguez-Aguirre said.
The surveillance policy could eventually create room for limited uses of facial recognition technology that benefit the public, such as quickly identifying people in the aftermath of an earthquake, Dominguez-Aguirre said.
His team in Portland plans to keep tackling surveillance issues themselves until federal lawmakers develop a comprehensive approach to regulating facial recognition technology, Dominguez-Aguirre said.
