Facial recognition is technology that identifies or verifies a person from an image of their face. It converts facial features into a numeric template, a face embedding, and compares it with stored templates. It is among the most capable and most regulated areas of computer vision, because it processes biometric data that identifies individuals.
Key takeaways
- Verification is one-to-one: does this face match this claimed identity?
- Identification is one-to-many: who is this, among many enrolled people?
- Faces become embeddings; matching compares distances between them.
- Accuracy varies with image conditions and, in many systems, across demographic groups.
- Regulation is strict and growing, particularly for public-space use.
Facial recognition explained in simple terms
A human recognises a friend by combining many features without listing them. A face recognition system does something similar mathematically: it turns a face into a list of numbers where similar faces sit close together, then checks which stored face is closest.
How it works
- Detection: find faces in the image (object detection).
- Alignment: rotate and crop so eyes and mouth sit in standard positions.
- Embedding: a neural network converts the aligned face into a vector, often 128 to 512 numbers.
- Matching: compare the vector with stored templates using distance or cosine similarity.
- Decision: if similarity passes a threshold, declare a match.
The threshold sets the trade-off between false accepts, where a stranger is admitted, and false rejects, where a legitimate person is denied.
Verification vs identification
| Aspect | Verification (1:1) | Identification (1:N) |
|---|---|---|
| Question | Is this the account holder? | Who is this person? |
| Example | Phone unlock, KYC onboarding | Watchlist search in a crowd |
| Consent | Usually explicit | Often absent |
| Risk | Lower | Much higher |
| Regulation | Generally permitted with consent | Heavily restricted in many places |
The distinction matters legally as much as technically: unlocking your own phone is very different from scanning a crowd against a database.
Accuracy in practice
Under good conditions, leading systems are highly accurate. Accuracy falls with poor lighting, extreme angles, low resolution, ageing, masks and motion blur. Independent testing, notably the US National Institute of Standards and Technology’s face recognition evaluations, has found wide variation between vendors and, in many systems, different error rates across demographic groups. Those differences have contributed to documented cases of wrongful identification, which is why one-to-many use in law enforcement is so contested.
Regulation
- The EU AI Act prohibits or tightly restricts real-time remote biometric identification in public spaces for law enforcement, with narrow exceptions, and treats many biometric uses as high-risk.
- Biometric privacy laws, such as Illinois’ BIPA in the US, require consent and have produced substantial penalties.
- Data protection law, including the GDPR, treats biometric data used for identification as a special category requiring a strong legal basis.
- Several cities and states restrict or ban public-sector use.
Organisations deploying facial recognition should confirm their legal basis, obtain consent where required, minimise retention and document their assessment.
Responsible deployment
- Prefer verification over identification wherever possible.
- Test accuracy across demographic groups on your own data.
- Store templates, not raw images, with encryption.
- Add liveness detection to resist photo and video spoofing.
- Keep human review for consequential decisions.
- Provide an alternative for people who decline.
Limitations
- Accuracy varies by conditions and group.
- Vulnerable to spoofing without liveness checks.
- Biometric templates cannot be reissued if breached.
- Legal exposure is significant and jurisdiction-dependent.