News article

Governments around the globe are scrambling to introduce legislation around facial recognition. But experts say current and planned laws simply aren’t keeping up. Across the world, from the EU’s groundbreaking Artificial Intelligence Act to local bans in the U.S., the focus has been on banning or limiting the use of real time biometric facial recognition by law enforcement in the public sector. However, experts in law and tech say this is creating a ‘false sense of security’. The main issue is how widespread this technology is. Facial recognition is now being used everywhere from high definition police cameras on street lights to private security, in shops, on apps and social media. Current laws are struggling to address its expansion in the private sector, many times there are no clear consent forms that are readable by consumers. There can also be issues with enforcement due to the nature of the technology. Biometric data is easy to transfer across borders. Developers can train their AI in areas with low privacy regulations but then apply it to their product worldwide. Many attempts to enforce more transparency such as forcing companies to tell consumers what they have trained their AI on often fail due to companies wanting to protect their trade secrets. With the rise in generative AI and fake biometrics, it has become increasingly difficult to tell what is a genuine image and what isn’t. This means traditional laws often fail to define what biometric identifiers are. By the time a law is debated, written and put into place, the technology will have changed. Whilst banning certain uses could help reduce over use by police in certain cities, experts say this won’t stop the global, commercialised technology. Without global, comprehensive laws around the use of this technology in the private sector along with the algorithm itself, facial recognition will grow at a much faster rate then the laws trying to stop it.

As governments around the world rush to put in place legislation on facial recognition technology, many experts argue that proposed and existing laws are lagging behind the fast-moving technology. In the United States, there have been local bans of facial recognition. In the EU, a sweeping new Artificial Intelligence Act would in effect prohibit real-time use of facial recognition by police. But legal scholars and technologists argue such laws give a false sense of control, and leave big gaps in regulation. A key problem is that facial recognition technology is now found in private security systems, social media, smartphone apps and in retail analytics. Existing laws struggle to pick up this use in the private sector. Often embedded in long, unread terms of service, consent to its use is taken for granted. Biometric data easily crosses borders, allowing developers to train algorithms in regions with lax standards before deploying them globally. And frequently, when laws seek to require transparency of a company's use of facial recognition, they clash with the company's right to protect trade secrets. Even more challenging is fast-moving technology. Increasingly, using generative AI and synthetic biometrics, it has become hard to tell the difference between a real image and one produced by an algorithm. In many legal frameworks, this undercuts the concept of biometric identifiers. And by the time a law is written, debated and passed, the technology underlying it may well have moved on. In some cities, targeted bans of facial recognition in the public sector could well restrain overreach by police. But, say experts, piecemeal regulation of a global, commercial technology will not work. Without international rules covering use of facial recognition in the private sector and its underlying algorithms, the technology will develop much more quickly than the laws seeking to limit it.

The lag between laws and the technology often outpaces them has led to cries for reform. Lawmakers have poured over facial recognition laws, with some countries - like the European Union - introducing proposed laws covering artificial intelligence. Others have focused on how facial recognition can be used by public services, with FMJ and other outlets covering various municipal bans on how law enforcement deploys the technology. But jurists and technologists claim that these measures have given the public a false sense of security over the technology, and that instead, these pieces of legislation have created massive blind spots. The chief issue, they say, is that the legislation right now focuses almost exclusively on public sector deployment - as opposed to the private sector proliferation that these jurists warn is much closer to most people’s day to day lives. These laws, far more extensive than most proposed federal facial recognition or biometric laws in the United States, also are not able to handle the proliferation in private use. Outside of consent forms buried in terms-of-service documents, the majority of these laws avoid any conversation about how private companies like security firms or retailers are allowed to use facial recognition. This is largely because of the difficulty in policing where this data is collected and how it is used, judged or sold. Technological shifts further confuse the landscape. Generative AI and synthetic biometrics make it difficult to tell what’s authentic versus what’s artificial. We already see systems demonstrating this effect, and “biometric identifiers” will be incompletely and inappropriately defined in these legal frameworks. Also, by the time a law is debated, drafted, and enacted, the technology has shifted, making the legislation ineffective. Targeted bans may give specific cities a respite from police overreach, but experts agree that piece-meal regulation cannot corral this global, commercialized technology. Faced with the technological impossibility to contain or limit the underlying algorithmic architectures, only comprehensive international standards addressing both private commercial use and underlying algorithmic architectures have hope of slowing the expansion of facial recognition.

As governments around the world scramble to enact laws regulating facial recognition technology, experts note that existing and proposed regulations fail to keep pace with rapid technological development. From the landmark artificial intelligence legislation of the European Union to local prohibitions throughout the United States, policymakers have concentrated primarily on public sector applications and restrictions on real-time use of biometric surveillance by law enforcement. However, legal scholars and technologists argue that these measures provide a false sense of security and leave enormous gaps in regulatory coverage. The major difficulty reflects the ubiquity of the technology. Facial recognition is no longer limited to high-resolution cameras on street lights, but is integrated into private security systems, commercial applications for retail analytics, smartphones and social media. Current laws are inadequate to regulate this expansion of private-sector applications in which consent is routinely obtained by signing lengthy terms-of-service agreements that are never read. Plus, limitations on jurisdiction severely impair enforcement. Biometric data readily cross national borders to permit development of algorithms based on low standards of privacy protection, followed by global deployment of the finished products. Attempts to require disclosure of training data were frustrated by protection of commercial trade secrets. Finally, rapid changes in technology represent an additional major challenge. Development of systems for generating and manipulating synthetic biometric images has eliminated distinctions between real and artificial images, and rendered most existing definitions of "biometric identifiers" obsolete for purposes of legal regulation. By the time legislation is discussed, drafted and enacted, the underlying technology has generally changed to a degree that renders the legislation ineffective. Restrictions on police activities may temporarily limit abuses of facial recognition technology in certain cities, but overall, piecemeal regulation is incapable of containing a worldwide commercial technology. Absent complete international standards applicable to both commercial applications and underlying methods of algorithmic processing, development of facial recognition technology will continue to proceed at a rate far greater than that of associated legal controls.

Experts say that while governments around the world are rushing to create new laws regulating facial recognition technology, both current and proposed regulations have fallen behind the fast-paced development of the technology itself. From the European Union's pioneering Artificial Intelligence Act, to local government prohibitions on the use of real-time biometric surveillance by police departments throughout the U.S., there has been a significant focus by governments on regulating public-sector deployment of AI technology. Specifically, governments are restricting the ability of law enforcement agencies to use real-time biometric surveillance. On the other hand, many legal scholars and technology experts contend that these restrictions create a false sense of security while leaving large gaps in the regulation of AI technologies. One major barrier is that the technology has become so common. Facial recognition is now used in more places than just high resolution cameras on street lights. Private security systems, retail analysis, smart phone apps, and social media sites use facial recognition as well. Current laws have difficulty dealing with the spread of the technology into the private sector. Consumers are frequently asked to give their consent through long terms-of-service agreements which most consumers sign off on without ever reading. In addition, the ability for companies to develop and deploy biometric software products on a global scale is hindered by the jurisdictional limitations that exist regarding the enforcement of privacy laws. Because biometric data can easily cross national boundaries, it is possible for developers of biometric software products to use training data from countries where there are fewer restrictions on how companies collect, store, and process personal information. Once the developer trains the algorithm using this training data, they may then deploy the product in other countries where there are stricter rules regarding the collection, storage, and processing of personal information. Mandating that companies provide transparency regarding what types of training data they collect and use (e.g., disclosing the source of the training data) are often met with resistance due to company trade secrets. The advent of new technology presents a larger problem than ever before. Generative AI and synthetic biometrics have made it difficult to tell what is real from what is fake when viewing pictures. Therefore, what was previously defined as a "biometric identifier" in most laws is now obsolete. Due to the speed at which technology advances, by the time a law is proposed, created, and implemented, the technology that was used as the basis for the law has likely changed, making the law useless. While some cities have banned the use of facial recognition by their local police departments, experts say these types of bans are only a temporary solution to the larger problem. Piece-meal regulation of this type of technology cannot prevent a globally commercialized technology from being used. Therefore, without a global standard for how to regulate private commercial use of this technology, as well as the underlying algorithms that make it work, the technology will grow at a much faster rate than the regulations intended to control it.

With countries rushing to create laws about facial recognition technology, the prevailing consensus among experts is that current and pending laws simply cannot keep up with the technology. The EU’s recently passed Artificial Intelligence Act, for example, along with bans passed in several American cities, focus on the government’s use of facial recognition. Laws around the world tend to be focused on restricting law enforcement’s access to the technology. Yet facial recognition is not only used by law enforcement; there are plenty of applications that exist outside the realm of policing. Facial recognition software isn’t just used to scan police bodycam footage for suspects anymore, it’s being deployed in video surveillance systems that don’t require law enforcement involvement. Laws have difficulty addressing this problem because people sign away their rights to consent in agreements they don’t read when signing up for a new phone app or software service. Moreover, most laws only work within a country’s own borders, and biometric data can easily cross borders. This means that the software used to train facial recognition models can operate from countries that have less strict data protection laws, or even no laws at all. Some laws attempt to address these issues by forcing companies to disclose how their models were trained, but this often conflicts with intellectual property laws, making it difficult to enforce. Even if laws are able to successfully regulate facial recognition’s current applications, the technology is still growing and changing. Some laws struggle to define what facial recognition actually is. For instance, some laws define biometric data as data based on physical characteristics, which does not account for the ability to generate images using artificial intelligence. Laws might also become outdated quickly, since they need to go through the legislative process before becoming law. By the time they are passed, they might not apply to the technology they were supposed to be regulating. Although many laws might temporarily prevent law enforcement from using facial recognition technology, this is not enough to regulate the technology fully. Facial recognition technology will continue to outpace laws unless governments and organizations around the world work together to establish broad regulations.

As lawmakers around the world scramble to legislate facial recognition technology, analysts suggest that current and proposed legislation are unable to match the rapid pace of the technology. From Europe's groundbreaking Artificial Intelligence Act to city bans throughout the United States, legislators have concentrated on the public sector, including prohibitions and limitations of the use of the technology by law enforcement for real-time biometric surveillance. However, according to legal experts and technologists, these efforts create a false sense of security while leaving large holes in regulation. One of the major challenges is the widespread use of the technology. Face recognition is not just a matter of high-resolution cameras in police stations attached to the streetlight any longer. It is a part of private security systems, retail analytics, smartphone applications, and social media platforms. Current regulations do not apply to this broad spectrum of private sector use, where consent forms are often included in long terms-of-service agreements that people just sign without reading. Jurisdictional limitations further weaken regulation of the issue. Biometric data can easily be transferred from one country to another, which means that developers can train their algorithms in countries that do not have strong privacy laws in place and then use the software globally. The attempts to force the company to make data used for training public run into trade secret laws. The technological change presents a different challenge to legislation. With the emergence of generative AI and synthetic biometrics, it is increasingly difficult to define what "biometric identifier" is in the context of some laws, which become outdated as soon as they are debated, discussed, and enacted. While the targeted ban may help in restraining police in certain cities, experts say that piecemeal regulation will not be able to stop a global technology

As governments rush to write laws related to facial recognition technology, experts are pointing out that laws on the books, and those being written, cannot keep up with the pace of this rapidly emerging technology. Policymakers have fixated on government use - banning or restricting law enforcement's use of real-time biometric surveillance, for example - from the European Union's groundbreaking Artificial Intelligence Act to citywide bans throughout the United States. But legal experts and technologists say these efforts, while well-intentioned, are mostly illusions that leave giant regulatory gaps. The fundamental challenge: the widespread infiltration of the technology. No longer limited to high-resolution police surveillance cameras atop streetlights, facial recognition has pervaded security, retail applications, smartphones, and social media, and current laws haven't caught up with that private-sector spread, where declarations of consent lurk deep in often-unread terms-of-service contracts. Additionally, jurisdictional restrictions pose a significant obstacle to enforcement. Because biometric data can be transmitted across jurisdictions, designers can train their algorithms in states with weak privacy laws and then deploy the software elsewhere. Efforts to force companies to reveal the training data for their models - a very simple form of transparency - are often thwarted by companies citing trade-secret protections. But technological change is even more difficult. Generative AI and synthetic biometrics have eroded the line between real and fake images, making the notion of "biometric identifiers" a legal anachronism in many jurisdictions. By the time a law is being considered and written, the technology it is based on may already be outdated. By themselves, targeted bans in some cities may rein in police conduct, but it won't stop a product that's now licensed and used around the world. Without international standards for private commercial use and the algorithms underlying such systems, facial recognition is unlikely to be reined in by legislation anytime soon.

Governments around the world are trying to make laws for facial recognition technology. But experts are saying that the rules they are coming up with aren't keeping up with how fast the technology is changing. The European Union has its big AI Act, and some cities in the U.S. have banned it. Mostly, these rules focus on how the government, like the police, can use this technology for watching people in real-time. But some legal experts and tech people think these rules give us a false sense of safety because they miss many important areas. The main problem is that this technology is everywhere now. Facial recognition isn't just on police cameras on streetlights anymore. It's in private security systems, stores use it to track shoppers, and it's in phone apps and social media. Current laws have a hard time dealing with this in the private sector. Often, you have to agree to it in long terms-of-service agreements that people just click through without reading. Also, laws don't work well when data crosses borders. Companies can build their facial recognition software in places with weak privacy rules and then sell it everywhere. When people try to make companies be more open about how they train these systems, they often can't because of trade secret laws. Things are even harder because of new technology. Generative AI and fake biometrics make it tough to tell if an image is real or artificial. This makes old definitions of "biometric identifiers" useless in many laws. By the time a law is even made, the technology has often changed, making the law ineffective. Banning police use in some places might help for a short time. But experts say that just having a few separate rules won't stop a technology that is used globally for business. We need international rules that cover both private use and how the technology itself is built. If we don't, facial recognition will keep growing much faster than the laws trying to control it.

Governments around the world are quickly creating laws to control the use of facial recognition technology, but experts are concerned that these laws are not being updated fast enough to keep up with the technology's rapid growth. This means that the rules in place may not be effective in addressing the issues that come with this technology. Policymakers have been paying a lot of attention to how artificial intelligence is used in the public sector, especially when it comes to law enforcement using real-time biometric surveillance. For example, the European Union has passed a big law about artificial intelligence, and some cities in the United States have banned certain uses of it. But some experts think these rules are not enough and might even make people feel safer than they really are. They say there are still big gaps in the rules that need to be fixed. These experts, who are lawyers and technologists, believe that the current measures do not go far enough to address the issues with biometric surveillance. The big problem is that facial recognition technology is everywhere. It's not just used in high-quality cameras on the streets, but also in security systems for private companies, stores that want to know more about their customers, apps on our phones, and social media sites. The laws we have now are having a hard time dealing with how common this technology is in the private sector. A lot of times, when we sign up for something online, we just click "agree" without reading the long terms of service, which can include consent for facial recognition. This makes it tough to know what's happening with our personal info. The rules that govern how personal information is used are often not strong enough. This is a problem because biometric data, like facial recognition, can be shared easily across the world. As a result, companies can develop their technology in places with weak privacy laws and then use it everywhere. When governments try to make companies be more open about how they use this data, they often hit a roadblock. Companies don't want to share their secrets, so they use trade-secret laws to avoid being transparent about what they're doing. Technological shifts present an even greater challenge. The rise of generative AI and synthetic biometrics has blurred the line between authentic and artificial images, rendering traditional definitions of "biometric identifiers" obsolete in many legal frameworks. By the time a law is debated, drafted, and enacted, the underlying technology has often shifted, rendering the legislation ineffective. Experts say that banning facial recognition in a few cities might help stop police from misusing it, but this won't solve the bigger problem. Since facial recognition is a global technology that's being used more and more for business, we need international rules that cover everything, including how companies use it and the technology behind it. Without these rules, facial recognition will keep spreading faster than the laws that try to control it. This is because the technology is not just limited to one place, it's being used all over the world, and companies are making a lot of money from it. So, we need to have a comprehensive approach to regulate it, otherwise, it will be hard to keep up with its rapid growth.