For example, several  photograph management software programs can detect individuals, such  as family members, which the user has asked to be identified. Secure access. Marketing and customer service. The Extent of Commercial Use of Facial Recognition Technology Is Not Fully Known

Facial recognition technology is currently being used in a number of  commercial applications in the United States, but the full extent of its  present use is not known. In particular, concerns have been raised by the technology’s potential to  identify and track individuals in public without their knowledge, and  around the collection, use, and sharing of personal data associated with  the technology. However, some industry stakeholders have argued that  the technology does not present new or unusual privacy risks, or that  such risks can be mitigated. Privacy Concerns Have Been Raised Related to the Ability to Identify and Track Individuals in Public

While acknowledging the potential benefits of commercial use of facial  recognition technology, government agencies, privacy advocacy  organizations, academics, and others have raised a number of privacy  concerns about the technology and its future direction. As noted earlier,  facial recognition technology continues to rapidly improve in accuracy. Some privacy  advocacy organizations and others have reported that, like other  forms of personal data, information that is collected or associated with  facial recognition technology could be used, shared, or sold in ways  that consumers do not understand, anticipate, or consent to. Several Stakeholders Have Suggested Privacy Guidelines, and Company Privacy Policies Vary in Addressing Facial Recognition

Several government, industry, and privacy organizations have proposed  or are developing suggested privacy guidelines for commercial use of  facial recognition technology. Among other things, the standards  state that companies should disclose in privacy policies the data collected by digital signs and the  purpose of the data; obtain affirmative consent before using facial recognition to identify an notify consumers at the physical location of the sign when using facial  recognition (or other means) to collect other information about an  individual, such as age range or gender; not share data for any uses incompatible with those specified in the allow consumers to submit complaints and request to access their  data. Two companies operating social networking applications that use facial  recognition technology expressly address how they use the technology in  their privacy policies and associated documents. Some Federal Laws May Potentially Apply to Facial Recognition Technology, but Do Not Fully Address Stakeholder Privacy Issues

Some federal laws may potentially be applicable to the commercial use of  facial recognition technology, but these laws do not fully address the  privacy concerns that have been raised about facial recognition  technology by some stakeholders. Applicability to collection, use, and storage of  personal information   Governs the disclosure of individually identifiable  health information collected by covered health care  entities, and sets standards for data security. As  previously discussed, no federal law expressly regulates commercial use  of facial recognition technology. In our September 2013 report on personal information collected for  marketing purposes, we suggested that Congress consider strengthening  the consumer privacy framework to reflect the effects of changes in  technology and the marketplace, a suggestion that is underscored by the  privacy issues associated with facial recognition technology. We also found that gaps existed in federal privacy law because  it had not adapted to new technologies. Federal law does not expressly  address the circumstances under which commercial entities can use  facial recognition technology to identify or track individuals, or when  consumer knowledge or consent should be required for the technology’s  use. However, views  vary on the efficacy of voluntary and self-regulatory approaches versus  legislation and regulation to protect privacy. The privacy issues  stakeholders have raised about facial recognition technology and other  biometric technologies serve as yet another example of the need to adapt  federal privacy law to reflect new technologies. Agency Comments

We provided a draft of this report for review and comment to the  Department of Commerce and the Federal Trade Commission. Appendix I: Objectives, Scope, and Methodology

This report examines (1) the uses of facial recognition technology for  consumers and businesses, (2) privacy issues that have been raised in  connection with commercial uses of facial recognition technology, (3)  proposed best privacy practices and industry privacy policies related to  facial recognition technology, and (4) privacy protections under federal  law that may potentially apply to facial recognition technology. The scope  of this report includes use of the technology by companies and other  private entities and does not include use by federal, state, or local  government agencies. Computer Fraud and Abuse Act.
Why GAO Did This Study

Facial recognition technology—which can verify or identify an individual from a facial image—has rapidly improved in performance and now can surpass human performance in some cases. The Department of Commerce has convened stakeholders to review privacy issues related to commercial use of this technology, which GAO was also asked to examine.
This report examines (1) uses of facial recognition technology, (2) privacy issues that have been raised, (3) proposed best practices and industry privacy policies, and (4) potentially applicable privacy protections under federal law. The scope of this report includes use of the technology in commercial settings but not by government agencies. To address these objectives, GAO analyzed laws, regulations, and documents; interviewed federal agencies; and interviewed officials and reviewed privacy policies and proposals of companies, trade groups, and privacy groups. Companies were selected because they were among the largest in industries identified as potential major users of the technology, and privacy groups were selected because they had written on this issue.

What GAO Found

Facial recognition technology can be used in numerous consumer and business applications, but the extent of its current use in commercial settings is not fully known. The technology is commonly used in software that manages personal photographs and in social networking applications to identify friends. In addition, several companies use the technology to provide secure access to computers, phones, and gaming systems in lieu of a password. Facial recognition technology can have applications for customer service and marketing, but at present, use in the United States of the technology for such purposes appears to be largely for detecting characteristics (such as age or gender) to tailor digital advertising, rather than identifying unique individuals. Some security systems serving retailers, banks, and casinos incorporate facial recognition technology, but the extent of such use at present is not fully known.
Privacy advocacy organizations, government agencies, and others have cited several privacy concerns related to the commercial use of facial recognition technology. They say that if its use became widespread, it could give businesses or individuals the ability to identify almost anyone in public without their knowledge or consent and to track people's locations, movements, and companions. They have also raised concerns that information collected or associated with facial recognition technology could be used, shared, or sold in ways that consumers do not understand, anticipate, or consent to. Some stakeholders disagree that the technology presents new or unusual privacy risks, noting, among other things, that individuals should not expect complete anonymity in public and that some loss of privacy is offset by the benefits the technology offers consumers and businesses.
Several government, industry, and privacy organizations have proposed or are developing voluntary privacy guidelines for commercial use of facial recognition technology. Suggested best practices vary, but most call for disclosing the technology's use and obtaining consent before using it to identify someone from anonymous images. The privacy policies of companies GAO reviewed varied in whether and how they addressed facial recognition technology.
No federal privacy law expressly regulates commercial uses of facial recognition technology, and laws do not fully address key privacy issues stakeholders have raised, such as the circumstances under which the technology may be used to identify individuals or track their whereabouts and companions. Laws governing the collection, use, and storage of personal information may potentially apply to the commercial use of facial recognition in specific contexts, such as information collected by health care entities and financial institutions. In addition, the Federal Trade Commission Act has been interpreted to require companies to abide by their stated privacy policies. Stakeholder views vary on the efficacy of voluntary and self-regulatory approaches versus legislation and regulation to protect privacy. GAO has previously concluded that gaps exist in the consumer privacy framework, and the privacy issues that have been raised by facial recognition technology serve as yet another example of the need to adapt federal privacy law to reflect new technologies.

What GAO Recommends

GAO makes no recommendations in this report. However, GAO suggested in GAO-13-663 that Congress consider strengthening the consumer privacy framework to reflect changes in technology and the marketplace, and facial recognition technology is such a change. GAO maintains that the current privacy framework in commercial settings warrants reconsideration.