Facial recognition mistakes
Facial recognition software can wrongly treat photos of two different people as showing the same person. In a search of a database, such a false positive puts an incorrect match on a list of candidates for further scrutiny (NIST).
What official findings and settlements show
- The US Federal Trade Commission said that the facial recognition system used by the pharmacy chain Rite Aid generated thousands of false-positive matches, and that employees acting on false alerts followed customers around its stores, searched them, ordered them to leave or called the police (FTC).
- The FTC also said that Rite Aid's actions disproportionately impacted people of color. To settle the FTC's charges, Rite Aid will be prohibited from using facial recognition technology for surveillance purposes for five years (FTC).
- A study by the US National Institute of Standards and Technology found demographic differentials in the majority of the face recognition algorithms it studied: an algorithm's ability to match two images of the same person varies from one demographic group to another (NIST).
- In the UK, the government says that after a possible live facial recognition alert, a police officer on the ground decides what action, if any, to take, and must form reasonable grounds before an arrest (UK government factsheet).
- When police search images after an incident, a specially trained operator visually assesses any possible match, and a confirmed match is passed to an investigating officer who reviews it for accuracy and considers all the available evidence (UK government factsheet).
What you can do
- In the UK, ask for your data. You have the right to ask an organisation whether it is using or storing your personal information, and to ask for copies of it. This is called a subject access request, and organisations usually have one month to respond (ICO).
- Know the rules. The UK Information Commissioner's Office says facial recognition is covered by data protection law, which requires any use of personal data, including biometric data, to be lawful, fair and proportionate (ICO).
- Raise a concern, then complain. In most cases the ICO recommends raising your concern with the organisation first; if you are unhappy with its response, you can then complain to the ICO (ICO).
- In the United States, you can report fraud, scams and bad business practices to the FTC at ReportFraud.ftc.gov (FTC).
Sources
- Rite Aid Banned from Using AI Facial Recognition After FTC Says Retailer Deployed Technology without Reasonable Safeguards, US Federal Trade Commission, 19 December 2023.
- NIST Study Evaluates Effects of Race, Age, Sex on Face Recognition Software, US National Institute of Standards and Technology, 19 December 2019.
- Police use of facial recognition: factsheet, GOV.UK, published 4 December 2025.
- ICO clarifies how data protection law applies to facial recognition technology, UK Information Commissioner's Office, 13 August 2025.
- Getting copies of your information (SAR), UK Information Commissioner's Office.
- Check if you can complain, UK Information Commissioner's Office.