Facial recognition in policing

Lesson 1 of 5 in Biometric Surveillance, Law Enforcement AI, and Protecting Children.

On a January afternoon in 2020, Detroit police arrested Robert Williams on his front lawn, in front of his wife and two daughters, for a watch-store theft he did not commit. The evidence: a grainy surveillance still run through a facial recognition system, which returned his expired driver’s-licence photo as a candidate match. A detective put that photo in a six-pack lineup; a security contractor who had never seen the thief in person picked it. Williams spent thirty hours in custody. He is the first publicly documented wrongful arrest driven by facial recognition — and every documented case since (Porcha Woodruff, eight months pregnant, arrested for carjacking; Nijeer Parks in New Jersey; more in Detroit, New Orleans, Texas) shares two features: the technology erred, and the humans around it treated a candidate match as an identification.

Understand the mechanics and the failure pattern becomes predictable. A face recognition search takes a probe image, computes a numeric faceprint, and ranks a gallery (mugshots, licence photos, scraped web images) by similarity. The output is a ranked list of candidates, each above some adjustable threshold — never a verified identity. NIST’s FRVT testing shows the best algorithms are extraordinarily accurate on clean photos, and dramatically less so on the low-quality probes real investigations use — with error rates that differ by demographic group, the pattern the Gender Shades study first made public.

Key terms: facial recognition, remote biometric identification, biometric data, false positive, automation bias

Regulatory responses split into three families. US cities went first with outright bans on government use — San Francisco in May 2019, then Boston, Oakland, and roughly two dozen others; Portland, Oregon went furthest, banning private use in places of public accommodation. Some jurisdictions later reversed or softened (Virginia banned in 2021, re-authorised with safeguards in 2022; New Orleans reinstated use in 2022), so treat any list of bans as a snapshot.

States legislate procedure rather than prohibition: Washington’s 2020 law requires warrants for ongoing surveillance; Maryland and others now require training, disclosure to defendants, and bar FRT matches as the sole basis for arrest — the exact rule Detroit adopted in the Williams settlement.

The EU chose a third path: risk-tier the practice, not the technology. That is the subject of the next section — and the reason your prerequisite module matters here.

The EU AI Act slices police facial recognition along two axes: real-time versus retrospective, and publicly accessible spaces versus everywhere else. You met the full Article 5 text in the prohibited-practices module; here is the operational logic.

Real-time remote biometric identification (RBI) in publicly accessible spaces for law enforcement is prohibited — Article 5(1)(h) — subject to three narrow exceptions: targeted searches for victims of abduction, trafficking, or sexual exploitation and for missing persons; prevention of a specific, substantial, and imminent threat to life or a genuine, foreseeable terrorist threat; and locating suspects of listed serious offences punishable by at least four years. Even inside an exception, use requires prior authorisation by a judicial or independent administrative authority, a fundamental-rights impact assessment, registration, and a national law that opts the member state in.

Retrospective (post) RBI is not prohibited — it is high-risk under Annex III, with an extra deployer safeguard: Article 26(10) requires judicial or administrative authorisation, sought within 48 hours where the search is not tied to a specific ongoing investigation. The lesson for practitioners: in the EU the question is never “is facial recognition legal?” but “which practice, in which space, in which time-mode, under whose authorisation?”

Interactive checkpoint quiz (2 questions) — open this page in a browser to take it.