Passenger Data Explained
Menu

Biometric data at borders

Last checked: 21 October 2026 · How passenger data works

Biometric data at borders is fingerprint, facial image or other body-based data that border agencies capture to confirm who a traveller is 2. UN Security Council resolution 2396 (2017) decided that states shall develop systems to collect biometric data to identify terrorists, in compliance with domestic and international human rights law 3. The EU Entry/Exit System records fingerprints and facial images of non-EU short-stay travellers 1. US Customs and Border Protection captures facial photos of travellers and enrols in-scope non-US citizens in a DHS biometric system 4.
UN rule
Resolution 2396 (2017), paragraph 15 3
EU system
Entry/Exit System, fully operational from 10 April 2026 1
EU biometric fields
Fingerprint data and facial image 2
EU retention
Three years, or five years for people who overstay 2
Children in the EU system
Under 12s are exempt from giving fingerprints 2
US citizen photos
Kept no more than 12 hours after identity verification 4

What counts as biometric data

Kenya's Data Protection Act 2019 defines biometric data as personal data resulting from specific technical processing based on physical, physiological or behavioural characterisation 5. The examples in the Act include fingerprinting, DNA analysis and retinal scanning 5.

The EU Entry/Exit System (EES) Regulation uses a narrower definition. It says biometric data means fingerprint data and facial image 2. A facial image is defined as a digital image of the face 2.

Not every law names biometrics. The definition of sensitive personal information in the Philippine Data Privacy Act of 2012 does not mention biometric data 6.

Who collects it and who receives it

Paragraph 15 of resolution 2396 says Member States shall develop and implement systems to collect biometric data to identify terrorists, including foreign terrorist fighters 3. It encourages states to share this data responsibly among relevant Member States, as appropriate 3.

In Europe, the EES registers non-EU nationals travelling for a short stay at the external borders of 29 European countries 1. It records fingerprints, a facial image, name, travel document details, and the dates and places of entry and exit 1. The EU agency eu-LISA is responsible for developing and managing the system 1.

In the United States, CBP enrols in-scope non-US citizen travellers in the DHS Biometric Identity Management System (IDENT) as confirmation of arrival 4.

How the image is captured

Under the EES Regulation, the facial image is taken live when an individual file is created or updated 2. In exceptional cases where live capture cannot meet quality standards, the image may be taken from the chip of the travel document 2. It is added only after electronic checks confirm it matches the person presenting the document 2.

Images must have enough resolution and quality for automated biometric matching 2.

How long biometric records are kept

SystemWhoRetention
EU Entry/Exit System 2Travellers who respected their authorised stay 2Three years 2
EU Entry/Exit System 2People who did not exit within their authorised stay 2Five years 2
EU Entry/Exit System 2Certain family members of EU citizens 2Up to one year after exit 2
US CBP facial biometrics 4US citizens 4No more than 12 hours after identity verification 4
US CBP facial biometrics 4In-scope non-US citizens 4Enrolled in IDENT, no period stated on the CBP page 4

Exemptions and alternatives

  • Children under 12 are exempt from giving fingerprints to the EES 2.
  • People for whom fingerprinting is physically impossible are exempt. If the problem is temporary, it is recorded and fingerprints are taken later 2.
  • US citizens who do not want a facial photo may request alternative processing, which usually means a manual check of travel documents by a CBP officer 4.

When biometric records leak

In September 2020 the DHS Office of Inspector General (OIG) reported on a 2019 incident in a CBP facial recognition pilot at the Anzalduas, Texas port of entry 7. It found that subcontractor Perceptics, LLC transferred copies of traveller images to its own company network, which was hit by a ransomware attack 7. CBP estimated about 100,000 individual images after removing duplicates, and at least 19 were posted to the dark web 7. CBP concurred with all three OIG recommendations 7.

Common questions

Do children give fingerprints at EU borders?

No. Under the EES Regulation, children under the age of 12 are exempt from giving fingerprints 2.

How long does the EU keep border fingerprints?

The EES keeps records for three years for travellers who respected their stay and five years for people who overstayed 2.

Can a US citizen refuse a face photo at the border?

CBP says US citizens may request alternative processing, usually a manual document check by an officer 4.

Does the UN require states to collect biometrics?

Resolution 2396 (2017) decided that states shall develop and implement systems to collect biometric data, in compliance with domestic law and international human rights law 3.

Rules and fees change. Check the official site linked above before you apply or pay. Spotted an error? Email [email protected] with the official link.

Sources

  1. European Commission, Migration and Home Affairs: Entry/Exit System (10 April 2026)
  2. EUR-Lex: Regulation (EU) 2017/2226 establishing an Entry/Exit System (2017)
  3. United Nations: Security Council meeting coverage SC/13138 on resolution 2396 (December 2017)
  4. U.S. Customs and Border Protection: Biometric privacy policy (last modified 19 March 2024)
  5. Kenya Law: Data Protection Act No. 24 of 2019 (assented 8 November 2019)
  6. National Privacy Commission: Republic Act No. 10173, Data Privacy Act of 2012 (15 August 2012)
  7. DHS Office of Inspector General: Review of CBP's Major Cybersecurity Incident during a 2019 Biometric Pilot, OIG-20-71 (21 September 2020)

Related