Facial recognition gates at airports

How a facial match works

EU law defines an e-gate as an infrastructure operated by electronic means where a border is crossed ⁴. A self-service system performs all or some border checks. An automated border control system combines the two ⁴.

There are two ways to compare a face. In a one-to-one check, the gate reads the passport chip and compares its facial image with a live image of the person ⁴. In the US model, a camera sends a live image over an encrypted connection to the CBP Traveler Verification Service, which compares it with photo templates from the gallery associated with the traveller's manifest ¹.

Under EU rules, a traveller may use a self-service system only if the chip's authenticity is confirmed with the complete valid certificate chain and the chip holds a facial image that can be compared with a live image ⁴.

What is stored and for how long

CBP says US citizen photos are kept no more than 12 hours after identity verification, for continuity of operations only ². In-scope non-US citizens are enrolled in the DHS IDENT biometric system as confirmation of arrival. The CBP page gives no retention period for these records ². CBP states that its facial comparison software does not store biographic data for any traveller ².

In the EU, the Entry/Exit System (EES) records fingerprints and facial images of non-EU short-stay travellers, along with travel document data and the date and place of entry and exit ⁵. The Commission says EES allows wider use of automated border control and self-service systems ⁵.

Who runs the gates

EU law says self-service systems and e-gates shall be operated under the supervision of a border guard, who refers people to a manual check in cases such as doubts about identity ⁴. In the EU, the agency eu-LISA develops and manages the EES ⁵.

In the United States, CBP deployed facial recognition for departing travellers in partnership with airlines ³. The Government Accountability Office (GAO) reported that as of May 2020 this covered 27 airports ³. CBP now lists facial biometrics at all international airports on entry and at 55 airport locations on exit ¹.

Airlines describe their own role in privacy notices. British Airways says that at some airports facial recognition may be used to verify identity, that biometric checks are voluntary except where required by law, and that a manual alternative is available (company statement) ⁹.

Examples by country

Oversight findings

In a report released on 2 September 2020, GAO found that CBP had not consistently given complete information in its privacy notices and that signs were not always posted or visible ³. GAO found CBP had audited only one of its airline partners as of May 2020 ³. The report gives the number of airline partners as more than 20 in one place and 27 in its summary ³.

GAO made five recommendations and DHS concurred with all five ³. GAO lists four as implemented, including a public list of locations, opt-out information on signs and partner privacy assessments ³. It closed the recommendation on photo capture rates as not implemented. CBP said it could not require airlines to photograph every traveller ³.

Opting out

• US citizens may decline a facial photo and ask for a manual document check by a CBP officer ².
• In the UK, children aged 8 to 17 must be with an adult to use an eGate ⁶.
• In the EU, member states may open e-gates to EU, EEA and Swiss citizens, and to some third-country nationals not registered in EES ⁴.