Is Facial Recognition Legal?

The Short Answer

"Is facial recognition legal?" doesn't have one answer — it has dozens, depending on:

• Where you are. EU rules are stricter than US federal rules.
• Who's scanning. A government doing border control plays by different rules than a retail store doing "loss prevention."
• What they're doing with it. Real-time identification is treated more strictly than face verification (matching you to your own ID).
• Whether you consented. Most laws hinge on whether you gave informed permission.

The pattern almost everywhere: scanning your face is technically legal, but storing it, identifying you, and selling that data without consent is heavily restricted.

What Counts as Biometric Data Legally?

Most modern privacy laws define biometric data the same way:

In practice, that means:

The key word is processing. A photo of you is just a photo. The moment a system extracts your facial geometry into a mathematical template that can be matched against future photos, it becomes biometric data — and the strict laws kick in.

Is Facial Recognition Legal in Finland?

Finland follows EU law. Specifically, GDPR Article 9 classifies biometric data — including faceprints used for identification — as "special category" personal data. Processing it is prohibited by default unless one of a narrow list of exceptions applies, the most common being explicit consent.

On top of GDPR, Finland has:

• The Finnish Data Protection Act (Tietosuojalaki, 1050/2018) — implements GDPR with national specifics
• Tietosuojavaltuutettu (Office of the Data Protection Ombudsman) — the supervisory authority you can complain to if your rights are violated
• The Police Act — restricts how Finnish law enforcement can use facial recognition; live identification in public is heavily restricted

What this means in practice: A Finnish supermarket can't quietly run face recognition on every customer. A school can't use facial attendance without specific legal grounds. An app can't enroll your face in a recognition system without explicit consent — and that consent must be informed, freely given, and revocable.

But that's the law on paper. In reality, your face is likely already in databases run by foreign companies (PimEyes, Clearview AI, Precheck.ai) that scrape the public web. They argue they don't need consent because the data is "publicly available." European regulators disagree and have been issuing fines, but enforcement is slow.

EU and GDPR — The Strictest Framework

The EU's GDPR is the most restrictive major framework for facial recognition. Key points:

Article 9 — Special Category Data

Biometric data used for "uniquely identifying a natural person" is in a special category. Processing is prohibited unless one of these applies:

• You give explicit consent (must be specific, informed, freely given, revocable)
• It's necessary for employment law, social security, or vital interests
• You've already manifestly made it public yourself (this is the loophole face-search engines try to use)
• Substantial public interest with appropriate safeguards

Article 17 — Right to Erasure ("Right to be Forgotten")

You can demand any company delete biometric data they hold on you. They have 30 days to comply (extendable to 60 days for complex cases).

The EU AI Act (2024–2026)

The EU AI Act adds another layer specifically for AI systems:

• Real-time biometric identification in public spaces by law enforcement is banned, with narrow exceptions (terrorism, serious crime suspects)
• Emotion recognition in workplaces and schools is banned
• Untargeted scraping of facial images from the internet or CCTV to build recognition databases is banned (this directly targets Clearview AI's business model)
• High-risk biometric AI systems require registration, transparency, and human oversight

United States — A Patchwork

The US has no federal facial recognition law. Instead, you get a patchwork of state and local rules.

If you're in the US, your protections depend heavily on where you live. See the US country page → for more detail.

Can Companies Scan Your Face Without Consent?

The legally honest answer: it depends what they do with it.

The companies most people worry about — PimEyes, Precheck.ai, Clearview AI, FaceCheck.id — all rely on the legally questionable middle category. They argue scraped public photos are fair game. EU regulators consistently disagree, but enforcement is slow and these services keep operating.

Your Rights Under Modern Privacy Laws

Across most major frameworks (GDPR, CCPA, BIPA, LGPD, PIPEDA, APPI), you have these rights when it comes to facial data:

Country-by-Country Quick Reference

We maintain detailed pages for each major jurisdiction with specific laws, contact info for regulators, and what counts as biometric data locally.

See all countries →

Bottom Line: Legal but Hard to Enforce

The law is mostly on your side. In Finland, the EU, the UK, Canada, Brazil, and many US states, you have real, enforceable rights to demand your facial data be deleted from databases that hold it.

The catch is the practical gap between having a right and exercising it. Filing a GDPR erasure request requires knowing:

• Which companies actually hold your facial data (most are invisible to you)
• The right legal language to make them comply
• Where to escalate when they ignore you
• How to track which databases you've already filed against
• How to re-file when they re-add you (which they often do)

That's the entire reason Face Privacy exists.