When you unlock a phone with your face, the phone compares a fresh camera image with the face you enrolled and decides whether they match. That is verification, a one-to-one check: “is this the person they claim to be?” Airports use the same idea at automated passport gates. Identification is one-to-many: a system compares a face against a whole database to answer “who is this?”, which is how police photo searches and some retail watchlists work. Both are computer vision systems that turn a face into a numeric template, a kind of embedding, and compare templates by similarity.
Every system trades off two errors. A false match accepts or names the wrong person; a false non-match fails to recognize the right one. Where the threshold sits decides which error is more common, and the cost of each depends on the use. A failed phone unlock is an annoyance. A false match in a police search can lead to a wrongful arrest. NIST’s 2019 study of 189 algorithms found false positive rates that differed across demographic groups, often by a factor of 10 to more than 100 for some algorithms, though the best algorithms showed much smaller differences. That is a concrete example of AI bias that depends on the specific product, not on face recognition as a whole.
Law treats facial data as sensitive. The EU AI Act bans creating or expanding face databases through untargeted scraping of facial images from the internet or CCTV footage, and limits real-time remote biometric identification in public spaces by police to narrow exceptions. Several US states and cities regulate biometric data or government use of the technology.
Why it matters (editorial synthesis): facial recognition is one of the clearest cases where an AI system’s accuracy statistics translate directly into consequences for individual people. Before buying or deploying it, ask which task it does (verification or identification), what its measured error rates are for the population it will see, who reviews a match before anyone acts on it, and whether the people in the database agreed to be there. Recognizing a specific face is different from image classification or object detection, which can find that a face is present without knowing whose it is.
No Chain of Thought guest has discussed facial recognition in depth yet, so this entry relies on NIST evaluations and the EU AI Act.
Sources
- NIST: Face Recognition Vendor Test (FRVT) Part 3: Demographic Effects (NISTIR 8280) — 2019 NIST evaluation of 189 algorithms that found false positive rates varying by demographic group, often by factors of 10 to over 100 for some algorithms, with large differences between developers; checked October 24, 2026.
- NIST: Face Recognition Technology Evaluation (FRTE) 1:1 Verification — NIST's ongoing public benchmark of one-to-one face verification algorithms, reporting false non-match rates at fixed false match rates across image types; checked October 24, 2026.
- EU AI Act, Article 5: Prohibited AI practices — Bans building face databases by untargeted scraping of images from the internet or CCTV and restricts real-time remote biometric identification in public spaces for law enforcement to narrow listed exceptions; checked October 24, 2026.