Airport body scanners: technology, privacy rules and opt-out rights

What a body scanner does

A walk-through metal detector finds metal. It does not find non-metallic explosives. The European Commission says the attempted attack on a Northwest Airlines flight on 25 December 2009, with explosives hidden on a passenger, showed that traditional checkpoint equipment was not fully effective against such threats. It describes security scanners as able to detect both metallic and non-metallic items carried on a person ¹.

TSA describes the same gap. Its 2016 rule says advanced imaging technology (AIT) addresses the inability of metal detectors to find non-metallic explosives and other threat items, and cites the explosive used in the 2009 Christmas Day attempt ⁴. After that attempt the UK government announced more explosive trace detection, more random searches and the introduction of security scanners. Scanners were deployed at Heathrow and Manchester from 1 February 2010 ².

Millimetre wave and backscatter X-ray

Two main technologies have been used at airports. Millimetre wave scanners bounce low-power electromagnetic waves off the body to find anomalies ⁴. The UK Department for Transport says they use a very low power, non-ionising form of electromagnetic energy, and that their emissions are many times lower than a mobile phone's ³. Health Canada found the energy from CATSA's scanners is within Canada's radio frequency exposure guidelines ⁶. In Australia the radiation regulator ARPANSA oversees body scanners and says there are no known safety concerns ⁷.

Backscatter scanners use X-rays ⁵. EU rules ban scanners that use ionising radiation for passenger screening ¹. The UK says all its scanners must use millimetre wave technology ³. Canada says its scanners project low-level radio frequency energy ⁶. Australia says its scanners use non-ionising millimetre wave technology, not X-ray technology ⁸.

Why the US withdrew backscatter scanners

A 2015 National Academies report, written at the request of the Department of Homeland Security, says X-ray backscatter scanners were deployed at US airports in 2008 and removed from all of them by June 2013 over privacy concerns. The removal followed the FAA Modernization and Reform Act of 2012, which required all TSA body scanners to have automatic target recognition so that no screener sees an image of the person. The report says manufacturers failed to implement that for backscatter units ⁵.

The report studied radiation doses from two backscatter systems. It notes that TSA was looking at a second generation of backscatter scanners with privacy software ⁵. TSA's 2016 rule says the AIT it then used was millimetre wave, and that all its AIT units had automatic target recognition since May 2013 ⁴.

Automatic threat recognition

Automatic threat recognition (ATR) software reads the scan instead of showing a body image. The UK code of practice says ATR flags possible concealed items on a standard stick figure, and the officer then searches those areas by hand. Staff must not see images that ATR has not interpreted ³. TSA says its software replaces images of individuals with a generic outline that marks the location of possible threats ⁴. CATSA says its officers see a generic figure with no identifying features ⁶.

The US requirement is in law. The FAA Modernization and Reform Act of 2012 requires all AIT used to screen passengers to have and use ATR software, under 49 U.S.C. 44901(l) ⁴. The UK makes ATR a condition of an airport's privacy policy for scanners ³.

Privacy rules

The EU legal framework on security scanners dates from November 2011 and now sits in Implementing Regulation (EU) 2015/1998. Scanners must not store, retain, copy, print or retrieve images. A human reviewer, where used, must sit in a separate place, cannot see the passenger, and sees an image with the face blurred or hidden. Recording devices are banned from that room. A passenger may ask for a reviewer of the gender of their choice. Passengers must be told about the technology before screening ¹.

The UK requires all data about a person to be destroyed as soon as the scan analysis ends and the person moves away from the scanner. Airports must display a notice that no images are created and no scan data are saved ³. The UK code says passengers must not be chosen for scanning on the basis of personal characteristics such as disability, sex or gender ³. Australia says its body scanner images show no human anatomy, and that the scanners do not collect or store personal information ⁷. Some Australian scanners need the officer to select a gender, often based on the passenger's appearance ⁸.

Opt-out rights by country

Rules differ. The table summarises what each official source says.

Testing and approval

In Europe, security scanners are one of the equipment types tested in the ECAC Common Evaluation Process (CEP) against ECAC and EU performance standards. Since January 2020 the European Commission has treated a CEP result as a precondition for EU approval of security equipment. TSA joined the CEP as an Associated Authority on 9 June 2025. Australia and Canada run their own test programmes and take part in ECAC technical meetings ⁹.

The US rule says TSA had about 793 AIT machines at nearly 157 airports when it was written in 2016 ⁴. The rule followed a 2011 ruling by the US Court of Appeals for the District of Columbia Circuit in EPIC v. DHS, which told TSA to hold notice-and-comment rulemaking on its use of AIT. TSA published a proposal on 26 March 2013 and the final rule took effect on 2 May 2016 ⁴.