Facial recognition at airports: boarding, bag drop, borders and the rules that apply

Where face matching is used

Face matching appears at several points in the airport journey. The European Data Protection Board (EDPB) looked at four of them in a May 2024 opinion: security checkpoints, baggage drop, boarding and access to passenger lounges ¹. In these schemes a passenger enrols once, often by matching a selfie or a live photo to the chip in their passport. Cameras then confirm the passenger at each later step ¹.

At the US border, US Customs and Border Protection (CBP) builds a gallery of photos for the travellers expected on each flight. A camera at the gate or the arrival hall takes a live photo and compares it with that smaller gallery, not with a whole government database ⁵. CBP says it uses face comparison for entry at all international airports and for exit at 55 airport locations, and that it has processed more than 540 million travellers this way ⁶. The page gives no date for these figures.

The Transportation Security Administration (TSA) uses a different model at checkpoints. Passengers put their ID in a reader and a camera compares a live image with the photo on the ID ¹³.

Two kinds of matching, and why the difference matters

One-to-one matching, or verification, checks that a person matches one stored photo, such as the photo in their passport. One-to-many matching, or identification, searches for a person among many stored photos ⁸.

The EDPB found that the design matters most. Where the passenger holds their own biometric template on their own device, or holds the only key to an encrypted template stored at the airport, the processing could in principle comply with GDPR if safeguards are in place and no less intrusive option works as well ¹. Where an airport stores templates centrally for one-to-many matching, or an airline stores them in the cloud, the EDPB said the processing cannot meet the necessity and proportionality principles and cannot comply with Article 25 GDPR on data protection by design ¹.

The EDPB added that where consent is the legal basis, use must be voluntary. Passengers must be free to choose another process without detriment ¹.

The rules in the EU: GDPR and the AI Act

The General Data Protection Regulation defines biometric data to include facial images that allow or confirm the unique identification of a person ². Article 9 bans processing biometric data to uniquely identify a person, with exceptions. The first exception is explicit consent for specified purposes ².

The AI Act, Regulation (EU) 2024/1689, treats face systems by purpose. Annex III lists remote biometric identification systems as high risk. It excludes systems whose sole purpose is to confirm that a person is who they claim to be ³. Annex III lists systems used by public authorities in border control to detect, recognise or identify people as high risk, with an exception for the verification of travel documents ³.

Article 5 bans real-time remote biometric identification in publicly accessible spaces for law enforcement, with narrow exceptions such as searching for victims of abduction or preventing a genuine terrorist threat ³. That ban has applied since 2 February 2025 ³. The rules for high-risk systems listed in Annex III were due to apply from 2 August 2026 ³. The Digital Omnibus on AI, in force since 27 July 2026, moved that date to 2 December 2027 ⁴.

The rules in the United States: CBP and TSA

A DHS final rule published on 27 October 2025 and in force from 26 December 2025 lets DHS require all non-citizens to be photographed on entry and exit. It removed earlier exemptions for those under 14 or over 79 ⁵. US citizens may take part voluntarily. They can tell the airline agent or a CBP officer that they want to opt out, and their passport is then checked by hand ⁵.

CBP says photos of US citizens are deleted within 12 hours of confirming identity and citizenship. Photos of other travellers are kept for up to 14 days in a CBP system for identity checks, audits and accuracy tests. Some records sit in the DHS biometric system for up to 75 years ⁵.

In the same rule CBP acknowledged that some US citizens say they were sent to secondary inspection or told they could not board after declining a photo. It said signs and notices had not always been adequate at every location ⁵.

At TSA checkpoints, passengers in field tests could decline the photo but still had to place their ID in the reader ¹³. In November 2024, 12 US senators from both parties asked TSA's inspector general to investigate the programme. They said opting out was confusing and intimidating and that opt-out signs were hard to find ¹².

Regulator rulings in Europe and the UK

Spain's data protection agency (AEPD) fined airport operator Aena 10,043,002 euros in November 2025 under Article 35 GDPR. It found that Aena had deployed face recognition without a valid data protection impact assessment, and it confirmed a suspension of the biometric processing until one is done. Aena said it would appeal, that it had carried out impact assessments and that users gave informed consent ⁹.

Italy's data protection authority, the Garante, ordered a temporary suspension of the FaceBoarding system at Milan Linate in a decision dated 11 September 2025, pending its investigation. Press reports said it found passengers lacked active control over biometric data held by the operator, SEA. SEA confirmed the suspension, said the decision rested mainly on the non-binding EDPB opinion and said it would cooperate ¹⁰.

In the UK, the Information Commissioner's Office (ICO) reviewed Heathrow's plans through its regulatory sandbox and published a report on 23 July 2020. According to a summary by the law firm Slaughter and May, the ICO said consent was likely the most suitable legal basis, judged Heathrow's proposed method of signalling consent largely inadequate, and said Heathrow and airlines would likely be joint controllers ¹¹.

Error rates: what tests and audits found

The US National Institute of Standards and Technology (NIST) tested 189 algorithms from 99 developers in a study published on 19 December 2019. It found demographic differentials in the majority of algorithms. In one-to-one matching, false positives were often 10 to 100 times higher for Asian and African American faces than for white faces, depending on the algorithm. Some algorithms developed in Asian countries showed no such large gap between Asian and white faces. NIST said the most equitable algorithms ranked among the most accurate, and that different algorithms perform differently ⁸.

The US Government Accountability Office (GAO) reported on 2 September 2020 that CBP's air exit system identified over 90 percent of travellers correctly and exceeded its accuracy goals. It missed a goal to photograph 97 percent of travellers. Airlines did not photograph every traveller. GAO found privacy notices were not always complete or posted, and CBP had audited only one airline partner. It made five recommendations ⁷.

In its 2025 rule, CBP said its system must match at least 97 percent of in-scope travellers and falsely accept no more than 0.1 percent. It said internal analysis shows a match rate of at least 98 percent and a false acceptance rate of 0.02 percent. CBP said its own data show no measurable differences in match rates by age, sex or nationality ⁵. CBP does not collect race data and uses citizenship as a stand-in ⁵.