The short definition

Face recognition is a two-stage process. First, face detection finds the face region in the frame. Second, the recognition model extracts a numerical embedding (a vector representation of the face's distinguishing features) and compares it against embeddings stored in an enrolled database. A similarity score above the threshold returns a match; below the threshold returns no-match.

Modern recognition uses deep neural networks trained on millions of face images (DeepFace, ArcFace, FaceNet families). The embedding vector is typically 128 or 512 dimensions; the comparison is a cosine-similarity calculation, fast even at million-identity scale. Accuracy and speed are no longer the limiting factors; legal and ethical constraints are.

1:1 vs 1:N: two operational modes

  • 1:1 verification. Captured face vs one specific enrolled identity. 'Is this person who they claim to be?' Used as a second factor in access control: badge presents an identity, face confirms. Lower computational cost; lower privacy risk because the user has consented to enrollment for that specific access scenario.
  • 1:N identification. Captured face vs entire enrolled database. 'Who is this person?' Used for watchlist alerting (banned customers, denied-access list, former-employee monitoring). Higher computational cost; higher privacy risk because anyone walking into the camera's view is being matched without their consent.

The privacy-law landscape

Face recognition is regulated in many US jurisdictions and across the EU.

  • Illinois BIPA. Written consent before enrollment, public privacy policy, retention schedule. Private right of action. Multi-billion-dollar class actions against Facebook, Google, Clearview, and others.
  • Texas Capture or Use of Biometric Identifier Act. Notice and consent required. Enforced by AG only.
  • Washington Biometric Privacy Act. Notice and consent for commercial use.
  • NYC Tenant Data Privacy Act. Restricts landlord deployment.
  • City bans. San Francisco, Oakland, Berkeley, Boston, Portland (OR), Portland (ME), Cambridge (MA), Northampton (MA), Somerville (MA), Brookline (MA), Pittsburgh (PA), Minneapolis (MN), and others have banned or restricted government and/or commercial face recognition.
  • EU GDPR. Article 9 special-category data. Explicit consent or narrow exceptions. DPIA required under Article 35 for high-risk processing.

Always pair deployment with current legal review. The map of restrictions is changing rapidly, with new state and city laws every legislative cycle.

Where face recognition fits in commercial security

  • 1:1 access control at high-security doors. Data center cages, pharmaceutical clean rooms, casino vaults. User consents to enrollment as a condition of access. Per-door deployment, narrow scope.
  • Small watchlist alerting. Banned-customer list at retail (5 to 50 identities), former-employee watchlist at distribution centers (10 to 100 identities). Justified, documented, time-limited. Not bulk customer surveillance.
  • Forensic investigative search. Post-incident review where a specific suspect's appearance is searched across recorded footage. Used reactively after an event, not proactively against the public.
  • Employee timeclock with consent. Manufacturing and hospitality timeclock systems. BIPA-compliant consent paperwork required in IL, TX, WA, NY.

Where face recognition is not the right tool

  • Bulk customer surveillance. Identifying every customer entering a retail store. Almost universally bad on privacy, legal, and brand grounds.
  • Employee productivity monitoring. Identifying who's at their desk vs not. Generates litigation risk and morale damage.
  • Unattended public-space deployment. Cameras in lobbies or parking lots running 1:N against a database without operator review. False-positive alarm fatigue plus legal risk.

Tec-Tel's stance

Face recognition is a powerful tool used responsibly, and a litigation magnet used carelessly. We deploy 1:1 verification at narrow high-security access scenarios and small, well-justified watchlist installs. We don't build bulk-surveillance face recognition deployments. Free scoping call covers what fits your threat model.