Facial Recognition Search: How It Works and Your Rights

The pipeline in plain language

• Detection: software finds the face in the picture and crops it.
• Alignment: the crop is rotated and scaled so eyes, nose and mouth sit in standard positions.
• Embedding: a model converts the aligned face into a template, typically a few hundred numbers, that describes its geometry and texture.
• Search: the template is compared with millions of stored templates and the closest ones are returned.
• Score and threshold: each result carries a similarity score. The operator picks the cut-off. A score is a distance between two templates, not a verdict about who the person is.

Where the faces come from

An index is only as good as the crawl that built it, and no crawl covers the internet.

• Indexes are built by crawling public pages: social profiles, news sites, forums, company pages and, for some operators, mugshot and people-search sites.
• Private accounts, content behind logins and pages added after the last crawl are absent.
• Photos deleted from the web can remain in an index until the operator refreshes it or honours a removal request.
• Two engines with the same technology return different results because they crawled different sites at different times.

Why results are wrong more often than they look

• Lookalikes: siblings, parents, children, twins and strangers with similar features score highly, especially from a small or blurry crop.
• Image quality: resolution, angle, lighting, glasses, masks, makeup and years between photos all move the score.
• Uneven accuracy: independent benchmark testing has documented error rates that vary across demographic groups, so the same threshold does not mean the same thing for everyone.
• Confirmation bias: when a tool shows you a face and says 92 percent, it is hard not to believe it. Open the source page and check the context before you act.

Your rights and the rules

A face template is a biometric identifier. That single fact drives most of the law.

• Illinois requires informed written consent before a company collects a biometric identifier and lets individuals sue over violations.
• Texas restricts capturing biometric identifiers for a commercial purpose without consent, enforced by the state attorney general.
• Washington treats biometric data as consumer health data with consent and deletion rights, and several other states, including Colorado, have added biometric provisions to their privacy laws.
• The EU and UK classify face templates used to identify a person as special-category personal data, which needs an explicit legal basis to process.
• Platforms prohibit scraping faces in their terms, and using a search to locate, follow or expose a person can fall under harassment, stalking or anti-doxxing laws whatever the biometric statute says.

General information, not legal advice. Laws change; check the current text or ask a lawyer for your situation.

Checking your own exposure without becoming the problem

• Search for your own face only. You can consent for yourself; you cannot for anyone else.
• Prefer tools that state how long they keep your upload and let you delete it. Avoid any that add your face to an index as a condition of searching.
• Start with a reverse image search of the photos most likely to be copied, then search your name and usernames, then check inside the platforms you use.
• Keep a log of every place you appear, with the page address, a screenshot and the date. It is the raw material for reports and removal requests.
• Use platform privacy settings, tag review and the removal routes in the guides below, then re-check on a schedule.