Tag: biometrics

Apple Supports Digital ID Push With Facial Age Estimation

Apple is increasing its support of the digital ID age verification agenda and has released iOS 27.2, bringing a new way for Apple to verify your age: by scanning your face with an “age-estimation model” that will be fed by a selfie.

This is one of the ways in which Apple will check the age of its users, and it applies, as the company’s support page states, “Where required by law.”

The legal requirements that make this necessary in the US apply in Texas, and elsewhere in the world in Australia, Brazil, Singapore, South Korea, and the UK. The iOS update that introduces the new method of age verification was released on October 26.

Apple will ask for age verification when you create an Apple Account, “update the software on your device, try to change certain safety settings, or try to download or purchase apps with an age rating of 18+.”

In Australia, Brazil, Singapore, and the UK, the selfie option is available, while in other places, Apple will ask for a credit card, a scan of an ID, or look at information associated with an Apple Account.

Apple’s explains that the selfie option works by letting the user “Capture all four angles of your face by moving your head slowly right, left, up, and down.” To increase the likelihood of the scan being successful, the company advises users to “Remove anything that might cover your face, such as masks, hats, or sunglasses” and to “Make sure only your face is in the frame.”

The models that will be used to estimate age from these selfies will run “both on-device and on Private Cloud Compute,” Apple says, referring to a service it provides that “extends the security and privacy of your Apple device into the cloud.” The results will then be “combined on your device.”

Apple promises that the selfie “isn’t accessible to anyone, not even Apple,” and that “Once your age is confirmed, your selfie is deleted and isn’t retained in any form.”

Apple has not revealed the accuracy of the age-estimation model, what happens when it misidentifies an adult as a minor, or what record of the result is kept by the company. Those who are not verified as at least 18 by the model are advised to either try another selfie or use another method.

The other methods Apple will use to determine age are: looking at information associated with the user’s account, such as whether they have a credit card on file or how long they have had their Apple Account; and scanning an ID. The image of the ID is “kept for a short period of time to complete this process, after which it’s deleted,” Apple says, and adds that “Debit cards and gift cards aren’t supported.”

Keep reading

Report Finds “Significant Weakness” in the TSA’s Handling of Biometric Data

A recent Department of Homeland Security (DHS) Inspector General audit found that the TSA has been mishandling sensitive biometric data collected at airports.

An unclassified summary of the report explains the Office of the Inspector General (OIG) audit, which was intended “to determine the extent to which the Transportation Security Administration’s (TSA) facial recognition and identification technologies enhance security screening to identify persons of interest and authenticate flight traveler information while protecting passenger privacy.”

“Significant weakness”

To the TSA’s credit, the audit determined that TSA personnel delete photos of passengers moving through airport checkpoints in a timely fashion and in accordance with federal regulations. However, the audit also identified a “significant weakness” in their operations. The issue concerns Credential Authentication Technology (CAT-2), which the TSA uses in its biometric facial recognition system. That system is apparently insecure. According to the OIG, CAT-2 allows the TSA contractor providing it to access passenger data, including driver’s licenses and passport photos. This sensitive information was available to the contractor during “system troubleshooting and enhancements” without the TSA’s knowledge. According to the audit summary:

“TSA lacked clear policies, did not track when this data was extracted, could not verify that extracted information was properly deleted, and did not notify passengers when their biometric and biographic information may have been stored. As a result, although passenger information was generally protected during routine operations, weaknesses in vendor oversight created a risk that sensitive personal information could be retained or exposed.”

The vendors in question appear to be two firms: Idemia Identity and Security USA, LLC. According to a 2023 TSA announcement, the agency awarded $128 million to these two contractors to develop the CAT-2 system. In that release, the TSA touted CAT-2, noting that this second-generation technology would “allow for automated identity verification with an integrated camera for biometric and self-service capabilities.” The agency noted the system’s scale, adding that their “new contract with Idemia [would] enable TSA to test, manufacture, procure and deploy over 1,500 new CAT-2 systems to airport security checkpoints nationwide.”

This is the system the OIG audit singled out for compromising passenger privacy. While Security USA LLC has a limited paper trail online, Idemia has a well-documented and problematic record (Idemia Identity is one wing of the Idemia corporation).

Keep reading

Homeland Advanced Recognition Technology: The Largest US Biometric Database You’ve Never Heard Of

After being troubled by delays and budget concerns for nearly a decade, the Homeland Advanced Recognition Technology (HART) program will become the US government’s largest biometric database when it launches in September. The program has also been plagued by privacy concerns raised by the Government Accountability Office (GAO), which has warned that HART has “gaps” in its privacy policies.

HART will be managed by the Department of Homeland Security (DHS) and will store and process biometric data such as digital fingerprints, iris scans, and faceprints that have been gathered by DHS and its various sub-agencies. According to DHS, government agencies may seek to access this data for national security reasons, law enforcement, immigration and border management, intelligence gathering, background investigations for national security positions, and certain positions of public trust.

While HART is set to complete “initial operating capability” in September 2026, the system is not scheduled to be fully completed until 2027. The system was originally announced in 2015 as a replacement for the legacy Automated Biometric Identification System (IDENT), which was originally developed in 1994 as a law enforcement system for collecting and processing biometric data from individuals apprehended by border security or immigration officials. In 2013, the DHS’ Office of Biometric Identity Management (OBIM) began plans to replace IDENT with HART. HART was set to become operational in December 2018 but was delayed numerous times due to budget concerns.

Since the initial announcement regarding the transition from IDENT to HART, the GAO and digital rights groups have raised concerns about the government upgrading and centralizing its repository of sensitive personal information of millions of Americas.

In February 2020, DHS published its original HART Privacy Impact Assessment to “assess and mitigate any potential privacy risks.” While the system wasn’t yet active, DHS said they “anticipated potential privacy risks associated with the privacy sensitive system” and “sought to proactively develop appropriate privacy safeguards to be implemented” throughout HART’s development.

In September 2023, the GAO released their own report detailing what it saw as “gaps” in privacy policies required by the Office of Management and Budget. The GAO said DHS implemented only five of twelve privacy requirements. GAO noted that the 2020 privacy impact assessment was “missing key information,” including on whose data will be stored in the system and the partners with whom the system will share the data.

The GAO report also said the HART program did not have “assurances that partners that provide information to the system will appropriately retain and dispose of personally identifiable information.” GAO concluded by stating that until DHS addressed these “privacy weaknesses,” there is no assurance that the personal data gathered on hundreds of millions of individuals will be “appropriately protected.”

In August 2024, DHS released an updated Privacy Impact Assessment for HART in an attempt to “clarify and address points raised by external oversight bodies.” The assessment provided answers to some of the questions posed by the 2023 GAO report, namely whose information will be stored and with whom it will be shared.

“HART will contain personally identifiable information, including biometric data and associated biographic information, on U.S. citizens, lawful permanent residents, and foreign nationals,” the assessment stated.

The report says biometric data held in HART may be shared with every agency of the DHS, including Customs and Border Protection (CBP), U.S. Immigration and Customs Enforcement (ICE), U.S. Secret Service (USSS), and the Transportation Security Administration (TSA), as well as other federal agencies such as the State Department, the Department of Justice (DOJ), and the Department of Defense (DOD). It also states that biometric data may be shared with “elements of the Intelligence Community (IC).”

Keep reading

Police Launch Live Facial Recognition Trial at London Subway Stations

It was a busy week for the cameras. Nobody, we were assured, would have their face read without the option of going somewhere else instead.

That was the promise at Victoria Underground on Tuesday, where British Transport Police switched on live facial recognition and, with the manners of a good host, laid on “alternative routes” and clear signage so that everyone could make “informed choices about passing through.”

The choice on offer being to let a police computer check your face against a watchlist, or to find some other way into the station, on a Tuesday, at the start of a trial booked to run four months.

The scale is where courtesy starts to sing. TfL’s own draft annual report logs over 1.2 billion passenger journeys in the year, around 3.3 million a day, and since most of those are the same tired people going to work and trudging home again, the honest figure for faces passing a lens on any given day is merely hundreds of thousands, possibly the far side of a million. Each of them, presumably, informed.

The weekend before, Greater Manchester Police had taken the same idea to the Manchester Caribbean Carnival, a party going strong since 1971, where the Manchester Evening News reckoned 60,000 people would turn out across two days of parade, soca and steelpan. The force said the cameras produced 34 alerts and 11 arrests, and that a missing child was found, which is the part no one with a heart wants to be sour about.

Then, emboldened, GMP put out a press release on Tuesday to tell us all how splendidly it is going. 641,000 faces were scanned across 56 deployments. 208 alerts. That’s to say that 99.97 percent of everyone the force has ever photographed at one of these things set off precisely nothing, roughly one ping for every 3,082 law-abiding citizens run through the machine.

Was anyone asked? No, but signage was provided.

Keep reading

Google’s New Recovery Option Stores a Clip of Your Face

Google’s newest account-recovery option asks for something no password ever required: a moving image of the account holder’s face, kept on the company’s servers.

Selfie video sign-in, launched July 23, records a short clip of the user turning their head on cue. When someone is locked out, Google matches a fresh clip against the stored one to decide whether to let them in.

The head movements are the security pitch.

They let Google’s systems tell a live face from a photograph or a prerecorded loop, the same trick it uses to turn away deepfakes.

Those checks all serve the accuracy of the match.

They say nothing about how much of the face Google stores, or for how long.

The company’s assurance covers only the storage. In its words, the video is “encrypted at rest, meaning it’s securely stored even when it’s not being used.”

Encryption at rest is a claim about how the file is stored. It says nothing about who can open it.

Its systems have to read the enrolled video to check any new face against it, so Google can decrypt the footage on demand. Encryption that only the account holder could open would rule that out, and Google has not claimed it.

Passkeys, hardware keys, and authenticator apps already restore a locked account with no biometric anywhere in the process.

Google added the face scan on top of them.

By default, the company says the clip stays with verification and recovery. A separate setting asks the user to release the same data toward developing Google’s products.

The feature is opt-in and reversible. Eligible accounts around the world can switch it on, and account holders can delete the stored clip at any time.

The company has not said how long it keeps that clip while the feature runs, or where the footage is handled.

Keep reading

Facebook Verified: Meta Now Wants a Video Selfie of Your Face

Meta is rolling out a badge on Facebook that requires users to record a video of their own face.

The feature, massively accelerating the normalization of face scanning and biometric data collection, is called Facebook Verified, and asks a user to record a short video selfie, which the company checks against the photos already on their profile to confirm a match.

The process is free and takes a few minutes.

The company, which has been aggressively lobbying for “age verification” digital ID laws, presents the badge as a way to confirm a real person is behind an account. “As AI makes it easier to generate content, profiles, and messages,” it said, it wants users “to know there is a real person on the other side of a profile.”

The badge is open to Facebook users who are 18 or older and in good standing with Meta’s Community Standards on fraud, scams, and deceptive practices, and who show “no evidence of inauthentic behavior.” It is not available for Pages or ProMode accounts, which limits it to personal profiles.

Once a user completes the one-time check, the badge appears on Marketplace, Dating, Groups, and Profile. Meta said it plans to extend it to Feed posts over time.

Facebook Verified is separate from Meta Verified, the company’s paid subscription, which bundles a badge with impersonation protection and account support. Facebook Verified charges no fee.

Meta has not said how long it keeps the selfie video, where it stores it, or when it deletes it.

The launch materials describe the match and say nothing about the video afterward.

The scan arrives the same month Google added a selfie-video sign-in that records a user’s face to recover a locked account. Age-check laws in several US states and in Britain already require a face or an ID scan to open some accounts.

Meta is now asking hundreds of millions of Facebook users for a face scan too.

Facebook Verified is rolling out in phases, starting in select markets, and Meta plans to expand it worldwide.

Keep reading

California Grocery Stores Use Facial Recognition Technology To Combat Theft

Faced with a shoplifting epidemic that has battered California retailers for years, Grocery Outlet is fighting back with technology.

Customers are not thrilled about it.

The Emeryville-based discount grocery chain has begun installing facial recognition software called SAFR at a handful of Bay Area stores, including its Pleasant Hill “Bargain Market” location, CBS News San Francisco reported.

Customers walking through the doors will find signs warning them the system is in use, a disclosure the company says is meant to keep shoppers informed.

The rollout comes as California tries to combat a shoplifting problem that has spiraled out of control.

FBI data cited by CBS shows theft in the state has jumped 50 percent since the COVID-19 pandemic, a surge that has forced retailers from big-box chains to neighborhood grocers to spend millions on security measures, or in some cases, shutter stores altogether.

For June Guerrero, who spent years managing a retail store, the new technology is a welcome and overdue response to a problem she saw firsthand.

“I worked for years as a manager of a store and the theft was just unbelievable,” Guerrero told CBS News. “I agree with it.”

Not every customer sees it that way. Barbara Jackson told the outlet she’s uneasy about having her face scanned every time she shops for groceries.

“I do understand, but invading my privacy with my picture, I don’t agree on that,” Jackson said. “You gotta find a better way.”

Shopper Steve Burdette raised a different concern: the risk of the system misidentifying innocent customers as thieves.

“It could lead to a lot of problems, I think for companies and businesses and people,” he said.

SAFR president Charisse Jacques pushed back on the notion that the technology amounts to mass surveillance. She said the company does not maintain a database of every customer who walks through the door, retains information on suspected shoplifters only for a limited window, and does not share data with outside agencies — including U.S. Immigration and Customs Enforcement, according to the New York Post.

Keep reading

Doll-Heads Apparently Fooling Tesla FSD. Is Facial-Recognition Update Next?

Chinese e-commerce platforms are selling miniature heads that, according to Fred Lambert at the EV blog Electrek, are being used to “trick Tesla’s cabin camera into thinking a driver is paying attention.”

Priced at $20 to $50 and marketed as dashboard decorations or “travel companions,” these miniature heads are mounted near the rearview mirror to mimic a human face while Autopilot or Full Self-Driving is engaged.

via Instagram user “decentmiss_” … 

While FSD is engaged, Tesla’s cabin camera monitors driver attentiveness, including whether the driver repeatedly looks away from the road, and issues warnings when attention appears to lapse. Tesla requires increased supervision when FSD is in “Mad Max” or “Hurry” mode.

Videos of the miniature heads recently went viral on social media, suggesting that some users in China are employing them to trick Tesla’s driver-attention safeguards.

Here is Lambert’s first take:

Let me be direct: anyone mounting a fake head to defeat their Tesla’s driver monitoring system is putting their life and the lives of everyone around them at risk. And the sellers profiting from these devices are enabling potentially fatal behavior for $30 a pop.

Over the years, drivers have used various defeat devices, such as counterweights attached to the steering wheel to trick the torque sensor into believing someone was holding it. Tesla countered that workaround with the cabin camera, but now must address the issue of miniature heads.

Keep reading

Mexican Government Delays Biometric Registration Deadline After Massive Public Resistance

Mexico’s President Claudia Sheinbaum has announced an extension to a controversial deadline that required Mexican citizens and foreign residents to register their phone lines with their identification. The move comes after less than half of the country signed up to register their phone lines.

On Thursday morning, Mexico’s Telecommunications Regulatory Commission (CRT) announced a staggered extension for citizens to register their mobile phone lines with their identification. This controversial requirement has received pushback and resistance from the Mexican population, many of whom question how their data will be stored and used.

According to the announcement, prepaid phone lines that have not yet been linked to an identity will now have until between August and December to complete the process, with the deadline based on the last digit of the phone number. The new policy states that after the deadline expires, telephone companies will suspend service to non-compliant lines within 72 hours.

“For the safety of all, every telephone number must be registered in the name of one person, in order to eliminate the anonymity that has allowed crime such as fraud or extortion,” the press release reads. “With this measure, Mexico will cease to be one of the few countries that allowed the acquisition of a SIM card without identification, and will join the international practice currently in place in 166 countries.”

Calls for a deadline extension have increased in recent weeks, as many critics believe the government did not adequately prepare the public for the change. In late May, Mexican billionaire Carlos Slim called for an extension because the process was “very complicated” and progressing slowly.

With the extension of the deadline, the Mexican government and telecom companies are hoping extra time is all that will be necessary to convince more than 50 million people to comply with the mandate. This may prove more challenging than they anticipated in a country well known for mistrust of official institutions.

The requirement to link a person’s ID with their phone line is a fairly new development in Mexico—one of the few places in the world where individuals could still purchase and use SIM cards in cellphones without registering a name or showing some form of identification. All of that changed in July 2025 when several new laws took effect that compel the population to register for a biometric program required to access many services, including phone and internet access. Phone users were originally instructed to register their phone line with their telecommunications provider before June 30, 2026, or face interruption of service. This would force businesses selling these services to check a customer’s CURP before purchase.

Keep reading

Is Tesla About To Use Facial Recognition Before Activating Full Self-Driving

Tesla is reportedly preparing a series of updates, including one that would use a vehicle’s cabin camera to verify a driver’s identity before activating Full Self-Driving.

It sounds a bit dystopian, but this is likely the direction that connected smart-car brands are headed. As vehicles become more autonomous, automakers will increasingly need to verify who is behind the wheel before unlocking FSD functions.

The X account Tesla App Updates penned a new report outlining a series of changes possibly headed to the mobile app, including deeper FSD integration, more owner-facing controls, and expanded software monetization infrastructure.

What stood out to us is the possibility of a new FSD identity-verification layer tied to the cabin camera. If the system cannot verify that the driver matches an authorized profile, FSD could be blocked.

Here’s the full report:

Native Support for “Coastal Blue” Paint

Tesla has added support for a new paint color called Coastal Blue, currently exclusive to the base Model Y Rear-Wheel Drive built at Giga Berlin for the European market.

The strings COASTALBLUE, getCoastalblue, setCoastalblue, clearCoastalblue, and hasCoastalblue show that the app is being updated to properly render this color in its 3D vehicle models. The app can now dynamically load the correct material and shading when a vehicle with this paint code is detected, ensuring accurate representation on the home screen, climate menu, and widgets.

In-App Searchable Video Tutorials

Tesla is building a native, searchable video tutorial library directly into the mobile app. Users will have access to a dedicated tutorial hub (VideoTutorialContent and VideoSearchPanel) with a search bar (VideoSearchBar) that returns relevant results (VideoSearchResultItem). This allows owners to quickly find how-to videos for features like FSD, wiper blade replacement, or PIN to Drive without leaving the app.

Users can also pin important tutorials (setPinnedVideo, pinnedVideo) for quick access. These pinned videos are expected to sync across devices via mergePinnedVideos. The interface uses a clean card-based design (VideoListCard) with pagination (VIDEO_SEARCH_PAGE_SIZE) for better performance.

Keep reading