Facial Recognition Governance Frameworks Will Define Who Keeps the Tool

The Regulatory Wave Is Already Forming

For physical security professionals working in commercial real estate, hospitality, healthcare campuses, and mixed-use developments, the last several years have produced a familiar cycle: a technology arrives with genuine operational promise, early adopters integrate it without adequate governance, high-profile controversies follow, and legislators respond with frameworks calibrated more to political urgency than operational nuance. Facial recognition is now deep in that cycle, and the window for the security industry to shape a workable outcome is narrowing.

Municipal and state governments across the country are preparing significant expansions of biometric privacy law. Illinois, which enacted the Biometric Information Privacy Act (BIPA) in 2008, has continued to tighten enforcement and litigation exposure through subsequent amendments, producing a body of case law that commercial operators nationwide are now watching carefully. New York City's Local Law 31 imposes disclosure and data-practice requirements on commercial establishments using biometric identifier technology. San Francisco's municipal code bars public agencies from deploying facial recognition, a prohibition that has influenced how commercial landlords in that city approach vendor contracts and liability. The Federal Trade Commission issued guidance in 2025 reinforcing its position that biometric surveillance practices can constitute unfair or deceptive acts under Section 5 of the FTC Act when consumers lack meaningful notice or control. Looking ahead to 2026 and 2027, analysts and legislative tracking services are monitoring additional state bills modeled on BIPA and on the European Union's AI Act biometrics provisions, though the precise timelines and final language of those measures remain pending.

The thesis of this commentary is straightforward and deliberately uncomfortable for both sides of the current debate: facial recognition technology, deployed within a principled governance structure, remains one of the most operationally significant tools available for active threat mitigation on commercial properties, and security leaders who abandon it wholesale in response to regulatory anxiety will expose the people and assets in their care to risks that legacy access control and human patrol alone cannot adequately address. At the same time, operators who continue deploying facial recognition under ad hoc or opaque arrangements will find the next regulatory cycle ends their programs entirely, and will, frankly, deserve the consequences they receive.

What the Technology Actually Delivers, and Where It Falls Short

The National Institute of Standards and Technology's Facial Recognition Vendor Test (FRVT) program has produced the most rigorous and publicly available dataset on the operational performance of facial recognition algorithms. NIST's ongoing evaluations document dramatic variation in accuracy across vendors and, critically, across demographic groups. Some top-tier algorithms perform with remarkably low false-match rates on cooperative, frontal imagery under controlled conditions. Performance degrades meaningfully with poor lighting, non-frontal angles, occlusion, and certain demographic combinations, and NIST has documented differential accuracy by race, sex, and age across numerous vendor submissions.

This matters for the governance argument in a specific way: an operator who deploys a poorly performing algorithm in a high-stakes identification scenario and then acts on a false match has incurred legal exposure and has potentially caused direct harm to an innocent person. The NIST FRVT data are publicly accessible, and selecting a vendor without consulting those benchmarks is, at this point, an indefensible decision. Algorithm selection must be treated as a professional obligation, not a procurement checkbox. Security leaders bear responsibility for understanding the performance envelope of the tools they authorize.

Within the appropriate performance envelope, however, the operational value is genuine. Facial recognition can flag known trespassers, individuals subject to active restraining orders, or persons previously removed for cause from a property, in real time, before an incident escalates. In healthcare environments, it can alert staff to individuals who have previously exhibited threatening behavior toward clinical workers. In large mixed-use developments, it provides a layer of deterrence and detection that no economically feasible staffing model can replicate through human patrol alone. The question facing commercial property owners is whether they are prepared to operate the technology in a way that is legally defensible, ethically coherent, and institutionally sustainable.

The Legal Landscape as It Currently Stands

Illinois BIPA remains the most consequential biometric privacy statute in the United States, both because of the private right of action it provides and because of the volume of class action litigation it has generated. The statute requires informed written consent before biometric data collection, mandates a written retention and destruction policy, prohibits the sale of biometric data, and creates per-violation liquidated damages that have resulted in settlements reaching into the tens of millions of dollars. Amendments and judicial interpretations have refined the accrual of claims, but the core obligations have not softened. Any commercial operator with locations in Illinois who is collecting facial geometry, which BIPA defines as a biometric identifier, without a compliant consent and retention program is carrying material litigation exposure today.

New York City's Local Law 31, which applies to commercial establishments rather than only public agencies, requires operators to post clear notice at each entrance where biometric identifier technology is in use. The law also prohibits the sale of biometric data collected from customers and imposes other data-practice restrictions. It is narrower than BIPA in some respects but represents an important data point: major municipalities are moving beyond public agency restrictions and reaching into private commercial operations.

San Francisco's prohibition on public agency use of facial recognition, codified in the municipal code, does not directly regulate private commercial operators, but it has shaped the broader political environment in that market and has influenced how institutional property owners communicate with tenants and investors about technology deployment. The signaling effect of high-profile municipal bans should receive serious weight; they create reputational pressure on commercial operators even when the legal prohibition does not technically apply to them.

The FTC's 2025 consumer protection guidance on biometric surveillance reinforces that federal enforcement attention is active in this space. The FTC has signaled that practices involving the collection of biometric data without adequate consumer notice, or retention of data beyond operational necessity, are potential Section 5 targets. The guidance does not constitute a binding rule, but FTC enforcement actions are expensive and reputationally damaging regardless of outcome, and the guidance puts commercial operators on notice that "we didn't know" will not constitute an adequate defense.

The Counterargument Deserves Honest Treatment

Critics of commercial facial recognition deployment make several arguments that deserve serious engagement rather than dismissal. The civil liberties concern is substantive: ubiquitous biometric surveillance, even when deployed by private actors, contributes to an environment in which people's movements and associations are tracked without meaningful awareness or consent. The concern is grounded in documented risks. Data breaches, vendor failures, mission creep, and the potential for data to be accessed by law enforcement through legal process or subpoena are all genuine risks that governance frameworks must address directly.

The accuracy disparity documented by NIST across demographic groups is also a serious concern in a commercial security context. An access control or watchlist system that generates systematically higher false-match rates for certain demographic groups is technically imperfect and subjects those individuals to a disproportionate burden of suspicion, with potential consequences ranging from inconvenience to physical confrontation. Operators who dismiss this concern as an abstraction have not thought carefully about what a security officer does with a facial recognition alert, or about the liability and human cost of acting on a false match.

These concerns are real, and the governance framework this commentary recommends is designed in part to address them directly. Acknowledging the legitimacy of the opposition is a precondition for building the kind of principled deployment model that can survive regulatory scrutiny and public accountability.

A Governance Framework That Can Actually Survive

For commercial property owners who conclude that facial recognition serves a genuine security purpose on their properties, the following framework reflects what responsible deployment looks like in the current and anticipated regulatory environment. It is a description of what institutional seriousness about this technology requires, going well beyond a minimum compliance checklist.

Begin with a documented purpose limitation. The use case for facial recognition on a given property should be articulated in writing before deployment: what specific threat scenarios does the system address, why are alternative measures insufficient, and what categories of individuals will be enrolled in any watchlist. Purpose limitation is both an ethical discipline and a legal protection. A system deployed for access control should not be repurposed for employee attendance monitoring without a separate analysis and consent process. Scope creep is both the most common failure mode and the most predictable source of regulatory and litigation exposure.

Algorithm selection must be grounded in the NIST FRVT data. Operators should require vendors to produce their NIST FRVT evaluation results as a condition of procurement, specify the demographic accuracy requirements the system must meet for the specific use case, and document that analysis in the procurement record. The data are public, which makes this step achievable, and it transforms algorithm selection from a marketing exercise into a defensible professional judgment.

Consent and notice obligations must be met as a matter of unconditional practice, not as a jurisdiction-by-jurisdiction calculation. Post clear, prominent signage at all points of entry where biometric data may be collected. For employees subject to enrollment, obtain written informed consent that explains what data are collected, how long they are retained, who has access, and under what circumstances they will be deleted. Treat BIPA and Local Law 31 as the floor of your obligations, because the direction of regulatory travel is clearly toward greater restriction, and building a program to the current minimum means rebuilding it again in 2027.

Data minimization and automatic purging are structural requirements. Retention of facial recognition data beyond operational necessity is a liability without a corresponding benefit. Systems should be configured to purge captured biometric data automatically on a schedule tied to the specific use case. In many commercial applications, retention beyond 24 to 72 hours for non-watchlist individuals serves no legitimate security purpose. Watchlist data should be reviewed and pruned on a defined schedule, with documented justification for continued retention of each enrolled individual. These measures reflect a coherent position about the purpose and proportionality of the program, as well as satisfying compliance obligations.

Vendor contracts must address data access, breach notification, subprocessor obligations, and law enforcement request protocols explicitly. A commercial operator who deploys a third-party facial recognition platform without understanding how that vendor responds to law enforcement subpoenas, or whether the vendor aggregates data across client deployments, has not actually controlled the risk they think they have controlled. Due diligence on vendor data practices is a material component of a defensible program.

Finally, human review must be a structural feature of any consequential decision workflow. Facial recognition should generate alerts that trained security personnel evaluate. It should not autonomously trigger access denial, dispatch, or physical intervention. The human-in-the-loop requirement is both an ethical safeguard and a practical limitation on liability. Documenting that policy and training security staff to follow it consistently is as important as the technical configuration of the system itself.

What Security Leaders Owe Their Organizations Right Now

The 2026 and 2027 legislative cycles will produce a patchwork of state and municipal requirements that commercial operators with multi-market portfolios will need to navigate simultaneously. The organizations that build governance infrastructure now, including documented policies, vendor contracts with appropriate terms, staff training, and retention schedules, will be able to demonstrate compliance across jurisdictions with relatively modest adaptation. The organizations that wait will face the choice between rapid unplanned remediation and abandoning the technology under regulatory pressure.

There is also a competitive dimension that security directors should surface in conversations with ownership and general counsel. Properties that demonstrate responsible biometric governance are better positioned with institutional tenants, insurance underwriters, and, increasingly, with municipal licensing authorities. The reputational cost of a high-profile biometric misuse incident, such as a wrongful detention, a data breach, or a class action filing, extends well beyond the direct legal exposure.

USPA Nationwide Security has observed, across its service portfolio, that the properties with the most sustainable security programs are those where technology deployment decisions are preceded by clear analysis of purpose, governed by written policy, and operated by trained personnel who understand both the capability and the limits of the tools they use. Facial recognition, in that environment, is a defensible and valuable component of a layered security strategy. Deployed carelessly, it is a liability that no security outcome can justify.

The regulatory environment will continue to tighten. Security leaders who engage that reality seriously, build the governance infrastructure it demands, and retain the operational capability facial recognition provides will be better equipped to protect the properties and people in their charge. Those who treat compliance as someone else's problem will find, eventually, that it has become their only problem.

---

For questions about security program design or compliance-aware technology deployment, contact USPA Nationwide Security at (800) 214-1448 or visit uspasecurity.com/contact.