Your Face Is Your Ticket: Frightening Comfort

Nobody scanned the digital card on my phone so I could participate in this year’s MWC, the annual tech trade show formerly known as Mobile World Congress. Facial recognition software did all the work.

Your face may also be your ticket to a place near you. Delta Airlines a company.,

United Airlines Holdings a company.

and JetBlue Airways corp.

You have ticketless face scanning systems installed in many airports. This season, all Mets fans can use facial recognition express lanes previously reserved for season ticket holders. Suspicious? amazing? Based on a recent brush with technology, both.

As facial recognition access points appear in more public places including airports and concert venues, you may be wondering how you feel about it.

Companies that implement face matching software offer the benefits of speed, convenience, security, and contactlessness to customers. Most of them also maintain that it is just an option. Meanwhile, lawmakers in several US states are looking to tighten regulations around the use of this type of technology, citing privacy concerns as well as allegations of bias. Research has found that this technique is not accurate for people of color and women in general.

At this year’s MWC trade show in Barcelona, ​​participating participants gained entry by standing in front of cameras equipped with facial recognition software. Angel Garcia/Bloomberg; Maurizio Martorana for The Wall Street Journal

While the answer is up to the individual, it helps if you know the company providing the service and the expected benefits: Do you want that company to store your biometric information? Do you get something useful in return? It also depends on where you are, since local laws affect how much facial recognition and data collection can be used.

Capture your face

Facial recognition works by creating a map of your face. The map contains your unique measurements – the distance between your forehead and your chin, or between your eyes. These stats are then converted into a code called a biometric code or face print.

It’s how your iPhone’s Face ID recognizes you, how Google Photos can compile snapshots of your kids or how Amazon.com a company

The Astro robot can tell family members about thieves. Tokens are not shared between premium services – each uses its own unique, non-transferable token on your behalf.

GSMA, the industry group that organizes MWC and represents mobile network operators worldwide, used a facial recognition service called Breez, which was developed with ScanVis Ltd. , a Hong Kong-based company. The service indicates the faces of attendees with pre-submitted photos of their government-issued ID cards.

Breeze entry is optional, but I chose it for speed. Before the event, non-Breez attendees can wait several days to confirm their registration. Signing up for the MWC app — which used my phone’s camera to match my face to the photo in my passport — took less than a minute.

How secure is my data?

While the face-scanning aisles at the conference were certainly comforting, every time I stared into the camera, I wondered who was looking back at me. Where does my picture go and what can I do with it?

The company that stores your facial data could keep it and divert it from entering the place, say, to law enforcement, or it could be acquired by a company with a completely different purpose than you agreed to. This kind of misuse is largely hypothetical. However, you can’t always keep track of where your face ends up: One company sold facial recognition technology based on billions of photos taken from Facebook, LinkedIn, and other sources.

Before agreeing to use biometric data, Joseph Kettler, professor of machine intelligence at the University of Surrey in the UK, recommends finding out three things: the purpose your data was collected, what happens to your facial image once you no longer need the service and how to delete the data.

Conference organizers said the attendees’ biometric codes are encrypted and stored in Europe, though the data can be accessed from Hong Kong. The event’s privacy policy said the data was “securely destroyed” within 28 days of the event in accordance with EU data privacy laws. A GSMA spokesperson told me that the data will likely be deleted within three days of the event closing. ScanVis, the GSMA’s technology partner, did not respond to my request for comment.

Protect your biometric data

Although you always have the ability to opt out of facial recognition, it can come at a price, said Jennifer King, privacy and data policy fellow at the Stanford Institute for Human-Centered Artificial Intelligence. Think of how the cash lane at the toll stop is much slower than the E-ZPass lanes.

Another issue, she said, is that the United States does not have a federal law governing opt-out and non-discrimination rights, as the European Union does. Not only are there laws in Europe, but there are also regulators empowered to enforce them, Dr. King said. Currently, only a handful of states, including Illinois, Texas, and California, have biometric privacy rules.

In January, the New York Attorney General launched a review of Madison Square Garden Entertainment corp.

, after the New York City site used facial recognition technology to prevent lawyers from companies suing the company from attending concerts or sporting events. In late February, two court rulings expanded the scope of an Illinois law that governs companies’ use of biometric data, which includes facial and retina scans.

Facial scanning will become more prevalent in our travel and entertainment, as well as other areas such as education, banking and law enforcement. We are just beginning to understand the pros and cons.

For more WSJ Technology analysis, reviews, advice and headlines, visit Subscribe to our weekly newsletter.

Write to Nicole Nguyen at [email protected]