Security Experts:

FTC Offers Recommendations for Facial Recognition Usage

The Federal Trade Commission has published a staff report containing guidelines and recommendations for companies that use facial recognition technologies. The compilation of best practices is aimed at protecting consumers when such technologies are deployed for purposes such as marketing.

The FTC’s report addresses concerns and issues raised during a workshop on the topic held last year, where a number of issues related to facial recognition were discussed. The centers the best practices around three issues, including privacy by design, consumer choice, and transparency, as the main considerations organizations need to keep in mind when deploying such technologies.

Facial recognition technology, the report explains, has a number of uses. For example, online social networks, mobile apps, and digital signs use it; but there are other potential uses including determining age range and gender in order to deliver targeted advertising; assessing viewers’ emotions to see if they are engaged in a video game or a movie; or matching faces and identifying anonymous individuals in images.

This also creates privacy concerns, which is why the workshop led to this latest report. “Fortunately, the commercial use of facial recognition technologies is still young. This creates a unique opportunity to ensure that as this industry grows, it does so in a way that respects the privacy interests of consumers while preserving the beneficial uses the technology has to offer,” the FTC staff report states.

There are three essential points that the best practice list focuses on. First, if an organization is deploying facial recognition for a service, then the service must be designed with consumer privacy in mind. Second, security has to be included in order to protect all of the data that the services will collect. Lastly, the organization has to consider the sensitivity of the information they are collecting. For example, the FTC added, digital signs using facial recognition technologies should not be set up in places where children congregate.

Additional recommendations include proper notice that such technology is being used, before the consumer interacts with it. In the case of social networks using facial recognition, the report said that consumers (users) should be given clear notice about how the technology is being used, what data it is collecting, how it works, as well as guidance on how to turn the feature off and permanently remove any previously collected information.

It’s a step in the right direction when it comes to privacy, but unfortunately, there is nothing legally binding by any of the recommendations that are being presented.

The full report from the FTC is available here

Steve Ragan is a security reporter and contributor for SecurityWeek. Prior to joining the journalism world in 2005, he spent 15 years as a freelance IT contractor focused on endpoint security and security training.