Facial recognition technology is quietly moving into Britain's high streets and shopping centres, and the public is noticing. While police deployments of live facial recognition (LFR) have dominated headlines, private organizations are now rolling out the same biometric tools with far less visibility and far fewer rules.

What You Need to Know

Facial recognition technology (FRT) is expanding from police forces into retail environments, where its use is often less visible and less understood by the public. A survey by Face Int found that 73% of UK adults support police use of FRT, but only 54% support its use in retail. The UK currently regulates FRT through a patchwork of laws including the Data Protection Act and the Human Rights Act, while the EU AI Act introduces specific biometric identification requirements from December 2027. The Government's recent consultation on a new framework for law enforcement use of FRT did not extend to private sector deployments.

Public Attitudes Depend on Who Is Watching

Support for facial recognition is not driven by the technology itself. It depends on who operates it, why it is deployed and where it is used. The public draws a clear line between a police force tracking a violent suspect and a retailer flagging someone suspected of shoplifting.

That distinction shows up sharply in the data. Earlier this year, Face Int commissioned an independent survey of 2,000 UK adults. It found that almost three quarters (73%) support police use of FRT, compared with 54% who support its use in retail environments.

The gap does not mean the public rejects private sector deployment outright. It means acceptance is tied to context and to the organization behind the camera. When police use LFR, marked vehicles and signage typically make the operation obvious, often with advance announcements about timing, location and data processing.

In retail spaces, the same clarity is often missing. Shoppers may not know they are being scanned, nor understand what happens to their biometric data afterward. That uncertainty is sensitive: 57% of respondents to Face Int's survey said they were concerned about how images of their faces are stored.

Accuracy Alone Will Not Secure Trust

Much of the debate around facial recognition focuses on accuracy, and for good reason. Reports of false identifications have raised serious concerns. Ensuring the technology is accurate, robust and properly tested is essential.

Accuracy, however, is only one part of the puzzle. How facial data is collected, processed and stored matters just as much, as does the governance surrounding its use. In fact, 43% of the UK public said that clear laws governing FRT would increase their trust in the technology.

The UK currently regulates FRT through a patchwork of legislation, including the Data Protection Act and the Human Rights Act. Organizations deploying the technology must interpret multiple laws to stay compliant, which leads to inconsistent standards across the sector.

The EU AI Act takes a different approach. It specifically addresses biometric identification, with additional requirements to protect the public and their data due to come into effect in December 2027. The UK's framework, by contrast, remains fragmented.

Earlier this year, the Government completed a consultation on a new framework for law enforcement use of FRT. Notably, that consultation did not extend to private sector deployments. More recently, the Independent Commissioner's Office (ICO) published findings from its work examining police use of FRT, stating that it was working with forces and police oversight bodies to give the public confidence in its governance and oversight.

What Responsible Deployment Looks Like

Greater scrutiny does not automatically mean tighter restrictions. It should mean clearer expectations for how organizations capture, process and store biometric data. Responsible use starts with transparency and ends with accountability.

Organizations must be open about when and why FRT is being used. Information about the purpose of a deployment, what happens to people's data and who is responsible for it should be readily available before any data is captured.

Privacy should be built into FRT systems from the outset, not added after sensitive data has already been collected. Techniques such as hashing and other forms of biometric template protection can remove the need to capture facial images at all. This privacy-by-design approach should be a minimum expectation for anyone investing in FRT.

  • Data minimization: Organizations should only capture and retain data they genuinely need, and data relating to individuals who do not match a legitimate watchlist should not be retained.
  • Clear retention periods: Information that does need to be stored should be subject to defined retention limits.
  • Robust security: Access should be restricted, with clear records of why, when and by whom data has been accessed.
  • Human oversight: Facial recognition matches must still be treated as an alert requiring human review, not as automated decisions.

Anyone handling biometric data should receive appropriate training. Organizations must also have processes in place for responding quickly and transparently to breaches.

Finally, technology should support human decision making, not replace it. While facial recognition is improving rapidly, matches must still be treated as alerts requiring human review.

Why This Matters

The expansion of facial recognition into retail changes the stakes for millions of shoppers who never consented to being scanned. Unlike police deployments, which come with signage and public announcements, private sector use often operates in a regulatory grey zone with no equivalent transparency requirements.

This shift matters most for consumers, who face the prospect of being identified by algorithms they cannot see and cannot question. It also matters for retailers, which risk losing public trust if they deploy the technology without clear safeguards. And it matters for regulators, who now face pressure to extend oversight beyond policing into the private sector.

The Government's decision to limit its consultation to law enforcement leaves a gap that private organizations are already filling. Without a clear framework, inconsistent standards will persist, and public confidence in facial recognition will remain fragile.