Between smartphone and borders, facial recognition is discreetly essential in our daily lives. Inventory of technology under close legal surveillance.
At the airport, my smartphone unlocks thanks to my face and I pass the paratically without slowing down. Two harmless uses of facial recognition which facilitate everyday life, but which are enough to fuel all fantasies: Orwell, Big Brother, permanent surveillance … France of 2025 is however not yet on algorithmic dictatorship. Yes, facial recognition does exist, but no, it does not yet follow us at every street corner. So, legally speaking, what is possible to do today with this technology? Where are the limits not to be crossed? And above all: what are we heading for?
Authenticate or identify: a double entry shade
Facial recognition does not designate a single use, but two distinct logics that share the same name. To authenticate is to verify that a person is the one they claim to be. Typical example: Face ID on your smartphone, 1: 1 verification, between you and your digital twin.
Identify, on the other hand, is to try to find a person in a crowd, by comparing their face to a base of images: a search 1: n, much more intrusive. And this is where facial recognition changes its face.
What French (and European) law says)
In France, as in Europe, facial recognition is governed by a strict legal framework. The GDPR prohibits the processing of biometric data in principle, whose faces are part, with exceptions: explicit consent, vital emergency or major public interest. However, in professional and private contexts, consent is generally not recognized as a sufficient legal basis, especially due to the link of subordination. In this case, other foundations must be considered, such as legitimate interest or a legal obligation. And if a less intrusive solution can meet the same objective, it must be privileged. For sovereign uses (police, justice, etc.), the framework is even more forced: a biometric treatment can only be implemented if it is provided for by a law, or, failing this, by a decree in the Council of State taken after motivated and published advice from the CNIL.
Thus, impossible for the police to use cameras with biometric identification in public space in real time. This prohibition was reinforced by AI Act European, adopted in May 2024, which clearly specifies the distinction between facial recognition “in real time” (prohibited except very precise exceptions) and “a posteriori” (authorized under strict conditions). Exceptional use must be validated by an independent authority and justified by extreme cases such as terrorism, kidnapping or the hunt for a suspect of serious offense (terrorism, homicide, drug trafficking).
These derogatory cases must be precisely defined by each Member State and subject to the prior authorization of an independent judicial or administrative authority. The current legal framework, soon reinforced by AI Acts, therefore places facial recognition in a locked box. Double lock: one European, the other national.
Current uses: pragmatic and limited
Certain uses of facial recognition are already integrated into a daily life. At the borders, for example, the parafe automatic airlocks allow rapid authentication (recognition 1: 1 via your biometric passport), reliable and well accepted. Difficult to find someone to offend it: she avoids the line without upsetting freedoms too much, and voluntary consent. You are free to choose the longer line, for the pleasure of the smile in uniform.
Another use, more discreet: the posteriori identification by the font via the TAJ file (processing of judicial history). In practice, investigators extract an image captured by a camera after an offense, and submit it to software that compares it to the millions of photos contained in the TAJ. This practice was validated by the Council of State in 2022, despite the protests of associations such as the Quadrature of the Net, who see it as a form of deaf, but very real monitoring.
In the private sector, facial recognition has imposed itself without a crash in our smartphones or certain banking apps, replacing the PIN code. Who moved? Person. The facial data remains stored locally, and it is you who decide whether or not to activate the option.
More recently, the Proman group has deployed Izicheck: an instant identity verification by selfie, to combat usurpations. This feature integrated into the IziWork application uses facial recognition to ensure that the mission person with their customers corresponds well to the papers presented. An innovation under experimentation.
Companies have also planned to replace badges with facial recognition gantries, and some stages have tested the identification of persona non grata supporters. But as Marie Duboys-Fresney, from the CNIL: “No lasting deployment to date. At most, some experiments, carried out with the consent of the participants.”
Facial recognition in France therefore remains confined to some well identified uses: border security, a posteriori judicial investigation, and authentication chosen. We are far from a digital jungle where our faces would be scanned all the time. And for the moment, it is the right that holds the mouse.
Red lines: prohibited uses
Facial recognition in real time in public space is prohibited. The widespread filing of citizens via a centralized base is just as much. In 2019, an experiment of access by facial recognition in two PACA high schools was considered illegal by the CNIL, then confirmed by the justice. Same release for the American company Clearview AI, heavily sanctioned in France for having succeeded, without authorization, millions of photos online.
France is forbidden, for the moment, any use that would be similar to generalized or not consented monitoring. No refreshing cameras in the streets. No biometric coping in teaching or work areas. No recognition of emotions. No wild harvesting of facebook photos to train a police algorithm.
Electronic “eyes” must remain closed on our features. France holds its line of vigilance. But in terms of security, there are always insistent looks.
What prospects for the years to come?
In the short term, France will have to implement AI Acts and specify exceptional cases: on what criteria? What control authority? For what time? So many sliders to position before connecting the machine. On the technology side, facial recognition is progressing. Error rates are retreating, but still vary depending on whether you are a woman or a man, with clear or dark skin. Biases are corrected (slowly), algorithms accelerate. The tool becomes both more useful … and more risky.
More useful, because a more reliable system reduces errors, and strengthens the arguments of supporters: hard to say no to an almost infallible techno supposed to save lives. But also more risky, because omnipresent and precise facial recognition would bring one of the last concrete brakes to generalized surveillance. And the day the technology will be ready, the temptation will follow closely. All the more reason, according to NGOs, to register safeguards in legal marble as long as there is still time.
This displayed prudence does not prevent certain political leaders from hoping for further. On May 23, 2025, on RTL, Gérald Darmanin, now Minister of Justice, released: “You will see, in 5 or 10 years, we will do facial recognition.” For him, these smart cameras could become a central lever against narcotrafic and insecurity. A way of sliding that the legal lock is only a matter of time. It remains to be seen if the frame will follow … or will end up folding.
A well -framed use, well perceived, could pass smoothly. A faux pas, on the other hand, would be enough to bring up the dikes. The public authorities know this. And advance cautiously. Let’s say… in slippers on a microprocessor floor.
