Privacy in Computer Vision: Faces, Consent, Storage

• Detecting or counting people is different from identifying them; identification is where biometric laws apply.
• Illinois' BIPA requires informed written consent before collecting biometrics, with damages per person.
• Texas, Washington and several state privacy laws also protect biometric data, and the FTC watches for misuse.
• Design to avoid identifying people: blur faces, count without identity, keep events instead of video.
• When identification is the purpose, get clear consent, publish a retention policy and delete on schedule.
• Check vendors closely, and test any face recognition for accuracy across different groups.

This guide explains when camera data becomes biometric data, which laws apply, how to avoid identifying people, when to get consent, and how to store, share and delete images safely. Put plainly: see the work, not the person, unless identifying people is the job and you have consent.

This is general information, not legal advice. Biometric and privacy laws vary by state and country and change often. Confirm your system's design and consent process with counsel before deployment.

Seeing is not identifying. A camera that counts people entering a store, or detects a person in a restricted zone, doesn't need to know who they are.

Identifying is biometric. Face recognition creates a template from someone's face geometry to match them to an identity. That template is biometric data in most privacy laws.

Other biometrics count too. Fingerprints, hand geometry and voiceprints, often used in timeclocks and door access.

Images alone can be sensitive. Stored video showing identifiable faces, license plates or badges is personal data even without recognition software.

Know which you're building. Many projects drift from counting to naming people as features get added. Decide early, and write it down. The broader uses of computer vision are covered in teaching software to see your operation.

Illinois BIPA. The Biometric Information Privacy Act requires informed written consent before collecting biometric identifiers, plus a public policy on retention and destruction. Damages are $1,000 per violation, or $5,000 if reckless or intentional.

BIPA's 2024 change. An August 2024 amendment made repeated collection from the same person by the same method count as one violation, and confirmed that electronic signatures can serve as written consent.

Texas and Washington. Both have their own biometric laws requiring notice and consent before capturing biometric identifiers for commercial purposes.

State privacy laws. Several state consumer privacy laws treat biometric data as sensitive, with extra consent and notice rules.

The FTC. In 2023 the FTC issued a policy statement warning that unfair or deceptive uses of biometric information can break federal consumer protection law.

Florida businesses aren't out of reach. Your customers, staff, locations or data may cross into states with stricter rules. Plan for the strictest rules that could apply to you.

Count without identity. Many questions, such as how many visitors, how long the line is, or whether a zone is occupied, can be answered with anonymous detection.

Blur faces early. Blur or mask faces as close to the camera as possible, before images are stored or sent anywhere.

Process on the device. Analyze video on cameras or local servers, and send out only the results, not the footage.

Keep events, not video. Store "12 people entered at 9:00" or "spill detected at aisle 4," not hours of recordings.

Point cameras at the work. Aim at products, shelves, docks and equipment rather than faces wherever the job allows.

Collect only what the purpose needs. Every extra field or image is extra risk to protect.

Some uses need identity. Employee timeclocks, secure door access, or member check-in may require recognizing people.

Get clear, informed consent first. Explain what is collected, why, how long it's kept and who sees it. Get written or electronic consent before collecting.

Offer an alternative. A badge or PIN for people who decline. Consent that can't be refused isn't meaningful.

Post clear notices. Signs where cameras operate, and plain explanations in apps and onboarding.

Write the policy down. A public policy on how long biometric data is kept and when it's destroyed, as Illinois requires.

Keep it short. Set the shortest retention period the purpose allows, and delete automatically when it ends.

Encrypt everything. In storage and in transit, with keys managed separately.

Limit access. Only named roles can view footage or biometric data, with every access logged. The principles match those in agent security.

Separate templates from identities. Store biometric templates apart from names and records where possible.

Plan for deletion requests. Be able to find and delete one person's data when they leave or ask.

Clean data foundations help. Knowing where every image and record lives is the groundwork described in the foundation every AI project needs.

Know where processing happens. On your devices, your servers or the vendor's cloud, and in which country.

Read the contract. Whether the vendor can use your footage to train its own models, how long it keeps data, and how it deletes it.

No selling or sharing. Biometric data should never be sold, and shared only where the law and your consent allow.

Check security. Ask how the vendor protects data, how it handles breaches, and whether it has been independently audited.

Connections carry risk too. Every link between camera systems and other software should have limited access, as covered in API integration.

Recognition isn't equally accurate for everyone. Government testing has found that face recognition can be more accurate for some groups of people than others.

Errors have consequences. A wrong match can lock out an employee or wrongly flag a customer.

Test on your own population. Measure accuracy for the people and conditions your system will see.

Keep a person in the loop. Never let a face match alone deny access, pay or service without a human check and a way to appeal.

Workplace cameras. Tell staff where cameras are and what they're used for. Biometric timeclocks need consent and an alternative.

Customer-facing cameras. Signs at entrances, no facial recognition for marketing without clear consent, and anonymous analytics wherever possible.

Start with a pilot. Test a privacy-safe design on one site before rolling out, following AI pilots that fail safely.

Share of systems that identify people. Aim to keep it as low as the work allows.

Consent coverage. For any identification system, the share of people with recorded consent.

Retention compliance. Data deleted on schedule, checked each month.

Access log reviews. Who viewed footage or biometric data, and whether each access was justified.

Accuracy by group. For any recognition system, error rates across different groups.

Requests handled. Deletion and access requests answered on time.

List every camera and vision system, what it captures and whether it identifies people. Decide which jobs truly need identity. Review the laws that may apply with counsel, based on where your people and data are.

Switch systems that don't need identity to anonymous counting, blurring and event-only storage. For systems that do, set up consent, alternatives, notices and a written retention policy. Encrypt data and limit access.

Check that deletion runs on schedule and access is logged. Test any recognition system's accuracy across groups. Review vendor contracts, and run the first monthly privacy review.

Astra Results Marketing designs computer vision to see the work, not the person, wherever the job allows. We use anonymous counting, early face blurring, on-device processing and event-only storage to keep systems useful and low-risk.

When identification is truly needed, we build in consent, alternatives, clear notices, short retention and tight access, reviewed with your counsel. Engagements begin with a camera and data review through our computer vision team.

Related reading

• Computer Vision: Teaching Software to See Your Operation
• Agent Security: Permissions, Logs, Kill Switches
• Logistics ML: Route and Load Optimization

No. Detecting or counting people without identifying them is generally not biometric. Face recognition, fingerprints and similar systems that identify individuals create biometric data, which carries stricter rules.

Informed written consent before collecting biometric identifiers, and a public policy on retention and destruction. Damages are $1,000 per violation, or $5,000 if reckless or intentional. A 2024 amendment counts repeated collection from one person by one method as a single violation and allows electronic signatures.

They can. Your customers, employees, locations or data may fall under laws in states like Illinois, Texas or Washington, and federal consumer protection law applies everywhere. Plan for the strictest rules that could apply, and confirm with counsel.

Count people anonymously, blur faces as close to the camera as possible, analyze video on the device, store events instead of footage, and aim cameras at products and equipment rather than faces.

When identity is truly needed, such as secure access or timekeeping, and you have clear informed consent, an alternative for people who decline, short retention, tight access and a human check on any match.

As briefly as the purpose allows, with automatic deletion. Biometric data needs a written retention and destruction policy, and you should be able to find and delete one person's data on request.

Ready to use cameras without the privacy risk? Astra Results Marketing designs computer vision that sees the work, not the person: anonymous counting, early blurring, on-device processing and short retention, with consent and counsel review built in wherever identification is truly needed. ▸ CALL (786) 321-2866 · ▸ REQUEST YOUR CONSULTATION