Your Face Is Your Ticket: A Creepy Convenience

No one scanned the digital pass on my phone for me to get into this year’s MWC, the annual tech trade show formerly known as Mobile World Congress. Facial-recognition software did all the work.

Your visage, too, might already be an entry ticket at a venue near you.

Delta Air Lines Inc.,

United Airlines Holdings Inc.

and

JetBlue Airways Corp.

have ticketless face-scanning boarding systems installed at several airports. This season, all Mets fans can use facial-recognition express lanes previously reserved for season-ticket holders. Creepy? Cool? Based on my recent brush with the tech, it’s both.

As facial-recognition access points crop up in more public places including airports and concert venues, you might be wondering how you’re supposed to feel about it.

Companies implementing face-matching software tout speed, convenience, security and contactless benefits for customers. Most also stress that it’s only an option. Meanwhile, lawmakers in several U.S. states are looking to tighten regulations around use of this kind of tech, citing privacy concerns as well as allegations of bias. Research has found that the tech isn’t as accurate for people of color and women, in general.

At this year’s MWC trade show in Barcelona, participating attendees gained entry by standing in front of cameras equipped with facial-recognition software. Angel Garcia/Bloomberg; Maurizio Martorana FOR THE WALL STREET JOURNAL

While the answer comes down to the individual, it helps if you know the company providing the service and the expected benefits: Do you want this firm storing your biometric information? Are you getting something useful in return? It also depends on where you are, since local laws affect the extent to which facial recognition can be used and data can be collected.

Capturing your faceprint

Facial recognition works by creating a map of your face. The map contains your unique measurements—the distance between your forehead and chin, or between your eyes. These stats are then converted into code called a biometric token or faceprint.

It’s how your iPhone’s Face ID identifies you, how Google Photos can group shots of your kids or how

Amazon.com Inc.’s

Astro robot can tell family members from burglars. The tokens aren’t shared between distinct services—each uses its own unique, nontransferable token for you.

GSMA, the industry group that organizes MWC and represents mobile-network operators worldwide, used a facial-recognition service called Breez, developed with ScanVis Ltd., a Hong Kong-based company. The service cross references attendees’ faces with previously submitted photos from government-issued IDs.

Breez entry is optional, but I chose it for the speed. Ahead of the event, non-Breez attendees could wait several days to confirm their registration. Signing up with the MWC app—which used my phone’s camera to match my face with the image on my passport—took less than a minute.

How safe is my data?

While the conference’s face-scanning lanes were certainly convenient, each time I stared into the camera, I wondered who was looking back at me. Where does my image go and what can be done with it?

A company that stores your face data could keep it and pivot from venue admission to, say, law enforcement, or be acquired by a company that has an entirely different purpose than what you agreed to. This kind of misuse is largely hypothetical. However, you can’t always track where your face ends up: One company sold facial-recognition tech based on billions of images scraped from Facebook, LinkedIn and other sources.

Before consenting to use of biometric data,

Josef Kittler,

a professor of machine intelligence at the University of Surrey in the U.K., recommends finding out three things: the purpose of collecting your data, what happens to your face image once you no longer need the service, and how the data is deleted.

The conference’s organizers said attendees’ biometric tokens are encrypted and stored in Europe, though the data can be accessed from Hong Kong. The event’s privacy policy said the data is “securely destroyed” within 28 days of the event in accordance with the European Union’s data-privacy laws. A spokesman for GSMA told me the data will likely be deleted within three days of the event closing. ScanVis, GSMA’s tech partner, didn’t respond to my request for comment.

Protecting your biometric data

While you almost always have the ability to opt out of facial recognition, it could eventually come at a cost, said

Jennifer King,

a privacy and data-policy fellow at Stanford’s Institute for Human-Centered Artificial Intelligence. Think of how the cash lane at a toll stop is almost always far slower than the E-ZPass lanes.

Another issue, she said, is that the U.S. doesn’t have a federal law governing opt-out and nondiscrimination rights, the way the EU does. Not only are there laws in Europe, but there are also regulators empowered to enforce them, said Dr. King. Currently, only a smattering of states, including Illinois, Texas and California, have biometric-privacy rules.

In January, the New York attorney general launched a review into

Madison Square Garden Entertainment Corp.

, after the New York City venue used facial recognition to prevent attorneys from firms suing the company from attending concerts or sporting events. In late February, a pair of court rulings expanded the scope of an Illinois law governing companies’ use of biometric data, which includes face and retinal scans.

Face scanning will only become more prevalent in our travels and entertainment, as well as other areas such as education, banking and law enforcement. We’ve just begun to understand the pros and cons.

For more WSJ Technology analysis, reviews, advice and headlines, sign up for our weekly newsletter.

Write to Nicole Nguyen at [email protected]