Decode Civils CAShorts
ExplainerSci-TechPrelimsGS3

Facial recognition technology: how it works and India's privacy law

By CAShorts DeskPublished Updated Sources: NITI Aayog discussion paper (2022); PIB (Civil Aviation, Home Affairs, Electronics and IT ministries); DPDP Act, 2023; Supreme Court Observer; The Indian Express Explained

Why in news: A social media post of 11 October 2026 suggested makeup could dodge facial recognition cameras; a 13 October explainer tested that claim against research.

Facial recognition technology: how it works and India's privacy law
Illustration (AI-generated)

Facial recognition technology (FRT) is an artificial intelligence system that detects a face, converts its features into a numerical template and matches it against stored images, either to verify one person or to identify someone among many. India uses it in Digi Yatra airport boarding and in policing. Whether makeup can fool it was debated in October 2026.

Syllabus: Prelims · Polity & Governance; GS3 · Science & Technology; GS3 · IT, Space, Biotech & IPR

Why this matters for UPSC

GS3 science and technology and GS2 governance: Prelims can ask how FRT works, 1:1 versus 1:N, Digi Yatra's ministry and DPDP Act provisions; Mains can ask about State surveillance and privacy under the Puttaswamy tests.

In short

Facial recognition technology (FRT) is an artificial intelligence system that verifies or identifies people by matching faces with stored images, pitting convenience and security against privacy.

How FRT matches a faceFacial detectionFeature extractionGallery matching1:1 verification or1:N identification

Consent-based 1:1 verification is the safer path; police 1:N searches need a dedicated statute, independent audits and proportionality review first.

Why it matters

A traveller who chooses Digi Yatra walks through airport gates by showing a face instead of a boarding pass and identity card, and knows the camera is checking. A person filmed in a crowd may be searched against a police database without knowing it. In a one-to-many search, a wrong match can put suspicion on an innocent person, and the errors do not fall evenly across groups. The DPDP Act gives people the right to consent and to correct their data, but its section 17 exempts crime-related processing and contains no dedicated rules on watchlists, matching thresholds, audits or retention for police FRT. That leaves the Puttaswamy tests as the main check on how the State uses a person's face.

Prelims pointers

  • 1:1 verification matches a live face with one stored image (phone unlocking, Digi Yatra gates); 1:N identification searches many faces for one person (surveillance).
  • Face embedding: the numerical representation of a face; disguise can change it enough to block a match while the system still detects a face.
  • Justice K.S. Puttaswamy v. Union of India (2017): privacy is an intrinsic part of life and personal liberty under Article 21 and the freedoms of Part III.
  • Proportionality, four parts: a legitimate goal, a suitable means, the least restrictive effective alternative, and no disproportionate impact on the right holder.
  • DPDP Act, 2023, section 6: consent must be free, specific, informed, unconditional and unambiguous, and can be withdrawn as easily as given.
  • DPDP Act, section 7 (legitimate uses): the State may process data without fresh consent to provide a subsidy, benefit, service, certificate, licence or permit.
  • DPDP Act, section 17: processing for preventing, detecting, investigating or prosecuting offences is exempt from most obligations; the Central Government may exempt notified State instrumentalities.
  • Data Protection Board of India: a body corporate under section 18 of the DPDP Act; four members under the 2025 Rules; appeals go to TDSAT.

Practise a UPSC-style question

With reference to facial recognition technology (FRT), consider the following statements:

1. Facial detection, the first stage of FRT, matches a face against a gallery dataset to establish whose face it is.

2. A 1:N system searches many captured faces to identify one particular person and is typical of surveillance uses.

Which of the statements given above is/are correct?

  1. (a) 1 only
  2. (b) 2 only
  3. (c) Both 1 and 2
  4. (d) Neither 1 nor 2
Show the answer

Answer: (b) 2 only

1 is incorrect: facial detection only finds that a face is present in an image; matching against a gallery dataset is the later recognition stage. 2 is correct: 1:N (one-to-many) systems identify a person among many faces and are used in live surveillance and law enforcement.

More Explainers

All Explainers

More Sci-Tech current affairs