Facial Recognition in the UK: No Law, No Limits, No Consent

There is no law in the United Kingdom specifically governing police use of facial recognition. Not one. Parliament has never voted on it. No legislation mentions it by name. For over a decade, British police have scanned millions of faces under a patchwork of guidance documents, common law interpretations, and data protection rules never designed for mass biometric surveillance.

In 2020, the Court of Appeal ruled police use of facial recognition was unlawful. The police kept using it. The government responded not by banning or restricting it, but by launching a consultation in December 2025 to expand it to all 43 police forces.

Welcome to the UK's approach to facial recognition: deploy first, legislate later, maybe.

The Numbers

0

Laws specifically governing police facial recognition ^[1]

7M+

Faces scanned by police in 2025 ^[2]

80%

Of Met Police wrongful flags targeted Black people ^[2]

43

Police forces planned to get facial recognition ^[3]

What Law Actually Exists

Instead of dedicated facial recognition legislation, UK police operate under a patchwork that the Home Office itself admits is "complicated, inflexible and difficult to understand." ^[1]

According to government documents, understanding the current legal framework requires reviewing: ^[1]

Police and Criminal Evidence Act (PACE) 1984
Human Rights Act 1998
Equality Act 2010
UK General Data Protection Regulation
Data Protection Act 2018
Surveillance Camera Code of Practice
College of Policing guidance documents
"A range of detailed legal or data protection documentation"

That's not a legal framework. That's a scavenger hunt.

What the Patchwork Covers

Here's what actually governs police facial recognition in the UK:

Source	What It Does	Limitations
Common Law	General police powers to prevent/detect crime	No specific guidance on biometrics
Human Rights Act	Article 8 privacy protections	Doesn't mention facial recognition
Data Protection Act 2018	Rules on processing personal data	Not designed for mass surveillance
Surveillance Camera Code	Voluntary guidance for camera use	Not legally binding for most uses
College of Policing Guidance	Operational procedures	Internal guidance, not law

Notice what's missing? Any actual legislation authorizing or restricting facial recognition. Police interpret existing laws to permit what they're already doing.

The Bridges Case: A Court Said It's Unlawful

On August 11, 2020, the Court of Appeal delivered a landmark ruling in R (Bridges) v Chief Constable of South Wales Police. ^[4]

Ed Bridges, supported by Liberty, challenged South Wales Police's use of facial recognition. The Court found their use was unlawful on multiple grounds:

What the Court Found

The Bridges Ruling (2020)

Article 8 violation: Use was not "in accordance with law" because the legal framework has "fundamental deficiencies" leaving too much discretion to individual officers
Data protection failure: The Data Protection Impact Assessment failed to properly assess risks to rights and freedoms
Equality duty breach: Police failed to investigate whether the software had racial or sex bias
Excessive discretion: No clear criteria for who goes on watchlists or where cameras can be deployed

The ruling established that police facial recognition, as deployed, was unlawful. South Wales Police said they "welcomed the judgment" and wouldn't appeal. ^[5]

Five years later, police have scanned over 7 million faces. The government wants to give all 43 forces access to the technology. The "fundamental deficiencies" remain unfixed.

Current Police Guidance

After Bridges, the College of Policing issued "Authorised Professional Practice" guidance. It's not law, it's operational guidance for forces that choose to follow it. ^[1]

What the Guidance Says

Image retention: Images of non-matched individuals must be deleted within 31 days
Watchlist images: May be retained for up to 12 months
Watchlist categories: Wanted individuals, suspects, missing or vulnerable persons
Purpose requirement: Deployments must be for a policing purpose and be necessary, proportionate, and fair

What the Guidance Doesn't Say

Where cameras can be deployed
How to define "vulnerable" (police decide)
How to prevent racial bias
What happens when guidance is ignored
How citizens can challenge being scanned

Guidance without enforcement isn't regulation. It's suggestion.

The December 2025 Consultation

On December 4, 2025, the Home Office launched a 10-week consultation on a "new legal framework" for facial recognition. ^[3]

This sounds like progress. It isn't. The consultation isn't asking whether to expand facial recognition, it's asking how.

What the Government Wants

Legal framework for all 43 police forces to use facial recognition
National face-matching database using passport and driving license photos
Framework for "other biometric and inferential technologies", including emotion detection, voice recognition, and gait analysis
Single regulatory body for oversight

What the Government Doesn't Want

A ban (like the EU implemented)
Warrant requirements (like Montana and Utah require)
Strict limitation to serious crimes
Independent judicial authorization before deployment

Policing Minister Sarah Jones called facial recognition "the biggest breakthrough for catching criminals since DNA matching." ^[3] She didn't mention that DNA use is "very carefully controlled under several acts of Parliament with clear rules, reporting obligations and layers of independent oversight." Facial recognition has none of that.

How the UK Compares

vs. the European Union

The EU's AI Act, effective February 2025, bans real-time facial recognition in public spaces. ^[6] Exceptions exist for serious crimes but require judicial authorization and fundamental rights impact assessments. Violations cost €35 million or 7% of global revenue.

The UK looked at Brexit and decided EU privacy protections were optional.

vs. the United States

The US has no federal law either, but:

15 states have some form of restriction
16+ cities have bans
Montana and Utah require warrants
Illinois's BIPA has produced billion-dollar settlements
San Francisco banned government use entirely in 2019

The UK has fewer protections than several US states, and the US is considered a regulatory laggard.

vs. China

Even China now requires businesses to justify facial recognition necessity, prohibits use in hotel rooms and bathrooms, and mandates encryption of biometric data. ^[7]

The UK has no such requirements.

Current Deployments

As of December 2025, facial recognition is actively deployed by: ^[2]

Force	Faces Scanned (2025)	Status
Metropolitan Police (London)	~3.51 million	Permanent installations in Croydon
South Wales Police	~1.84 million	Active since 2017
Essex Police	~1.18 million	Active
Merseyside Police	Launched December 15, 2025	New deployment
Suffolk Police	47,000 (single deployment)	Borrowed vans from Essex

Seven more forces, Greater Manchester, West Yorkshire, Surrey, Sussex, Bedfordshire, Thames Valley, and Hampshire, are acquiring their own systems. ^[2]

Oversight Bodies

The UK has multiple bodies that technically provide oversight. In practice, none have stopped the expansion.

Information Commissioner's Office (ICO)

Regulates data protection compliance
Issues guidance on video surveillance
Has enforcement powers but rarely uses them against police
Did not prevent any current deployments

Biometrics Commissioner

Francesca Whitelaw KC appointed interim commissioner July 2025
Reviews how police use biometric technologies
Advisory role, limited enforcement power
Position was vacant for extended periods

Surveillance Camera Commissioner

Oversees Surveillance Camera Code of Practice
The code is voluntary for most uses
Cannot compel compliance

Multiple oversight bodies, zero actual restrictions on deployment.

The Racial Bias Problem

The Bridges court specifically found South Wales Police failed to investigate racial and sex bias. Five years later, the data shows why this matters. ^[2]

80% of people wrongly flagged by Metropolitan Police facial recognition were Black.

This isn't a glitch. Facial recognition systems consistently perform worse on darker skin tones. The technology's racial bias has been documented since at least 2018 by MIT and NIST studies.

The government's consultation mentions "testing and accuracy standards." It doesn't mandate them. It doesn't require independent bias auditing. It doesn't specify consequences for biased systems.

What Would Real Regulation Look Like?

If the UK wanted to actually regulate facial recognition, here's what other jurisdictions require:

From the EU AI Act

General ban on real-time facial recognition in public spaces
Exceptions only for serious crimes with judicial authorization
Mandatory fundamental rights impact assessment
€35 million fines for violations

From US States

Warrant requirement before use (Montana, Utah)
"Sole basis" prohibition, can't arrest based only on facial recognition (7 states)
Notice requirements, defendants told when FR used (5 states)
Serious crime limitations (6 states)
Testing and accuracy standards (Colorado, Virginia)

From Liberty's Recommendations

Independent approval before any deployment
Use limited to imminent threats, missing persons, serious offenses
Mandatory 14-day public warning before deployment
Clear legal boundaries on watchlist criteria

The Home Office consultation includes none of these as requirements. They're asking whether to consider some of them as options.

What You Can Do

Respond to the Consultation

The Home Office consultation closes February 12, 2026. Your response becomes part of the public record.

Contact Your MP

Parliament will eventually vote on facial recognition legislation. Find your MP at members.parliament.uk.

Support Legal Challenges

Big Brother Watch and Liberty are funding court cases that establish precedent. The Equality and Human Rights Commission has intervened in current litigation.

Know Your Rights

You're not required to identify yourself unless arrested
You can walk past LFR cameras
You can file ICO complaints
You can request data subject access under UK GDPR

The Bottom Line

The UK has no facial recognition law. A court ruled police use unlawful in 2020, and nothing changed. Over 7 million faces were scanned in 2025 alone. The government's response is to propose expanding the technology to all police forces, adding emotion detection, and building a national face database from passport photos.

The EU banned it. US states require warrants. Even China now mandates consent for commercial use.

Britain? Parliament hasn't even voted on it. And the consultation isn't asking whether to expand surveillance, just how fast.