ICE face recognition: what DHS records, GAO and courts document

This page belongs to the face recognition section. It reads primary documents only, each with its date, and sits beside the page on audits of federal law enforcement use, which covers the other agencies GAO reviewed.

01Which official records describe ICE face recognition?

Four documents are read here. Each answers a different question, and none reports how often an ICE search returned a wrong candidate.

An assessment describes intended practice, a GAO audit tests practice against records, a threshold analysis is a short screen, and a complaint states allegations, not findings.

02What does the 2020 privacy impact assessment say HSI does?

DHS/ICE/PIA-054 covers one use: HSI, the investigative arm of ICE, submits images to "government agencies and commercial vendors" that compare them against their own galleries and return lists of candidates (DHS publication page, May 2020). ICE runs no matching algorithm of its own under this document. The stated purposes include identifying victims of child exploitation and human trafficking.

The assessment sets rules for results. HSI "does not take enforcement action against any individual solely based on candidate images", and a lead "will never be the sole basis used to establish probable cause, determine wrongdoing, or deny a benefit" (PIA-054 PDF). Agents request a candidate list, with a default length such as 20, not a single answer. An HSI systems unit evaluates each service before approval, using resources such as the NIST Face Recognition Vendor Test, but those evaluations "will not add weight to an FRS's returns".

Some vendor galleries hold images "obtained by 'scraping' internet websites"; what regulators ruled about scraped face databases is on its own page.

03What did GAO find about HSI in 2023?

GAO-23-105607 examined seven DHS and DOJ agencies. HSI officials told GAO that within ICE only HSI had used the commercial service in the review for criminal investigations, and that "ICE has not used this service in immigration law enforcement or removal operations" (GAO-23-105607, September 2023). The report attributes that statement to HSI officials.

On training, HSI had a rule: an ICE memorandum of 15 January 2021 required a course of about three and a half hours before staff used such services. GAO matched training records to search logs for 4 March 2021 to 31 March 2022 and found 106 staff who searched. Ninety-one had completed all training first and ran 2,120 searches; 15 had not and ran 569 of the 2,689 searches, or 21 percent. Eleven of the 15 finished later; four had not by 31 March 2022. GAO closed its training recommendation in June 2024 after ICE set up "a process for HSI to ensure that only trained staff can receive access".

On privacy review, GAO found that HSI and the FBI completed some requirements "after they had already begun to use the services".

04What does the 2025 Mobile Fortify privacy threshold analysis say?

This analysis describes a different tool from PIA-054: a mobile app developed by CBP for ICE agents and officers to verify identity "through facial recognition or contactless fingerprint matching". An officer photographs a person; the photo goes to CBP's Traveler Verification Service and to a gallery of people for whom CBP holds derogatory information. If there is no match, the officer may take contactless fingerprints. The airport page describes the Traveler Verification Service in its border setting.

The document, as released with law enforcement exemptions redacted, states several choices plainly. "Every new photograph or fingerprint, regardless of match, is an encounter and stored and retained in ATS for 15 years", ATS being CBP's Automated Targeting System. "ICE does not provide the opportunity for individuals to decline or consent." The form answers "No" to whether individuals receive a privacy notice. It acknowledges that a photo "could be that of someone other than an alien", including a US citizen or lawful permanent resident.

The privacy offices' finding is mixed. They find the app "privacy sensitive and requires a Privacy Impact Assessment and a System of Records Notice", and in the same adjudication conclude that existing assessments are sufficient. The form was submitted on 20 February 2025 and approved on 12 May 2025, expiring 12 May 2028. The DHS page listing ICE privacy documents, last updated 13 February 2024 by its own footer, carries PIA-054 and no entry for this app.

05What does the January 2026 complaint allege?

On 12 January 2026 the State of Illinois and the City of Chicago filed a 103-page complaint in the Northern District of Illinois against DHS, ICE, CBP and Border Patrol and officials in their official capacities (case 1:26-cv-00321, complaint). Its paragraphs on the app allege that DHS "launched Mobile Fortify on or around June 2025", used it "over 100,000 times" since launch, and retains photos and fingerprints, "including that of U.S. citizens, for 15 years". It pleads that this use "is not authorized by statute" and is arbitrary and capricious. These are allegations.

06Why do the documents give different dates and counts?

The analysis lists a launch date of 25 March 2025; the complaint says "on or around June 2025". GAO counts staff and searches of one service in a stated 13-month window; the complaint counts uses of one app since launch; neither counts the other's population. The 15-year retention period appears in both the analysis and the complaint.

07What do these records not say?

They give no error rate for ICE searches. PIA-054 states that accuracy depends on the algorithm and the image, noting that unconstrained photos, such as those from surveillance or social media, "are at a greater risk for inaccurate matches", but it reports no measurement. GAO counted training and searches, not false candidates. The complaint alleges practice and measures none. Algorithm-level figures come from NIST, summarised on the demographic differentials page; the privacy rules page covers the legal side.