Law enforcement face recognition: what official audits and reports found

This page is part of the face recognition section and sits next to the page on face datasets and consent, which covers where the enrolled photographs come from. Here the question is narrower: what have auditors and courts actually found about police use, and on what dates.

01Who audits law enforcement face recognition?

In the United States the GAO reports to Congress and publishes its findings with a recommendation status that it updates for years afterwards. In England and Wales the courts have ruled on a specific deployment under the Human Rights Act, data protection law and the public sector equality duty. NIST does not audit agencies; it tests algorithms on datasets that include law enforcement photographs and publishes the error rates. Each answers a different question, so the findings below are kept apart and dated. Vendor accuracy claims, press accounts of individual arrests and unpublished police statistics are absent because they cannot be checked against a primary document.

02What did the GAO find in 2021?

GAO-21-518, published 3 June 2021 and released publicly on 29 June 2021, surveyed 42 federal agencies that employ law enforcement officers. Twenty reported owning a face recognition system or using one owned by another entity, 15 reported using non-federal systems, six reported using the technology on images of the protests of May 2020, and three on images of the events at the United States Capitol on 6 January 2021 (GAO-21-518). The finding that drove its recommendations: "All fourteen agencies that reported using the technology to support criminal investigations also reported using systems owned by non-federal entities. However, only one has awareness of what non-federal systems are used by employees." GAO made two recommendations to each of 13 agencies, to track non-federal systems and to assess their privacy and accuracy risks; the status page lists most as implemented between 2021 and 2025, four as closed because the agency stopped using such systems, and five as open or partially addressed as of March 2026.

GAO-21-526, published 24 August 2021, asked a different population, the 24 agencies covered by the Chief Financial Officers Act, about fiscal year 2020. Eighteen reported using face recognition for some purpose; 16 for digital access such as unlocking agency phones, six "to generate leads in criminal investigations, such as identifying a person of interest, by comparing their image against mugshots", five for physical security, and ten planned to expand use through fiscal year 2023 (GAO-21-526). The two reports are not additive: one counts agencies with law enforcement officers, the other the largest departments.

03What did the GAO find in 2023?

GAO-23-105607, published 5 September 2023, examined seven law enforcement agencies in the Departments of Homeland Security and Justice that used commercial or nonprofit face recognition services between October 2019 and March 2022. "All seven agencies initially used these services without requiring staff take facial recognition training," and the six with usable data "cumulatively conducted about 60,000 searches when they did not have training requirements in place" (GAO-23-105607). At the FBI, where training was described internally as required but applied as a best practice, "only 10 staff completed facial recognition training of 196 staff that accessed the service". Three of the seven agencies had policies specific to face recognition that addressed civil rights and civil liberties; four did not.

GAO made ten recommendations and the agencies concurred with all of them. By the status page's account, the FBI issued a face recognition policy directive in December 2023 that requires training following Facial Identification Scientific Working Group guidance, the Department of Justice issued an interim policy in December 2023, and two Department of Justice privacy recommendations remained open as of January 2026. The page on Clearview AI rulings covers the regulators' decisions about one of the services these agencies used.

04What did the Court of Appeal find about live facial recognition?

On 11 August 2020 the Court of Appeal of England and Wales ruled on South Wales Police's use of a live facial recognition system it called AFR Locate, deployed at a shopping street in December 2017 and at an arena in March 2018. The judgment records the scale: "Over the 50 deployments that were undertaken in 2017 and 2018, around 500,000 faces may have been scanned," and "the overwhelming majority of persons whose biometrics are captured and processed by SWP using AFR Locate are not suspects" (Court of Appeal judgment). The appeal was allowed on three of five grounds. The use was "not in accordance with the law" under Article 8 of the European Convention because the framework left "too much discretion" to individual officers over who went on a watchlist and where the system was deployed; the data protection impact assessment was deficient; and the force had not met the public sector equality duty.

The equality finding is the one that bears on benchmarks. The court wrote that the force had "never sought to satisfy themselves" that "the software program in this case does not have an unacceptable bias on grounds of race or sex", noting evidence that face recognition programs "can sometimes have such a bias". The court did not find that the system was biased; it found that nobody had checked. The judgment also records that the matching threshold "is generally suggested by the manufacturer" and that most systems let the user change it, which is why a deployment's false alert rate is a property of the setting, not of the algorithm alone.

05What has NIST measured on law enforcement images?

NIST's demographic effects report (NISTIR 8280, 19 December 2019) ran 189 algorithms from 99 developers over 18.27 million images of 8.49 million people, and states that "All four datasets were collected for authorized travel, immigration or law enforcement processes"; one of them is a set of domestic mugshots (NISTIR 8280). Its headline is that "false positives rates often vary by factors of 10 to beyond 100 times" across demographic groups, while "false negatives tend to be more algorithm-specific, and vary often by factors below 3". On the mugshot set specifically, "false negatives are higher in Asian and American Indian individuals". The report also notes that for one-to-many search, the mode police use, "some developers supplied highly accurate identification algorithms for which false positive differentials are undetectable". The demographic differentials page and the NISTIR 8280 report explainer give the full findings.

The ongoing NIST FRTE 1:N track reports a false negative identification rate "at the threshold that limits the False Positive Identification Rate (FPIR) to 0.003", with 713 algorithms from 224 developers since 2018 (NIST FRTE 1:N). Those are laboratory numbers on enrolled galleries of one image per person. A police search against a gallery of unknown size, with a probe cropped from surveillance video, is not that test.

06What do these documents not say?

They do not give an error rate for police use. GAO counted agencies, searches and training records, not false matches. The Court of Appeal ruled on legality and process, not on how often the system alerted on the wrong person; the judgment describes the threshold mechanism but reports no measured rate for the deployments at issue. NIST measured algorithms on still photographs at fixed thresholds and did not test any force's deployed configuration or its operators. A statement that police face recognition is "x percent accurate" therefore has no primary source in these documents, and this site does not carry one.

What they do establish is a checklist. Is the system tracked by the agency that uses it (GAO, 2021: one of fourteen could say). Are the operators trained (GAO, 2023: 10 of 196 at one agency). Is the watchlist and the deployment location constrained by a rule (Court of Appeal, 2020: no). Has anyone tested the algorithm for demographic differentials at the threshold in use (Court of Appeal, 2020: no; NIST, 2019: differentials of 10 to 100 times exist in many algorithms). A candidate match from a police system is a lead that the page on checking a face video would place alongside other evidence, not above it.