TSA face recognition: what the program does, from TSA's own pages

This page is part of the face recognition section and describes only what TSA and the Department of Homeland Security publish about the program. The distinction it rests on is explained on the 1:1 versus 1:N face recognition page.

01What does TSA's face recognition program do?

TSA describes the technology as "facial comparison" and defines its purpose narrowly: it "helps ensure the person standing at the checkpoint is the same person pictured on the identification document (ID) credential" (TSA factsheet). The unit that does this is CAT-2, a credential authentication scanner with a camera. TSA's biometrics page states that the approach "does not require a database of pre-staged images because it simply compares an image from the document presented by the passenger against an image taken of the passenger at the checkpoint" (TSA biometrics page).

The CAT part of the unit predates the camera. It authenticates the physical or digital ID, and it is linked to TSA's Secure Flight system so that the officer sees the traveller's flight and pre-screening status without a boarding pass. The 2020 privacy impact assessment describes the combined process: the unit authenticates the document, captures the document photo and biographic data, takes the live image, compares the two, checks the biographic data against Secure Flight, and displays the result to the officer, who directs the traveller to a lane (DHS/TSA/PIA-046(b)).

02Is the photo optional, and how does a traveller decline?

TSA's pages state that it is. The Digital ID page says "if you decide to decline the optional photo, notify the TSA officer before presenting your ID" and "you will not lose your place in line" (tsa.gov/digital-id). The factsheet says travellers "may decline the optional photo, without recourse, in favor of an alternative identity verification process", that signage at the camera informs travellers participation is voluntary, and that CAT-2 screens are being updated with language saying the photo may be declined. The FAQ on the same pages answers the direct question with "No. Facial comparison technology is voluntary."

The privacy impact assessment adds one condition the summary pages do not: a traveller who declines the photo "will still be required to place their identity document in the CAT-C for verification" against Secure Flight data. Declining removes the live photo and the comparison, not the document scan. The factsheet also states that "travelers under 18 are not photographed".

03What happens to the photo?

TSA's Digital ID page states that "your photo and personal data are deleted after your identity is verified" and that "images are not used for law enforcement, surveillance and not shared with other entities". The factsheet gives the exception: photos "are not stored or saved after a positive ID match has been made except in a limited testing environment for evaluation of the technology's effectiveness".

The 2020 assessment specifies the mechanism. In routine operation, "each passenger's PII collected from the identity document and photo will be overwritten when the next scan occurs, and when the TDC officer logs off" the device, which also logs off automatically after 30 minutes of inactivity. Secure Flight data sent to the unit is deleted "within 24 hours of the original flight departure time". For testing, TSA "may from time to time configure a small number of CAT-C devices for a short period of time to retain passenger data from the ID and photo for up to 24 months", with signs stating the retention period and the option of a manual check. Those are the published retention terms; this page does not state anything about how they are applied in practice because no fetched document does.

04How is this different from the 1:n program?

TSA runs two face programs and its biometrics page separates them. The CAT-2 program is 1:1: one live photo against one document photo. The second program is 1:n, described as comparing "a passenger's live image to a database of pre-enrolled reference photos" through CBP's Traveler Verification Service, for TSA PreCheck and Global Entry members who opt in during airline check-in. It began as a pilot at Detroit in March 2021 with one airline, extended to Atlanta in 2021 and 2022, and is now marketed as TSA PreCheck Touchless ID. The DHS publication page for PIA-046 records that on 28 March 2024 the department's Acquisition Review Board moved the program "from the 'pilot' phase to Full Operational Capacity", and that participating passengers "will no longer be required to scan their identity document" (DHS PIA-046 page).

The two programs carry different error vocabularies. A 1:1 comparison has a false match rate and a false non-match rate; a 1:n search has false positive and false negative identification rates, defined on this site's FMR, FNMR, FPIR and FNIR page. TSA's own 2020 assessment notes in a footnote that the agency "is realigning terminology to follow the National Institute of Standards and Technology's (NIST) usage of 'verification' (1:1 matching)".

05What does TSA say about accuracy?

TSA publishes no error rate for CAT-2 on its public pages. The factsheet states that TSA "uses facial comparison algorithms developed by top-performing vendors, as noted in NIST's ongoing evaluation" and is "committed to ensuring continued accuracy of these systems across all demographic groups"; it names no vendor and no figure. The NIST evaluation it refers to is the Face Recognition Technology Evaluation, whose 1:1 track reports FNMR at a fixed FMR for every submitted algorithm and is described on this site's NIST FRTE page. A vendor's rank there is a laboratory result on NIST's image sets, not a measurement of CAT-2 at a podium, in the same way that a cell in the cross-dataset detection grid is a result on a named test set and not on the internet.

The 2020 assessment treats image quality as a privacy risk rather than an accuracy figure: "there is a risk that TSA's cameras will be unable to capture images of a high enough quality to produce accurate matches", mitigated by sending any failed or errored comparison to the manual process. GAO's September 2020 review, which covered both CBP and TSA, found that TSA "has conducted pilot tests to assess the feasibility of using FRT but, given the limited nature of these tests, it is too early to fully assess TSA's compliance with privacy protection principles"; all five of its recommendations went to CBP (GAO-20-568). No later GAO figure for TSA was fetched for this page.

06How did the program develop?

The DHS publication page lists six versions of the privacy assessment: January 2018, August 2019, June 2020, January 2021, November 2023 and January 2026. TSA's biometrics page gives the operational sequence: CAT-2 demonstrated at Washington National in August 2020, field tests with volunteers at Washington National, Phoenix, Indianapolis and Miami, further pilots from 2022, and deployment of CAT-2 units from early 2022 to support mobile driver's licences. The factsheet's figure of approximately 350 airports with CAT-2 and the Digital ID page's figure of more than 250 airports accepting digital IDs are the two deployment counts TSA publishes; they count different things.

The consent model is the point of contact with the rest of this site. The face datasets described on the benchmark definition page and in the deepfake dataset timeline were mostly collected from the web without the subjects' knowledge; TSA's program, as published, asks each traveller at the podium and deletes the image at the next scan. Whether the published terms are met is a question for the auditors named in the assessment, not for this page.