UK Home Office Live Facial Recognition DPIA [2026]

Update: Home Office Moves Facial Recognition Into Delivery Phase

Update — November 4, 2026: The Guardian reported today, drawing on documents first uncovered by Liberty Investigates, that the Home Office is preparing live facial recognition at transport hubs and public events for "general immigration enforcement", including non-criminal immigration offences. The guidance published on October 8 and the DPIA suggest watchlists could include people who overstayed a visa or entered without leave, which are civil rather than criminal matters, and say no one under 18 will be listed. The project "has now moved into the formal delivery phase", and the Home Office said it is "considering further trials". It declined to explain what "events" or "sensitive" locations mean. The biometrics and surveillance camera commissioner, William Webster, said he was not consulted and that immigration use falls outside his remit. Separately, the Home Office announced a new law and an independent oversight body able to pause police deployments; see our breakdown of the UK police facial recognition law and oversight plan. Whether that pause power will reach immigration deployments has not been stated.

The UK Home Office has published the live facial recognition DPIA behind Immigration Enforcement's use of face scanning in public places. The document went up on GOV.UK on October 22, 2026 as a 62-page PDF, and Biometric Update's October 23 report pulled out the passages that matter: an explicit admission that the technology interferes with private life, a promise of automatic deletion for people who do not match, and a rule that humans must verify every alert.

Days earlier, on October 13, the Home Office had set out how the scheme will operate. Together the two documents are the clearest public statement yet of how the UK government intends to scan faces at transport hubs and events. If you travel in the UK, publish video of public places, or simply want to know what happens to your face when a camera sees it, here is what the documents say, what they leave open, and what you can do.

Update — October 30, 2026: Police Reform Bill framework and more force deployments: see the UK live facial recognition rollout.

Update — October 24, 2026: The Met also plans permanent live facial recognition cameras on London's Oxford Street, likely from November. See Oxford Street live facial recognition cameras.

Update: Open Rights Group Report on Home Office AI

Update — October 27, 2026: A new report by Open Rights Group, titled Automated Discrimination: Unpacking the Digital Hostile Environment, says AI is now embedded across the Home Office in near-total secrecy, according to The Guardian. Besides border surveillance through live facial recognition, AI-powered drones and satellites, the report lists AI in sham-marriage detection, assessing asylum seekers' ages, searching the contents of new arrivals' phones, summarising asylum interviews and prioritising cases through a tool called Ipic. ORG says officials routinely invoke national security to refuse freedom of information requests, and it calls for a public register of government AI tools, a narrower definition of national security and regulation of AI, including a ban on uses it calls undemocratic or rights-violating. The report has cross-party backing from MPs Bell Ribeiro-Addy, Pete Wishart and Siân Berry. A Home Office spokesperson said AI "does not replace or automate the role of human decision-makers" and that the tools "cannot be used in isolation and do not make decisions on claims", adding that the department has committed to publishing updated evaluations of their rollout. The report's claims are ORG's; the DPIA discussed below remains the only primary Home Office document on the facial recognition element. Related: Facewatch Live and retail facial recognition.

What Is a DPIA and Why Does Its Publication Matter?

A data protection impact assessment is a risk document that UK GDPR requires before processing that is likely to be high risk, and live facial recognition plainly is. According to GOV.UK, this DPIA "details the steps taken by Immigration Enforcement to evaluate and reduce the data protection risks of live facial recognition, fulfilling UK GDPR accountability requirements and demonstrating compliance." It is described as a redraft of the template prepared for the live facial recognition proof of concept.

Publishing it matters for two reasons. First, DPIAs are usually internal, so a published one lets lawyers, journalists and campaigners test the claims line by line. Second, the language the Home Office chose becomes the standard it will be held to in complaints and court challenges. Our guide to UK GDPR and video privacy explains the accountability duties that sit behind a document like this.

What does the DPIA say about privacy rights?

It concedes the central point. Biometric Update quotes the DPIA as saying live facial recognition "constitutes an interference with the private life rights" of people whose facial images are processed. The assessment then argues the interference is limited in scope and duration and is mitigated by "immediate and automatic deletion" of data for people who generate no alert.

That is a notable framing. Rather than claiming faces in public are not private, the Home Office accepts an interference and argues it is justified. The justification rests on a legal aim, such as fighting crime or enforcing immigration policy, "where strict safeguards are in place," and on use being restricted to cases where people are lawfully sought and "cannot reasonably be identified or located through less intrusive means." Deployments must also be proportionate.

How Will Immigration Enforcement Use Live Facial Recognition?

At transport hubs, along travel routes and at events, with watchlists tied to a defined purpose. Biometric Update's October 13 report on the rules says the policy covers operations beyond ports of entry, including joint deployments with police, and governs watchlists, deployment locations, human oversight and matching thresholds.

Key rules reported:

• Watchlists must link to a defined deployment objective, location and context, be time-limited and proportional, and rest on a completed necessity and proportionality assessment.
• Overt use. Deployments are overt, and advance notice may be withheld only in exceptional, justified and recorded cases, with publication and scrutiny afterward.
• Human decisions. Any engagement or enforcement action is a human decision.
• Deletion. Images of people who do not generate an alert are "automatically and permanently deleted."
• Governance. IE's Emerging Technology Team provides senior internal oversight, and higher-risk deployments need additional oversight.
• Police links. IE may supply watchlists to police facial recognition systems or process police-supplied data on its own systems.

That last point deserves a second look. Shared watchlists and joint operations mean the safeguards in one agency's document travel only as far as the next agency chooses to honor them. Compare the police trial we covered in Western Australia's live facial recognition results, where headline error figures hid important context.

How Accurate Is the System, and What Does 0.64 Mean?

The guidance says Immigration Enforcement will use a matching threshold of 0.64, and it points to testing that is five years old. It states: "IE will continue to use a threshold of 0.64 for IE-led deployments using approved and objectively tested technology." Operational experience, it says, suggests a false alert rate of 0.1% or lower in most scenarios, meaning fewer than one false alert per 1,000 comparisons.

The guidance cites 2021 testing by South Wales Police and the Metropolitan Police Service, including a report on the NEC system used by NPCC police forces. The DPIA names NEC as an example of Home Office-verified systems. The same testing, according to the report, found the system was more likely to recognize watchlist subjects as age increased.

Is a 0.1% false alert rate actually low?

It depends on the denominator, and this is the part the headline number hides. A rate of one false alert per 1,000 comparisons sounds tiny, but a busy station can run hundreds of thousands of comparisons a day, so even a small rate produces real people stopped in error. The more useful question is the share of alerts that are wrong, not the share of all faces scanned. We walked through that arithmetic in the WA trial breakdown.

Earlier Biometric Update coverage listed in the report notes a January 12, 2026 headline that the UK proof of concept produced "no false alerts," and a February 24, 2026 headline about a trial resuming at Holyhead. The pages provide no more detail than headlines, so treat those as pointers to check rather than evidence.

What about demographic bias?

The DPIA includes a risk table covering misidentification, human error, demographic bias and retention practices, according to Biometric Update. Mitigations include using only Home Office-verified systems, human review and secondary identity checks, public engagement before deployment, strict scope control and technical measures. The reported text we reviewed does not give bias figures, so the public cannot yet judge from the summary whether the mitigations are enough. The full PDF is the place to read the risk table.

Does Human Review Make Facial Recognition Safe?

It helps, but it is not a guarantee. The DPIA states "the technology does not make enforcement decisions," and that all alerts require human review and verification before any action. This is the standard safeguard in nearly every live facial recognition deployment, and its weakness is well known: an officer shown a confident match on a screen may defer to the machine.

Questions worth asking of any deployment, including this one:

1. What training do reviewing officers get, and how often do they overrule an alert?
2. Are overrule and false-match numbers published after each deployment?
3. What happens to the data of people who are stopped and cleared?
4. Who audits the watchlists, and how are people removed from them?
5. Can a person who was stopped challenge the match and see the basis for it?

Is Live Facial Recognition Legal in the UK?

The documents rely on existing data protection and human rights principles rather than a dedicated statute. The DPIA grounds its justification in UK GDPR accountability, necessity and proportionality. That is why the proportionality assessments and published DPIAs carry so much weight: they are the legal scaffolding.

Other regulators have taken harder lines on biometric processing. See our coverage of the UK ICO's Clearview AI Court of Appeal case, and how the EU's rules treat archives in our post on the EU AI Act and retrospective facial recognition of CCTV. In France, police use of social media images after riots raised related questions, covered in our France facial recognition and riots post.

What Can You Control When the State Scans Faces?

Not the cameras, but you control the footage and photos you publish. A face you post is a face anyone can scrape, search and match, including face search engines and law enforcement tools. Public video of a station, a protest or a street scene can add unwitting bystanders to that pool.

How BGBlur fits

BGBlur is a browser-based tool that detects faces in video and photos and blurs them with motion tracking, so a face stays covered as people move. You upload, review the detected faces, choose which to blur and export. It has a free tier with short clips and a 720p export, and paid tiers raise limits. Our guide to blurring faces in photos and video with AI walks through it, and the GDPR video compliance guide covers when you must do it.

Caveats are real. Blurring does not stop a camera operated by the Home Office or police from scanning you in person. It does not remove you from anyone else's footage. And a weak blur can sometimes be reversed, so use a strong, opaque setting and check the result frame by frame.

What Should You Do Today?

1. Read the primary document. Open the DPIA on GOV.UK and find the risk table and the retention section.
2. Look for signage. The guidance says deployments are overt. If you see a notice at a station, you can note where and when.
3. Ask for your data. Under UK GDPR you can make a subject access request to ask whether your image was retained. Non-matches are supposed to be deleted, so a confirmed record deserves a challenge.
4. Raise concerns with the regulator. The Information Commissioner's Office takes complaints about biometric processing.
5. Contact your MP if you want a statutory framework instead of guidance.
6. Blur faces before you publish video of crowds, transport hubs or events, especially where children are present.
7. Keep a record if you are stopped after an alert: time, place, officers, what basis was given.

What Does the DPIA Change, and What Stays Open?

The publication is a genuine transparency step, and it hands critics a text to hold the Home Office to. It concedes interference with private life, promises deletion for non-matches, bars the system from making enforcement decisions, and ties watchlists to time-limited, proportionate purposes. Those are concrete, checkable commitments.

What remains open is whether the safeguards work in practice. The accuracy evidence cited is from 2021, the public summary gives no bias numbers, watchlists can be shared with police systems, and human review depends on people. The coming deployments, and any published results, will show whether the document describes reality.

For individuals, the lesson mirrors the Flock stories we have been tracking, including the Indiana officer arrested for misusing plate searches: surveillance systems are only as accountable as the audits behind them. You cannot audit a government camera yourself, but you can control your own footage. When you share video of public places, blur faces with BGBlur first, review the export, and keep the original private. We will update this post when deployment results or challenges are published.