By Mario Trujillo - 08/01/15 02:24 PM EDT
Facial recognition technology is becoming one of the nation’s great unknowns.
There are no laws that expressly regulate the software, nor is there data available on how much it is being used by American businesses to track customers and collect data.
“The privacy issues stakeholders have raised about facial recognition technology and other biometric technologies serve as yet another example of the need to adapt federal privacy law to reflect new technologies,” the GAO said.
The push for action came in the form of a new GAO report released Thursday and commissioned by Sen. Al FrankenAl FrankenDon’t let Congress legislate science The Hill's 12:30 Report Clinton’s 9 most likely VP picks MORE (D-Minn.) — a vocal privacy proponent who has called on Congress to develop a new framework.
But at least one former industry official told the GAO that comprehensive privacy reform in Congress does not appear likely any time soon. And a working group that the government formed to develop voluntary guidelines hit a roadblock last month when privacy advocates abandoned the talks.
Meanwhile, the technology is rapidly evolving, and according to the GAO, can even be more effective than the human eye in some respects. It has been used on social media, in retail stores and at casinos.
A GAO report on the FBI’s use of the technology will be out next year.
“I believe that all Americans have a fundamental right to privacy, which is why it’s important that, at the very least, the tech industry adopts strong, industry-wide standards for facial recognition technology,” Franken said. “But what we really need are federal standards that address facial recognition privacy by enhancing our consumer privacy framework.”
The GAO identified Google and Facebook as two companies that are already using facial recognition technology. Facebook uses the technology to help users tag friends in photos, while Google uses it to help users find photos and videos of themselves.
Google requires that you opt into the program, while Facebook automatically uses the feature unless people opt out. Both companies said they do not have any plans to share the information collected with a third party, aside from certain limited reasons like legal action.
Six other major social media companies did not use the technology, the report found.
The GAO also could not find facial recognition information about the five largest retail chains or the four largest casinos, though that does not necessarily mean they are not using it.
Digital ad signs in some retail stores also use facial recognition technology to detect age and gender for targeted marketing. The Digital Signage Federation has developed voluntary standards for the technology and said 28 members have certified they are abiding by them.
Privacy advocates have called for federal guidelines, but had also been working to develop voluntary rules as part of a National Telecommunications and Information Administration initiative. The thinking went that companies could voluntarily agree to the guidelines and the Federal Trade Commission (FTC) would be able to take enforcement action if the companies went back on them.
The talks are still ongoing, but nine privacy advocates walked away last month, mainly because of disagreement over whether companies should be required to get consent before using the technology.
“People deserve more protection than they are likely to get in this forum. Therefore, at this point, we choose to withdraw from further deliberations,” said the groups, which included the American Civil Liberties Union and the Electronic Frontier Foundation.
The FTC has recommended companies gain consent for facial recognition in some circumstances. It has also advised that companies provide clear notice when the technology is used to target demographic features, that companies set up a specific retention period, and that companies require consent if they want to share the data with a third-party.
Some advocacy organization has gone further, saying companies should not use the technology to determine demographic features of a person.
“Federal law does not expressly address the circumstances under which commercial entities can use facial recognition technology to identify or track individuals, or when consumer knowledge or consent should be required for the technology’s use,” the GAO concluded.