Your Face Is Your Ticket: An Uncanny Convenience

No one scanned the digital pass on my phone to gain entry to this year’s MWC, the annual tech trade show formerly known as Mobile World Congress. Facial recognition software did all the work.

Your face can also be an admission ticket to a location near you. Delta Airlines Inc.,

United Airlines Holdings Inc.

and JetBlue Airways Corp.

have installed ticketless boarding face scanning systems at several airports. This season, all Mets fans will be able to use facial recognition express lanes previously reserved for season ticket holders. Scary? Cool? Based on my recent brush with the technology, it’s both.

With facial recognition access points popping up in more public places, including airports and concert halls, you may be wondering how that should make you feel.

Companies implementing face-matching software strive for speed, convenience, security and contactless benefits for customers. Most also emphasize that it is only an option. Meanwhile, lawmakers in several U.S. states are trying to tighten regulations around the use of this kind of technology, citing privacy concerns and allegations of bias. Research has shown that the technology isn’t as accurate for people of color and women in general.

At this year’s MWC trade show in Barcelona, ​​participants gained entry by standing in front of cameras equipped with facial recognition software. Angel Garcia/Bloomberg; Maurizio Martorana FOR THE WALL STREET JOURNAL

While the answer comes down to the individual, it helps if you know the company providing the service and the expected benefits: Do you want this company to store your biometric information? Do you get something useful in return? It also depends on where you are, as local laws affect the extent to which facial recognition can be used and data collected.

Capture your faceprint

Face recognition works by creating a map of your face. The card contains your unique measurements: the distance between your forehead and chin, or between your eyes. These statistics are then converted into code called a biometric token or faceprint.

It’s how your iPhone’s Face ID identifies you, how Google Photos can group photos of your kids, or how Amazon.com from Inc

Astro robot can distinguish relatives from burglars. The tokens are not shared between different services – each uses its own unique, non-transferable token for you.

GSMA, the industry group that organizes MWC and represents mobile network operators around the world, used a facial recognition service called Breez, developed with ScanVis Ltd., a Hong Kong-based company. The service compares the faces of attendees to previously submitted photos of government-issued IDs.

Breez entry is optional, but I chose it for speed. Prior to the event, non-Breez participants could wait several days to confirm their registration. Logging in with the MWC app — which used my phone’s camera to match my face to the image on my passport — took less than a minute.

How secure is my data?

While the conference face-scanning jobs certainly came in handy, every time I stared into the camera I wondered who was looking back at me. Where is my image and what can it do with it?

A company that stores your facial data may keep it and move it from location access to, say, law enforcement, or be acquired by a company that has a very different purpose than you agreed to. This kind of abuse is largely hypothetical. However, you can’t always keep track of where your face ends up: One company sold facial recognition technology based on billions of images scraped from Facebook, LinkedIn and other sources.

Before giving permission for biometric data to be used, Josef Kittler, a professor of machine intelligence at the University of Surrey in the UK, recommends finding out three things: the purpose of collecting your data, what is happens to your face image when you use the service and how the data is deleted.

Conference organizers said attendees’ biometric tokens are encrypted and stored in Europe, although the data can be accessed from Hong Kong. According to the event’s privacy policy, data will be “securely destroyed” within 28 days of the event in accordance with European Union data privacy laws. A GSMA spokesperson told me the data will likely be deleted within three days of the event closing. ScanVis, GSMA’s technical partner, did not respond to my request for comment.

Protection of your biometric data

While you almost always have the option to turn off facial recognition, this can ultimately come at a cost, says Jennifer King, a privacy and data policy associate at Stanford’s Institute for Human-Centered Artificial Intelligence. Think about how the cash lane at a toll stop is almost always much slower than the E-ZPass lanes.

Another problem, she said, is that the US has no federal law governing opt-out and non-discrimination rights, as the EU does. Not only are there laws in Europe, but there are regulators who are empowered to enforce them, said Dr. King. Currently, only a few states, including Illinois, Texas, and California, have biometric privacy regulations.

In January, the New York Attorney General launched an investigation into Madison Square Garden Entertainment Corp.

, after the New York City venue used facial recognition to prevent firm lawyers from suing the company for attending concerts or sporting events. In late February, a pair of court rulings expanded the scope of an Illinois law regulating companies’ use of biometrics, including facial and retinal scans.

Facial scanning will only become more common in our travel and entertainment, as well as other fields such as education, banking and law enforcement. We are just beginning to understand the pros and cons.

For more analysis, reviews, advice and headlines from WSJ Technology, sign up for our weekly newsletter.

Write to Nicole Nguyen at nicole.nguyen@wsj.com