Whose Face Is It?

On 11 September 2025, Italy's data protection authority, the Garante, ordered SEA, the company that runs Milan Linate (LIN), to stop processing passengers' biometric data through its FaceBoarding service. Inspectors had found that the system was not working the way passengers had been told it worked. By the end of July that year, according to the authority, it had covered 24,550 people.

From the gate, nothing would have looked wrong. A passenger who had enrolled walked up, looked at the camera and went through. The barrier opened, and at the point where the passenger met it the service did exactly what it promised.

The failure sat behind the gate, where no passenger could see it.

Many terminals already contain a small safeguard against that gap, and it is something airports usually spend money trying to remove: the slower queue a few metres from the biometric gate, where a member of staff still checks documents by hand.

On an operations spreadsheet that desk looks like duplication. The airport has paid for automation and is still paying someone to do the same job manually. If the gate works, why keep the alternative?

Because the desk gives people a choice, and a passenger who chooses facial recognition is in a very different position from one who uses it because nothing else is practical. Over the past year that distinction has run through events at airports in Europe, Asia and Africa. Read together, they suggest that choice is only half of what makes these systems acceptable. The other half is someone being able to check them.

What the inspectors found at Linate (LIN)

FaceBoarding went live at Linate (LIN) on 7 May 2024. Passengers could register their face against their identity document and boarding pass, then use it to pass security and board without producing either. It was voluntary, and the appeal is easy to see. Once enrolled, a traveller stopped reaching for documents at every checkpoint, and the airport moved people through with less manual handling.

The Garante's findings, first in its provisional order and then in a final decision dated 12 March 2026, describe a different system from the one passengers were shown. Biometric templates were held centrally on SEA's servers rather than under the passenger's control. They were not encrypted. They could be kept for up to twelve months, a period the authority judged excessive. The privacy notice was inaccurate: SEA's own notice told passengers who enrolled through its app that their biometric template would stay on their smartphone. And because the gates were hybrid, serving enrolled and unenrolled travellers alike, the system captured the faces of people who had never signed up at all.

SEA suspended the service on 16 September 2025 and deleted the passenger data. It said at the time that it believed FaceBoarding complied with the rules. The final decision declared the processing unlawful but imposed no fine, since the service had already stopped.

As far as the record shows, the cameras matched faces correctly. The problems lay in everything around the camera: where the data went, how it was protected, how long it was kept and what people were told about it. A passenger with a perfectly smooth journey had no way of knowing any of that. It took an independent authority, with the power to inspect the system on site, to find out.

Spain followed within two months. In a decision dated 6 November 2025 and made public later that month, the Spanish data protection agency, the AEPD, fined the airport operator Aena €10,043,002 over facial recognition boarding at eight airports. The agency found that Aena had not carried out a valid assessment of the privacy risks before launching the system, and it suspended the biometric processing until one was done. Aena said it disagreed and would appeal.

Two of Europe's larger airport operators had now run into serious regulatory action over biometric boarding in the space of a few months. Neither case is a verdict on facial recognition itself. Both show that a technology working well where the passenger meets it can still sit inside a badly designed or badly run system, and in these cases the data at stake was people's faces.

When the queue moves somewhere else

Portugal produced a different kind of problem in April 2026.

The European Union's Entry/Exit System became fully operational on 10 April. It records biometric data, including facial images and fingerprints, from travellers from outside the EU as they cross the Schengen border. It is a border control system, compulsory for those it covers and quite separate from voluntary face boarding. In the first days, passengers at Lisbon (LIS) reported queues of around two hours. On 11 and 12 April, the Portuguese police force that runs border control, the PSP, suspended biometric collection for departing passengers at Lisbon (LIS), Porto (OPO) and Faro (FAO) so that people would not miss their flights. The pressure did not end there. On 17 May, border control recorded waits of more than two hours at Porto (OPO).

A system meant to manage the flow of people across a border had become the thing holding them up. Anyone who has delivered a large operational system will recognise how that happens. Improve one step and you can still make the whole process worse.

A camera can match a face in a fraction of a second. The border process around it still has documents to verify, exceptions to handle, travellers who need help and several organisations responsible for different stages. A fast algorithm feeding a slow process just moves the wait to the next step.

What passengers experience is the time from joining the line to reaching the gate, however quickly the algorithm runs. Aviation has learned that lesson more than once.

By the spring of 2026, then, Europe was asking uncomfortable questions about biometrics. In Italy and Spain, the questions were about privacy and oversight. In Portugal, they were about operational readiness. Over the same period, India and Vietnam were extending facial recognition and digital identity across their airports, and on terms that narrowed the passenger's choice.

What usage figures do not show

India's Digi Yatra lets passengers use facial recognition to move through airports, and the government has repeatedly described it as voluntary. In a written answer to parliament in August 2024, the Ministry of Civil Aviation called it "purely voluntary".

In June 2026, Air India launched a service called Easy Connect under the government's hub and spoke programme. It is designed to let travellers from smaller Indian cities connect through a major hub, starting with Varanasi (VNS) to Delhi (DEL), onto international flights. Air India's own guidance sets out who must do what. Indian passport holders on Easy Connect must enrol in Digi Yatra and use the e-gates at Delhi (DEL). Foreign passport holders on the same service do not need Digi Yatra; staff check their passport and boarding pass in the transfer area.

That distinction needs stating carefully. Facial recognition has not become compulsory for everyone passing through Indian airports. For Indian passengers who choose this particular service, though, enrolment is a condition of using it.

Vietnam has gone further, and through a different route. Under a government directive, from 1 December 2025 most domestic passengers have been directed to check in, clear security and board using biometric verification linked to VNeID, the national digital identity platform, or to use airport kiosks. Staffed counters remain for passengers with checked baggage and for special categories such as unaccompanied children, older travellers and those who need assistance.

There may be real operational gains in both approaches. Fewer repeated document checks and quicker movement between airport stages are worthwhile aims. But narrowing the choice has a consequence that is easy to miss, and it shows up in how adoption gets measured.

Suppose an airport reports that ninety per cent of its passengers now use facial recognition. That sounds like a technology people have accepted.

If those passengers could have walked to a staffed desk instead, high usage probably does say something about convenience and comfort. If the biometric gate is the only practical way to use a service, the same figure says much less about public confidence. Mainly, it says that people want to catch their flights.

High participation is evidence of a working process. It is not, on its own, evidence of trust.

Aerostack's own register shows why the distinction matters when looking across regions. As of 17 October 2026, it held 259 records of airport facial recognition and biometric deployments, compiled from public reporting. Nine were recorded as suspended or cancelled. Five of those were in Europe; none were in Asia-Pacific. Meanwhile, Asia-Pacific records rose from two in 2022 to fourteen so far in 2026, while Europe's annual count reached eleven in 2025.

Those figures need qualifying. The register is not a census of the world's airports. It depends on what organisations announce and what journalists dig out, and it leans heavily on reporting in English, so some regions are better covered than others. The pattern does not show that the technology works better in Asia-Pacific, or that European airports are worse at deploying it.

There is another possible reading, and it deserves consideration. Part of the pattern may reflect a difference in scrutiny. A biometric system that attracts an investigation and is then suspended becomes a matter of public record, something journalists and other authorities can examine. In another jurisdiction, a similar problem might draw less attention, or never be reported. Aerostack has no evidence that this has happened in any particular country, and makes no such claim. Fewer reported failures may partly mean fewer people looking.

The system behind the gate

That raises a question which gets less attention than it should: who actually controls the system that recognises your face?

A passenger at an automated gate naturally thinks of it as the airport's. It sits in the terminal and carries the airport's branding. But an airport operator, an airline, a ground handler and a government border authority may each handle part of a passenger's movement through the building, and the technology is divided up in much the same way. The organisation running the biometric service may not be the one storing the data. A separate system may do the matching. The company that built the physical gate may not have written the software inside it. Each party can carry different responsibilities and contracts.

So when someone asks where their biometric data has gone, naming the airport is often not enough. The answer depends on the system behind the gate.

Digi Yatra shows how much that system can matter. The service is run by the Digi Yatra Foundation, a non profit company owned 26 per cent by the government's Airports Authority of India, with the remaining 74 per cent held by five airport operators. According to the government, passenger data is encrypted and kept in a wallet on the traveller's own phone rather than in a central database. It is shared only with the departure airport, and purged from that airport's system within 24 hours of the flight.

That is a significant design choice and deserves credit. A system that keeps data on the passenger's device is very different from one that stores everyone's facial templates centrally for a year, which is what the Garante found at Linate (LIN).

Two other facts sit alongside it. The government has told parliament that Digi Yatra's central system falls outside India's Right to Information Act. And the Foundation's privacy policy provides for personal information to be shared with its employees, advisers, agents and third parties that provide services on its behalf.

Neither fact shows that biometric data is being mishandled. A general clause permitting the sharing of personal information does not mean facial templates are being passed to all of those parties. But it does make the detail worth examining. Exactly which data is shared, and with which systems? Who performs the matching? What stops the data being used for another purpose? And who can independently check that the implementation matches the published explanation?

None of those questions is exotic. They are the questions anyone would ask when assessing an important business system. They matter more when the data is personal and, unlike a password, cannot be replaced.

Other countries split the work differently. Vietnam's airport identity process runs on a national platform operated by the Ministry of Public Security. In the United States, the border agency, Customs and Border Protection, performs the facial matching itself through its Traveler Verification Service, while airlines and airports supply the cameras at the gate. The equipment passengers see can look almost identical from one country to the next. The arrangements behind it differ a great deal.

Those arrangements are often hard to see at all. Of the 259 airport biometric records in Aerostack's register, the technology supplier could not be identified for 154. In Europe, the figure was 50 out of 65.

Most products can be traced to their manufacturer, often down to individual components. For many of the systems being installed to recognise people's faces at airports, public reporting does not even name who supplied the technology.

The average passenger probably does not need the manufacturer's name. Somebody does, though, and the information has to be available when there are legitimate questions about procurement, security, performance or accountability.

South Africa shows why. In 2022, Airports Company South Africa (ACSA), the state company that runs the country's main airports, awarded IDEMIA a contract worth R115 million for automated border control, e-gates and a single token system. The contract required 30 per cent of its value to go to a small local business owned by black South Africans. That local partner, InfoVerge, later went to the High Court to challenge the award. In August 2024, ACSA placed its chief information officer on precautionary suspension, saying a preliminary investigation had found prima facie evidence of wrongdoing connected with the project. Later that month it terminated the contract under its notice provisions. IDEMIA said it follows the regulatory procedures in every country where it operates.

IDEMIA had also announced, in June 2023, that the operator of Delhi (DEL) airport had selected it as technology partner for Digi Yatra.

What follows from that needs care. Nothing suggests that the Digi Yatra system at Delhi (DEL) shares the problems associated with the South African contract. Nor does the South African sequence establish that the allegations were proven, or that they caused the termination. The point is much narrower. Once you know who supplied a system, you can start asking informed questions about that company and its contracts. Without the supplier's name, the first step of scrutiny becomes far harder.

For systems that handle people's biometric identity, that is an uncomfortable position: passengers are growing used to the gates while the arrangements behind them stay surprisingly hard to see.

Two safeguards worth paying for

Linate (LIN) holds both halves of the argument.

Passengers there were told how FaceBoarding would work and how their data would be handled. They had a choice about whether to take part. And an independent regulator was able to examine the real system and establish that it did not match what people had been told.

The case separates two things that are easy to run together. The first is choice. A genuine alternative matters because it lets people decide whether to take part at all. The second is verification. A choice is only informed if the information behind it can be trusted, and Linate (LIN) shows that the first does not guarantee the second. The service was voluntary, and serious problems with personal data still went unnoticed by the people using it.

Keeping a desk open and calling the system voluntary is therefore not enough. Neither is publishing a reassuring privacy statement. Someone needs to be able to check that the system works as described, because most passengers have no practical way to find out for themselves. Nobody should need to research an identity platform's architecture and suppliers before catching a flight. It is reasonable to expect the organisations running these systems to show that their promises are being kept.

Aerostack's proposal is modest.

If an airport wants passengers to use facial recognition, it should keep a genuine staffed alternative for those who would rather show their documents. It has to be an alternative people can realistically use, so that they can travel without enrolling their face.

Alongside it, there should be independent scrutiny. An appropriate regulator or inspector should be able to examine the system as it actually runs: what data is collected, where it goes, who can reach it and when it is deleted. The findings should then be published in terms an ordinary passenger can understand.

Neither measure is glamorous. Both cost money, and neither improves the headline figure for passengers processed per hour. But the drive to measure a system's efficiency can crowd out the question of what makes it acceptable to the people using it.

A facial recognition gate can be accurate and fast. It can cut administrative work and make the journey more convenient. Aerostack does not dismiss those benefits. Technical performance still cannot show whether a system is being run responsibly, and usage figures alone cannot show whether passengers trust it.

The questions that can show it are simpler. Can someone explain what happens to the data? Can an independent person verify that explanation? Can a passenger decline without being unreasonably disadvantaged?

Answering them needs clear responsibilities and someone with the right to check.

Airports usually treat the unremarkable queue beside the gate as evidence that something could run more efficiently, and often that is exactly what it is. Sometimes, though, the part of a system that looks least efficient is providing something the usual measures miss. Here it is the ability to say no. Together with independent oversight, that choice may be part of what makes the technology worth trusting, and the queue that protects it may be worth keeping.