Topic starter
06/11/2026 6:40 pm
TL;DR: Face recognition and facial authentication solve different problems, according to Daon, with the former used to identify unknown people in databases and the latter used to verify willing users through consent and liveness checks. Treating them as interchangeable creates security mismatches, privacy exposure, and compliance failures under regimes such as GDPR and BIPA.
Editorial analysis by NHI Mgmt Group, based on content published by Daon: “Face Recognition vs. Facial Authentication 101”.
Key questions
Q: How do organisations choose between facial recognition and facial authentication?
A: Facial recognition identifies or searches for a person from an image, while facial authentication verifies that a claimed person is the same individual enrolled earlier.
Q: Why does liveness detection matter in facial authentication?
A: Liveness detection helps stop spoofing by checking that a real, present person is facing the sensor rather than a photo, replay, mask or synthetic image.
Q: What privacy controls should govern biometric template storage?
A: Biometric template storage should be governed by data minimisation, strong encryption, strict access control, and a clear retention and deletion policy.
Practitioner guidance
- Define the biometric use case before selecting a control Separate identification, verification, and device unlock use cases before procurement or deployment so the consent and retention model match the actual workflow.
- Enforce liveness checks for access-bearing workflows Require active or passive liveness detection wherever facial biometrics can unlock accounts, devices, or applications, and test bypass resistance with spoof attempts.
- Minimise biometric template storage scope Prefer local or enclave-based template storage and avoid central repositories unless the use case truly requires population-scale matching.
Bottom line: Face recognition and facial authentication are not interchangeable controls, and using them as if they were the same creates governance and compliance errors.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
06/11/2026 6:41 pm
Face recognition and facial authentication should be governed as different risk classes: one is primarily an identification system, the other is an access control mechanism. That distinction matters because the first expands collection and retention obligations while the second concentrates on assurance at the point of use. Organisations that collapse them into a single biometric policy usually end up with controls that fit neither use case. The practitioner conclusion is to classify the workflow first, then select the biometric control.
A question worth separating out:
Q: What happens when biometric systems are built for the wrong identity use case?
A: When biometric systems are designed for the wrong use case, they often fail at accuracy, privacy or operational control. A search system built like an authenticator may over-enrol and over-share data, while an authenticator built like a search tool may miss liveness, consent and fallback checks, creating avoidable access and fraud risk.
👉 Read our full editorial: Face recognition and facial authentication have different governance burdens