BLOG
THE RULES ARE CATCHING UP WITH THE CAMERAS
Facial recognition is rolling out across UK policing and retail faster than the law around it is being written. What does responsible deployment look like in the meantime?
Facial recognition is rolling out across UK policing and retail faster than the law around it is being written. What does responsible deployment look like in the meantime?
Facial recognition is no longer an experiment in the UK. As of March 2026, live facial recognition was in use by 13 of the 43 police forces in England and Wales, and in January the government announced its largest ever rollout of the technology as part of wider policing reforms. On the high street, adoption is moving just as fast: major supermarkets have expanded store trials, and live facial recognition is now used by well over a hundred UK retailers through various providers.
Whatever your view of the technology, the direction of travel is clear. Facial recognition is becoming part of everyday policing and everyday retail security.
Here is the uncomfortable part: there is still no single, dedicated law governing facial recognition in the UK. Police use currently rests on a patchwork of UK GDPR, the Data Protection Act 2018, human rights law, ICO guidance and codes of practice. The Home Office ran a public consultation over the winter on a new legal framework for police use of biometrics and facial recognition, and the regulators who oversee biometrics have openly warned that deployment is moving faster than the law that governs it.
The courts are filling the gaps. In April 2026, London police successfully defended a legal challenge against a live facial recognition deployment. Cases like this are currently doing the work that a clear legal framework should be doing, deciding one dispute at a time what responsible use looks like.
It might be tempting for retailers to hold off until the rules settle. The reality is the opposite: the core legal duties already exist and already apply. Any retailer deploying facial recognition today must comply with UK GDPR, complete a Data Protection Impact Assessment (DPIA), prove the deployment is necessary and proportionate, be transparent with customers, and put strict limits on what data is kept and for how long. The ICO has already investigated facial recognition in retail and set clear expectations for how it should be run.
What the coming framework will change is scrutiny. When new rules land, every existing deployment will be measured against them. Systems designed loosely today become tomorrow's compliance problem.
FaiceTech's position is simple: do not wait to be told. We are ISO 27001 certified, registered with the ICO, and our platform is designed around the strictest reading of current UK rules. All biometric processing happens in the UK. Biometric data is kept separate from everyday business data, stored as encrypted templates that cannot be turned back into photographs, with no raw images retained and deletion under the customer's control. Watchlists belong to the retailer, every action is auditable, and we provide full DPIA support and a transparent list of every third party involved in delivering the service.
When the new framework arrives, systems built this way will already clear the bar. That is what responsible facial recognition looks like while the rules catch up: not the minimum you can get away with today, but the standard you would be happy to be judged against tomorrow.
GOV.UK: Consultation on a new legal framework for law enforcement use of biometrics and facial recognition
UK Parliament POST: "Facial recognition technology in policing" (2026)
Biometric Update: "UK announces largest ever facial recognition rollout as part of policing reforms" (January 2026)
Biometric Update: "London police win legal challenge against live facial recognition deployment" (April 2026)
Biometric Update: "Facewatch wants to bring live facial recognition to UK pharmacies" (June 2026)