In January 2020 police in Detroit arrested Robert Williams on his front lawn in front of his wife and young daughters. He was held for about thirty hours for a shoplifting case. The main lead against him was a facial recognition search that matched a blurry security camera image to his old driver's license photo. The match was wrong. His case, one of the first known wrongful arrests of its kind in the United States, shows how two technologies, face recognition and location tracking, have turned ordinary life in public into a source of data.

How facial recognition works

A facial recognition system measures features of a face and turns them into a numerical template, sometimes called a faceprint, which it compares with others. It helps to separate two uses. Verification is one to one: checking that you are who you claim to be, as when your phone unlocks for your face. Identification is one to many: comparing an unknown face against a large database to find who it is. Verification usually happens with your knowledge and cooperation. Identification can happen to anyone who walks past a camera.

The technology has improved enormously, and the best systems are very accurate in good conditions. But accuracy drops with poor lighting, odd angles and low resolution, which describes much security footage. A 2019 study by the US National Institute of Standards and Technology found that many algorithms produced more false matches for some demographic groups, including Black and Asian faces, while the most accurate algorithms showed much smaller differences.

The company Clearview AI built its database by copying billions of photos from social media and other public websites without asking anyone, then sold searches to police. Regulators in several European countries found that this broke their data protection laws. In the United States, Illinois's Biometric Information Privacy Act of 2008 requires written consent before private companies collect biometric data such as faceprints, and lawsuits under it have produced large settlements.

Responses vary. In 2019 San Francisco became the first major US city to ban its government agencies from using facial recognition. After the Williams case, Detroit agreed in a settlement that a facial recognition match alone could not be grounds for an arrest. The European Union's AI Act, adopted in 2024, sharply restricts police use of live face identification in public spaces, with narrow exceptions for serious crimes.

Location: where you go is who you are

Your phone reveals your location in several ways: by connecting to cell towers, through GPS used by apps, and through nearby wifi networks. Location data seems anonymous when names are removed, but it rarely is. A 2013 study of mobile data from 1.5 million people found that four location points were enough to single out 95 percent of people. Where you sleep and where you work are usually enough to identify you.

In 2019 the New York Times obtained a commercial file of more than 50 billion location pings from over 12 million phones in the United States. Reporters could follow individuals home from military bases, government offices and clinics.

Courts have begun to take this seriously. In United States v. Jones (2012), the Supreme Court held that attaching a GPS tracker to a suspect's car and following it for 28 days was a search. Several justices pointed out that tracking someone's movements over time reveals a whole life: political, religious, medical and personal associations. This idea, that many small observations can add up to something the law should treat as a search, is called the mosaic theory.

Police have also used geofence warrants, which ask a company to identify every device that was inside a defined area during a period of time. These can help find suspects in crimes with no other leads, but they sweep up everyone nearby. Federal appeals courts have disagreed about whether they are constitutional.

Worked example: a day at a protest

Leila attends a peaceful march about housing costs. She carries her phone and passes several city cameras along the route.

If police run an identification search on the camera footage, Leila's face may be matched to a license photo without her knowledge. If the image is poor, someone who looks like her might be matched instead. A geofence warrant for the area would capture her phone along with thousands of others. A broker might have already sold the fact that her phone spent two hours at the rally. None of these steps requires that she be suspected of anything.

Fairness requires the other side as well. The same tools have helped identify people who committed violence, find missing children and rescue victims of exploitation. The real questions are about rules: whether a warrant is needed, how errors are checked by humans, how long data is kept, and whether lawful protest is protected. Freedom of assembly means little if attending a march quietly places your name on a list.