Facial recognition: what may be collected and who oversees it

Service page: Digital commerce and AI lawyer: terms, privacy and direct mailing.

The technology is already here. The law is not.

Facial recognition is one area where technology races ahead and the legal system lags behind. In Israel in 2026, several realities live side by side, uneasily. Bills that would let the police install biometric camera systems in public spaces are before the Knesset (Israel’s parliament). Banks offer biometric verification, and security sites scan faces. All this happens without a specific law that regulates the subject.

This is not an accident. It is a choice. Every time someone drafts a broad law on AI and privacy in Israel, the debate gets stuck between security and liberty. Meanwhile, citizens pay the price.

No dedicated law: so what actually applies?

Without a dedicated law on facial recognition, regulation rests on several layers built for other purposes. They barely hold up against a technology nobody imagined in the 1980s:

• Protection of Privacy Law, 5741-1981: prohibits invading a person’s privacy without their consent (section 1), and “consent” means informed consent, express or implied (section 3). Since Amendment No. 13, a biometric identifier used to identify a person or verify their identity by computer is “information of special sensitivity” (section 3)
• Protection of Privacy Regulations (Data Security), 5777-2017: a database that contains biometric data is usually subject to at least the medium security level (First Schedule). Such a database with information about 100,000 people or more, or with more than 100 authorized users, is subject to the high security level (Second Schedule)
• Privacy Protection Authority (PPA): the supervising body. It published a policy document on collecting and using biometric data to monitor employee attendance (2024, in a version updated after Amendment No. 13)

And here a surprising factor comes in. Israeli companies that offer goods or services to people in the European Union, or that monitor their behavior there, are also subject to the European GDPR (Article 3(2)). Under the GDPR, processing biometric data to uniquely identify a person is prohibited, unless one of the exceptions applies, including explicit consent (Article 9).

Consent: the issue companies miss

To collect and process biometric data (including facial images for identification) without authorization by law, you need informed consent (sections 1 and 3 of the Law). In such a case, the Privacy Protection Authority recommends preferring explicit consent. This is not a “privacy policy update” that nobody reads. It is a specific consent to collecting facial data, with a clear explanation of:

• What is collected and why
• How long it is kept
• Who it is shared with
• How it can be deleted

Security cameras with facial recognition at the entrance to a building? A sign saying “Warning: security cameras” does not disclose that biometric identification is taking place. In the Privacy Protection Authority’s approach, silence or a lack of protest is not, in itself, valid consent. So I recommend informing people explicitly about the facial recognition and getting active consent.

The big problem: a biased algorithm, an innocent person arrested

Studies show again and again that facial recognition algorithms are less accurate (sometimes by significant margins) for women, dark-skinned people and older people. This is not theory: in the US, several cases of wrongful arrest caused by a wrong facial match have been documented.

In Israel, if the police arrested someone based on facial recognition alone, this is disputed evidence. A defense lawyer who understands the subject will challenge the admissibility of the identification, demand disclosure of the algorithm’s details, and ask for a counter-opinion.

What is happening in the world, and what it means for Israel

The European Union passed the AI Act (2024). It prohibits the use of “real-time” remote biometric identification systems in publicly accessible spaces for law enforcement, except for narrow exceptions (Article 5(1)(h)). It also prohibits creating or expanding facial recognition databases through untargeted scraping of facial images from the internet or from security cameras (Article 5(1)(e)). This is one of the sharpest laws in the world.

Israel does not have to adopt the AI Act. But Israeli companies that offer such systems on the European market, or whose system output is used in the EU, are subject to it (Article 2(1)). This is a market Israel cannot ignore.

Within Israel: as of October 2026, there is no dedicated law on facial recognition. Amendment No. 40 to the Police Ordinance (פקודת המשטרה) (published on 8 January 2024) regulated special camera systems that identify items and objects, but not biometric camera systems that allow facial recognition. Bills and reforms on the subject depend on political changes; it is advisable to follow the Knesset’s updates.

What to do: a quick guide for organizations

If your organization uses facial recognition (entrances, verification, security):

• Map it: where and how biometric data is collected
• Update your privacy policy: include specific details on facial recognition
• Build a consent mechanism: active consent, not “using the site constitutes consent”
• Set a deletion schedule: do not keep facial data forever
• Protect the database: in line with the Protection of Privacy Regulations (Data Security), 5777-2017

Which documents to prepare before going live

• Database definitions document: a description of the collection and use, the purposes, the types of information (including biometric data), processing by a holder, and transfer abroad (regulation 2 of the Protection of Privacy Regulations (Data Security), 5777-2017)
• Wording of the notice under section 11 of the Law: whether giving the information is mandatory or depends on consent, and what happens if a person does not consent; the purpose; the name of the controller and how to contact them; who the information will be passed to; and the rights of access and correction
• Record of consent: when the collection is not authorized by law, you must show that informed consent was given (sections 1 and 3)
• Agreement with the system supplier: if the supplier has access to the database (regulation 15 of the Data Security Regulations)
• Notice to the Privacy Protection Authority: when a database that does not have to be registered contains information of special sensitivity about more than 100,000 people. The notice is due within 30 days, with a copy of the database definitions document (section 8A(b))

Frequently asked questions

At the building entrance there is facial recognition and a “security cameras” sign. Is that enough?

No. A sign saying “Warning: security cameras” does not disclose that biometric identification is taking place. To collect and process biometric data without authorization by law, you need informed consent (sections 1 and 3 of the Protection of Privacy Law). In the Privacy Protection Authority’s approach, silence or a lack of protest is not, in itself, valid consent. So it is worth informing people explicitly about the facial recognition and getting active consent.

May the police use facial recognition?

As of October 2026 there was no dedicated arrangement for this. Amendment No. 40 to the Police Ordinance (published on 8 January 2024) regulated special camera systems that identify items and objects, but not biometric camera systems that allow facial recognition. Invasion of privacy is allowed only by a law, or under a law by virtue of express authorization in it (sections 7 and 8 of Basic Law: Human Dignity and Liberty). So each use is examined on its own merits.

An Israeli company sells a facial recognition system in Europe. Which rules apply to it?

The GDPR applies to anyone who offers goods or services to people in the European Union, or monitors their behavior there (Article 3(2)). Under it, processing biometric data to uniquely identify a person is prohibited, unless one of the exceptions applies, including explicit consent (Article 9). The AI Act applies to companies that offer such systems on the European market, or whose system output is used in the EU (Article 2(1)).

What level of security applies to a database containing biometric data?

A database that contains biometric data is usually subject to at least the medium security level. Such a database with information about 100,000 people or more, or with more than 100 authorized users, is subject to the high security level (First and Second Schedules to the Protection of Privacy Regulations (Data Security), 5777-2017).

Which documents should be prepared before running facial recognition in an organization?

A database definitions document (regulation 2 of the Data Security Regulations); the wording of a notice under section 11 of the Protection of Privacy Law; a record of informed consent, when the collection is not authorized by law; an agreement with the system supplier, if the supplier has access to the database (regulation 15); and, for a database that does not have to be registered and contains information of special sensitivity about more than 100,000 people, a notice to the Privacy Protection Authority within 30 days (section 8A(b)).