吃瓜大本营

Sports stadiums around the country have begun using face recognition to identify ticket holders, threatening to normalize a uniquely powerful surveillance technology that has already been used for abusive purposes. Worse, companies involved are already planning big expansions, raising the specter of a world where our faces become not just our ticket at sports stadiums, but a passport we鈥檙e forced to show across society.

Face recognition has been creeping into stadiums for roughly six years. In 2018, a security group used face recognition on fans at a Taylor Swift concert and Madison Square Garden scanning the faces of attendees, supposedly as a security measure. The Garden鈥檚 security rationale was undermined a few years later when the technology was used to lawyers who happened to work for a large firm where another lawyer was suing The Garden鈥檚 billionaire owner, James Dolan. Dolan, whose companies own many arenas around the country, had previously used his control over them to a Knicks fan who, upset over a losing streak, told Dolan he should sell the team. Face recognition technology not only allowed Donlan to expel the lawyers, but also provided a way for him to ban the disgruntled Knicks fan.

These abuses rightly sparked controversy and focused national attention on the potential misuses of face recognition. But, beyond security and marketing deployments, it鈥檚 also worth paying attention to the use of the technology for ordinary access control.

In recent years many sports arenas and leagues have embraced face recognition. In 2018 baseball stadiums using face recognition for admittance by partnering with the airport company CLEAR. In August 2024, the NFL announced that it was face recognition to control access to restricted areas in stadiums, such as offices, press boxes, and locker rooms. Meanwhile, a number of NFL teams have begun offering fans the option to use face recognition instead of tickets to enter stadiums. That involves sharing a photo of one鈥檚 face with the company Ticketmaster, which is then compared against a photo taken when you enter the stadium. In September, an executive with the company Wicket told a D.C. that the company planned to provide face recognition ticketing services to more than 40 stadiums 鈥渁cross all the major leagues.鈥� Other vendors are providing .

These deployments have drawn 鈥� not only from privacy advocates, but also from police officers who work stadiums. In Las Vegas, both the Las Vegas Metropolitan Police Department and the local police union to participating in the NFL鈥檚 secure-area face recognition program at Allegiant stadium, and subsequently to participate in it. The police union president the Associated Press that 鈥淸Privacy is] what everybody鈥檚 concerned about 鈥� taking our personal information and sharing it with vendors and teams.鈥�

Some have called stadiums 鈥渢he .鈥� Indeed, what is happening in stadiums shows signs of spreading elsewhere. Certainly, the corporate providers have big plans. An official with the Cleveland Browns, which was an early adopter of Wicket鈥檚 services and whose owner is a Wicket investor, spoke at the D.C. about how he鈥檇 like faces to become a unique identifier across a variety of services. 鈥淭icketmaster runs our ticketing, we have a concessions partner that runs our concessions, we have a merchandising partner,鈥� he said. 鈥淚 would love to get to the point where a customer鈥檚 face or a fan鈥檚 face could be their identity to all these different platforms [and where] all this technology is tied to your identity.鈥�

Sports companies may already be eager to see face recognition used as a unique identifier across the sporting world, but there鈥檚 little reason to think it will be contained to sports. The Wicket executive said his company has already expanded to offering face recognition as the means of entry to large conferences and that 鈥渟ome of the [sports] venues we鈥檙e in are starting to use us for other purposes beyond just sporting events.鈥� He said they鈥檙e also starting to talk to venues that only host concerts.

All of this expansion raises the question: where will it end? Are we looking at a future where face recognition is used everywhere and we can鈥檛 escape it? It鈥檚 already being pushed as a replacement for credentials by the Transportation Security Administration (TSA) and Customs and Border Patrol (CBP) in what are the first government face-recognition checkpoints. It is also used in a few housing facilities for access control as well as security. But it鈥檚 also being used in the private sector to access various facilities, including some office and . Universal Studios has face-recognition access control at its theme parks in Florida. (鈥淲e have done this at our park in Beijing,鈥� a Universal executive boasted to a reporter, seemingly oblivious of the irony.)

What happens if this technology starts appearing everywhere? The identity company , which sells face-recognition access control devices, 鈥淔rictionless Access Everywhere!鈥� It and other vendors, which include a number of , mention banks, medical offices, hotels, public transportation, retail stores, schools, and restaurants. CLEAR has expanded its face recognition ID service from airports to Uber, LinkedIn, and tool rental at Home Depot, and the 鈥渦niversal identity platform鈥� for the physical world.

If this happens, it will be in part because companies have embraced the efficiencies, the marketing advantages, and the security advantages that may be gained from switching to face recognition. They鈥檒l claim it will shorten lines, though it鈥檚 unclear how much more efficiency, if any, face recognition provides over barcode tickets. If it is faster, what it鈥檚 really doing is increasing profits for businesses 鈥� after all, short lines and quick entrances are always possible if the venues will just pay enough workers to staff the entrances.

These efforts may also connect with another technology the ACLU is watching closely: digital 诲谤颈惫别谤鈥檚 licenses. A Los Angeles stadium executive, Christian Lau, said at the D.C. conference that 鈥淲e鈥檙e also rolling out mobile 诲谤颈惫别谤鈥檚 licenses acceptance in California鈥�. We鈥檒l have a whole marketing campaign around it. It鈥檚 going to be really cool, and we鈥檒l tie all of our systems together ultimately.鈥�

All this might be great for billionaires, team owners, and big companies, but none of it would be good for ordinary people. The ACLU is concerned that:

• You can鈥檛 reset your face, which means you can鈥檛 reset your relationship with any of the entities that use it, who will never forget your history of transactions. That empowers them and disempowers you. We will lose control of when we鈥檙e being identified and checked and when we鈥檙e not.
• The face you present to one company is the same face you present to all the others, which makes it easy for them to get together and compare notes on your behavior. When your face is your ID, your ID is plain for all to see. Plans to 鈥渢ie all our systems together鈥� should be heard as an ominous warning.
• Centralized data stores always raise questions of data security and breaches. Faceprint databases are no exception, and a breach could result in fraud and other harm to the people whose data is being held. For example, stolen faceprints could be used to hijack pay-by-face apps and steal goods and services. This is particularly worrisome because again, while a credit card or account number can be changed after a breach, you are stuck with your face.
• The more companies that have your face, the more they can use that face in other contexts and places for other purposes 鈥� such as security uses and blacklists. Not only can鈥檛 you reset your face, you can鈥檛 likely live your life covering it. As we鈥檝e already seen at Madison Square Garden, it鈥檚 a small step from using your face to ticket you to using your face to ban you.

The use of face recognition for watchlists may be one of the most inevitable and consequential side effects of 鈥測our face is your ticket.鈥� Watchlists mean false positives and failures to update, producing situations where people are mistaken for others who are wanted or banned. They likely mean abusive private blacklists as companies collude 鈥� often through third parties 鈥� to share people they wish to exclude. There鈥檚 a long history of private and quasi-private watchlists being abused, going back to the labor battles of the early 20th century, when workers and organizers were blacklisted as 鈥渢roublemakers鈥� and could have trouble getting a job. Watchlists also likely mean a lack of due process over who is targeted. We鈥檝e seen that in most watchlist programs in recent decades, especially those run by the government, even though it, unlike private companies, is bound by at least some checks like the Privacy Act and the Fourth Amendment.

As the stadium executive Lau noted, praising the advent of face recognition, 鈥淲e can all thank Apple, because FaceID has gotten people so used to unlocking their phones, they don鈥檛 think about it.鈥� But Apple designed their unlocking systems such that your facial image never leaves your phone. That means it鈥檚 a completely different ballgame than sharing your face with the network of billionaires and monopolists that control the sports world, and the business world beyond sports. There is a big difference between face recognition being used by you, and face recognition being used on you.

The danger is that uncritical mass acceptance of these technologies for some very slight convenience will usher in a world where they become inescapable. If you鈥檙e offered the option to use face recognition next time you鈥檙e seeking admittance somewhere, you should opt out 鈥� this is not a trend that will be good for you. Policymakers and companies should also say no to face recognition technology for access control. It鈥檚 just not that hard to use a ticket.