Biometric Verification: India Kills the Shared Face Database

Here's a sentence that sounds boring until you really sit with it: India just told its telecom companies "yes, keep using biometric verification to check people's faces to issue SIM cards — but no, don't build one giant shared database of everyone's face." Two decisions. Same news story. Most people would read that and think it's one thing. It's not, and once you see why, you'll never look at a "please verify your identity" prompt the same way again.

TL;DR: Biometric verification — proving you are who you say you are, right now, in the moment — does not automatically require a company to build a permanent database that stores your face, fingerprint, or iris forever; those are two separate decisions with two separate privacy consequences.

What biometric verification actually checks — and what it does not automatically save

Let's start with what happened. India was drafting new rules for how telecom companies confirm your identity when you buy a SIM card. The early version of the plan included something called a Biometric Identity Verification System, or BIVS — basically a shared pool where every telecom operator could check a customer's biometrics against a single central record. Think of it as one giant lost-and-found box of everyone's face data, and any phone company could dig through it. India scrapped that part. What stayed? The actual identity verification requirement. Telecom companies still have to confirm who you are before handing you a SIM — they just do it through e-KYC and D-KYC (electronic and digital versions of "know your customer," the paperwork process banks and phone companies use to confirm you're really you), operator by operator, instead of through one shared repository, according to Biometric Update.

That distinction — verify now versus store forever — is the whole story. And it's one of the most misunderstood ideas in all of identity tech. So let's dig into how biometric authentication actually works under the hood, because once you see the mechanics, the misconception falls apart on its own.

How biometric verification uses unique biometric characteristics without needing a database

Biometric verification is what engineers call a "one-to-one" check. You give it your face, your fingerprint, or your iris. The system compares that single input against one specific record — usually the photo already sitting on your identity document, like a passport or national ID. It's not searching a warehouse of millions of faces. It's answering exactly one question: does this face match that photo? That's it. No lineup. No cross-referencing against strangers. Just you versus your own ID.

Here's where it gets interesting. When you hand over a selfie for verification, the system doesn't actually keep the picture of your face the way you'd expect. It runs a mathematical process that converts your facial geometry — the distance between your eyes, the curve of your jaw, dozens of measurements — into a facial template: a string of numbers. That template gets compared to the number-string generated from your ID photo. If the numbers land close enough together, you pass. The whole thing happens in seconds, and according to guidance from the UK's Information Commissioner's Office, systems can be built to process that image and then immediately throw it away the moment the comparison finishes — pass or fail. This article is part of a series — start with Deepfake Audio.

That number matters because it tells you where the real legal and financial risk actually sits. It's almost never the moment of verification itself that gets companies in trouble. It's what happens to your data afterward — how long they kept it, whether they told you, whether they had a reason to.

Every serious provider treats authentication as a layered process. The first authentication factor is the biometric check itself; a second authentication signal, such as a device fingerprint, backs it up. That is why banks describe biometric authentication to customers as one authentication step among several, not a master key. For users, stronger authentication means fewer stolen accounts; for security teams, every failed authentication attempt is a fraud signal worth logging.

Biometric verification versus building a shared biometric identity verification database

So if verification is a quick, one-to-one comparison, why would anyone build a shared database in the first place? Because a database lets multiple companies check the same person without each one collecting fresh data every time. That's convenient. It's also exactly what turns a fast, low-risk transaction into a permanent, high-risk liability — because now your biometric identity data lives somewhere outside your control, indefinitely, accessible to more than one organization.

Think about it like a bank teller checking your driver's license. The teller looks at your photo, glances at your face, confirms it's you, and opens your account. That's verification — quick, contained, done. What the teller does not do is photograph your face and upload it to a shared registry that every other bank in the country can search. If they did that, you'd probably ask some pointed questions. India's new rule is essentially the government telling telecom companies: keep doing the teller part, skip the shared registry part.

The final Telecommunications (User Identification) Rules, 2026 replace cross-company biometric matching with e-KYC and D-KYC processes, while still requiring operators to verify the identity of users through biometric methods. — reporting on India's telecom verification rules, Biometric Update

Practically, this means when you walk into a shop for a new SIM in India, you'll still go through identity verification — an identity document check plus a live selfie or fingerprint scan, according to reporting from Trak.in. What changed is who else gets to see and store that data afterward. Your local telecom operator verifies you. It doesn't get folded into a nationwide, cross-operator pool that every other operator can query too.

Why do companies ask for biometric verification if they don't need to keep the data?

Because verification and storage solve two different problems. Verification stops fraud right now — someone can't use your identity document to steal your phone number if the facial recognition check catches that their face doesn't match. Storage would only matter if the company needed to check you again later without asking twice. Most companies don't need that. They need the "right now" answer, not a permanent file.

Comparing biometric verification systems: which biometric check runs, and what gets kept

Notice that "verification happened" appears in every row of that table. What changes is entirely about retention, sharing, and how long your data has a heartbeat somewhere outside your control. That's the lever that actually matters for your privacy — not whether a scan happened, but what happened to it after.

The same split shows up in how biometrics are stored. Verification systems that follow modern security guidance convert biometrics into a one-way template, so the raw biometrics never sit in a shared pool. If an individual withdraws consent, deleting one template removes that individual's biometrics without touching other users. Identity verification built this way protects customers even when a vendor is breached, because the stolen templates cannot be replayed as fingerprints or faces.

The misconception that trips up almost everyone about biometric verification

Here's the mistake nearly everyone makes, and honestly, it's an understandable one: people assume that if a company scans your face, fingerprint, or iris to confirm your identity, it must be keeping that data forever in some vault. Why wouldn't you think that? You've never seen the backend. You gave a selfie, got approved, and moved on. From your side, verification looks like a single event, not two separate engineering decisions stacked on top of each other. Previously in this series: Deepfake Laws By State 35 Czech Cases In Six Months Podcast.

But once you understand that verification is just a quick math comparison — your facial template against your ID's template, matched in under a second, then either kept or discarded depending on policy — the whole assumption falls apart. The comparison itself doesn't require a database. It never did. Companies that build shared repositories do it for convenience, cost-cutting, or future fraud-detection features (like flagging the same person applying for ten SIM cards under different names using liveness checks and fraud pattern matching). That's a business decision layered on top of verification, not a requirement baked into how verification works.

Even the GDPR — Europe's big privacy law — treats this as two separate obligations. Companies are supposed to hold biometric data "no longer than necessary," and privacy guidance from firms like DIDiT describes "zero-retention" designs where the raw scan is deleted or transformed into an unreadable template the instant the check finishes. If the law itself distinguishes between checking and keeping, that should tell you something: the two really are different steps, not one bundled action.

How does facial recognition compare an image without storing your face permanently?

Facial recognition systems measure dozens of points on your face — the width between your eyes, nose shape, jaw curve — and turn those measurements into a number pattern called a template. When you're verified, your selfie's template is compared to your ID photo's template. Many systems then discard the raw image immediately, keeping only a non-reversible code, if they keep anything at all.

Security researchers make the same point about scale: verification compares one credential with one person, while biometric identification searches everyone. Each biometric check in a verification flow touches one record, so fraud stays contained and security reviews stay simple. Systems built for identity verification at this scale also pass liveness detection tests more reliably, because facial verification, fingerprint verification, and voice verification each confirm a living individual rather than matching a stored crowd.

Why biometric verification, security, liveness detection, and border checks all rely on the same split

This split — check now, decide separately what to keep — shows up everywhere, not just in India's telecom rules. Airport border checks use biometric verification to confirm your passport photo matches your face at the gate, and some systems delete that scan the moment you walk through. Bank apps use it to confirm you're the account holder before a big transfer. Employers use it for building access. In every one of these, the security problem being solved is "is this the right person, right now" — not "let's build a permanent archive of this person's face just in case."

At CaraComp, this distinction is basically the backbone of how facial recognition fraud prevention should be evaluated: not by whether a company scans faces, but by whether it can tell you — clearly, in plain language — what happens to that scan five minutes, five months, and five years later. That's the actual privacy question. Everything else is theater.

So here's the question worth carrying into your next "please verify your identity" prompt, whether it's a bank app, an airport kiosk, or a new phone plan: when a company or a government asks to verify who you are, are they solving a right-now problem, or quietly building a forever archive while you're distracted by the selfie camera? India just showed the world you can pick the first without the second. Most companies never bother to tell you which one they picked. Up next: Behavioral Biometrics.

For everyday users the practical advice is short. Prefer services whose verification systems explain what biometrics they collect and how long they keep them. Expect a liveness check — a live selfie beats an uploaded photo. And treat biometric authentication as you treat any authentication: it compares who you are with what your identity verification documents say, and good security never requires surrendering your biometrics to a shared database.

biometric verification: Frequently Asked Questions