That Face Match Looks Solid. The Paper Trail Behind It Might Not Be.

Here's something that might stop you mid-scroll: right now, 44 states have passed at least one law governing how AI works inside their borders. That's not a distant policy debate. That's 44 different sets of rules that a single facial comparison result — one score, one match — might have to survive before it ever helps close a case.

Most people assume facial recognition is a simple yes-or-no machine. You feed it two photos, it spits out a match percentage, and either the faces are the same or they aren't. Done. Case closed. But there's an entire hidden layer underneath that number — a layer that's getting more complicated by the month — and if you're hiring an investigator, reviewing evidence, or just trying to understand your own rights, it's worth knowing what that layer actually looks like.

The Score Is the Easy Part

When a facial comparison tool analyzes two images, it's doing something genuinely remarkable. It maps dozens of spatial relationships across a face — the distance between your pupils, the angle of your jawline, the proportions of your nose relative to your forehead — and converts all of that into a mathematical representation. Then it compares those representations and produces a similarity score. A high score means the geometry lines up closely. A low score means it doesn't.

That process takes fractions of a second. It's the part technology has gotten very good at.

But the score is almost the least complicated thing about it now. The complicated part? Proving that everything surrounding that score was handled correctly — and "correctly" now depends entirely on which state you're in. This article is part of a series — start with Why Fake Faces Look More Real Than Genuine Photos.

White House officials have publicly described this situation as a "growing patchwork of 50 different state regulatory regimes," according to Seeking Alpha. That phrase — "patchwork" — is doing a lot of work. It sounds abstract until you realize what it means for a real investigation crossing state lines.

What Detroit Actually Changed

Let's get concrete, because this is where it clicks.

Detroit police now operate under rules — stemming from legal settlements around wrongful arrest cases tied to facial recognition — that require any facial recognition match to be corroborated by additional evidence before a person is even placed in a photo lineup. Not just flagged. Corroborated. Furthermore, according to TechPolicy.Press, defendants must be told when facial recognition was used in their case, and the specific photo used in any lineup cannot be the same image the algorithm returned — a different photo of the suspect must be used instead.

Read that again slowly. The result of the algorithm cannot directly become the evidence. It's a lead, not a conclusion.

Now imagine an investigator who ran the same comparison under a different state's rules — somewhere with no equivalent requirements. Same algorithm. Same two photos. Same confidence score. But zero documentation of corroboration, no defendant notification trail, no record of which image went into the lineup. Whose results hold up better under scrutiny? The answer has nothing to do with the technology. It has everything to do with the paper trail.

"Police cannot use facial recognition systems without receiving training on the risks and dangers of the technology, and defendants must be informed when facial recognition was used and given details on the nature of its use." — Reporting on Detroit police settlement requirements, TechPolicy.Press

The Illinois Problem — And Why It Ripples Outward

Illinois has something called BIPA — the Biometric Information Privacy Act. Biometric data, by the way, just means the body-based stuff that's uniquely yours: your face geometry, your fingerprints, your voice pattern. BIPA says that before any private entity collects that information from you, they must notify you in writing, get your informed consent, maintain a written policy about how long they'll keep it and when they'll delete it, and they cannot profit from it without explicit permission. As detailed by Cambridge University Press in its overview of U.S. facial recognition law, these aren't soft guidelines. They're hard legal requirements with real penalties attached. Previously in this series: How Deepfake Videos Are Evaluated Source Geometry Frame Cons.

Here's why that matters beyond Illinois state lines. If your investigation involves any images of people who were photographed or enrolled in Illinois — or if evidence could ever be examined by an Illinois court — BIPA's requirements may follow that evidence. You'd need to show that whoever collected the original images did so lawfully, with proper consent and documented retention policies.

Think of it this way. A facial comparison result is like a prescription. The medication is identical regardless of which pharmacy fills it — but the label, the warning documentation, the storage requirements, and the records you're legally required to keep all differ depending on which state's rules apply. The "medicine" (the match score) may be exactly right. But if the label (the documentation) is missing or wrong, the whole thing becomes unreliable — and potentially unusable.

The Misconception That Gets People Into Trouble

Here's where most people — including experienced investigators — get tripped up. They assume that proving technical accuracy is the same as having usable evidence. If the algorithm returned a 94% similarity score, that feels like a fact. And in a narrow technical sense, it is — the math checked out.

But a match score doesn't tell you whether the source images were collected with proper authorization. It doesn't tell you whether the person depicted ever consented to having their face analyzed. It doesn't confirm whether the method used is accepted under the specific jurisdiction where the case will be heard. And it absolutely doesn't prove that someone was trained — as many states now require — on the limitations of the technology before they ran the comparison.

It's genuinely easy to get this wrong, by the way. For decades, expert testimony about technical results carried enormous weight in court — and it still does. The instinct to trust a precise-looking number is deep and reasonable. But what's changed is that courts and regulators are increasingly asking not just "what did the algorithm find?" but "how was this done, and can you prove it was done correctly?" Those are very different questions. The first is about technology. The second is about process — and process is now where cases get won or lost.

The Hidden Layer That Now Runs Alongside Every Comparison

At CaraComp, this is the gap we think about constantly — not just whether a facial comparison produces an accurate result, but whether the entire trail around that result is something you can stand behind. Source image documentation. Method transparency. Jurisdiction-specific compliance. Clear communication of what a match does and doesn't prove. Up next: The Most Real Face Youll See Today Was Never Born.

Washington State, for example, now operates under SB 6280, which requires state agencies using facial recognition to conduct accountability reports and allows independent testing for accuracy and bias — with results that must be made public. That's a documentation requirement baked directly into the law. The tool isn't the point. The accountability trail around the tool is the point.

What this means practically: if you are hiring an investigator who uses facial comparison technology, the right question isn't "what algorithm do they use?" The right question is "can they show me where the source images came from, explain which method was applied and why, tell me what the result does and does not prove, and demonstrate they followed the rules that apply to my specific situation?" If they hand you a percentage and a name without being able to answer those questions, you don't have evidence. You have a starting point dressed up as a conclusion.

So here's the question worth sitting with. If two investigators hand you the exact same facial comparison result — same score, same photos, same case — but only one of them can clearly show you where the images came from, which method was used, what the result proves and what it doesn't, and how the whole thing was handled under the rules that apply to your state: whose report would you trust?

The answer is obvious. And it has nothing to do with the algorithm at all.