Is Facial Recognition Safe: The Face Data Job Nobody Approved

You can change your password. You can change your phone number. You can't change your face. And right now, in supermarkets across Australia, cameras are scanning shoppers' faces at the door — with no new law, no new hardware needed to turn that into something else entirely. The moment that matters isn't when the camera goes up. It's what happens to the data afterward.

If you've walked into a store, an airport, or a

If you've walked into a store, an airport, or a stadium in the last year, this already touches you. And if the idea of your face sitting in a database you never signed up for makes your stomach tighten — that reaction makes sense. But there's a specific thing happening here that most people get backwards, and once you see it, the fear turns into something more useful. Today I want to teach you the difference between when a system gets installed and when it gets repurposed. Because those are two completely different privacy decisions. So why does the second one matter more?

There's a term for this. Researchers call it function creep, or scope creep. In plain English, it means data collected for one reason quietly starts getting used for a second reason nobody voted on. Picture opening a joint bank account with a company. You agree to it for exactly one purpose — say, catching shoplifters. But the account exists now. The money's sitting in it. And every month, someone in that building asks a slightly bigger question. What if we tracked which aisles people linger in? What if we priced things differently based on who walks through the door? No engineer has to build anything new. The barrier isn't technical anymore. It's just a policy memo.

According to ABC News in Australia, two major supermarket chains started facial recognition trials in August, pointing to a real problem — abuse against retail workers jumped roughly eighty-five percent over two years in Victoria alone. That's a genuine safety crisis. The justification is honest. But the cameras are up now, and the faces are stored now. What those faces get used for next year is an entirely separate conversation — one most of us were never invited to.

Here's what people naturally assume, and it's a

Now, here's what people naturally assume, and it's a reasonable assumption. Most of us think the privacy fight happens at installation. The cameras arrive, there's a public debate, people either accept it or push back. That feels like the decision point because it's the visible one. It's the part that makes the news. But Lauren Perry, a responsible technology policy specialist at the University of Technology Sydney, describes what actually follows. She says once the technology's in place, you see a layering — the same system getting used for steadily more invasive purposes. The real vulnerability window doesn't open at installation. It opens after.

And this isn't a glitch. The A.I. Now Institute makes a sharp point about this. Algorithmic systems are built to be extended. The ability to add new functions isn't a side effect — it's a selling feature. You're not watching a system fail. You're watching it work as designed.

So has anyone actually been caught doing this? Yes. A school in Sweden ran a trial using facial recognition to take student attendance. Swedish data protection regulators ruled it unlawful, because the students' data was processed without genuine, explicit consent. That's the pattern in miniature — a system justified for one thing, quietly extended to another. Regulators catch some of these. They don't catch most of them.