London Says Scan Every Face. Brussels Says Ban It. Same Continent, Opposite Answers.
Two governments, a short flight apart, just gave opposite answers to one question: is your face yours, or is it evidence?
Here is what their split means for the most permanent password you own — the one you can never change.
Let me start with a confession. I have walked through a train station scanned by facial recognition cameras and felt absolutely nothing — no chill, no second thought, just a person late for a train. That is the honest part I have to own before I argue anything: the technology is designed to be invisible, and on me, on that day, it worked perfectly. I was not stopped. I was not matched. I sailed through, mildly annoyed about the train, blissfully unbothered about the camera.
And that is exactly the problem with writing about surveillance — it asks nothing of you until the one day it asks everything. Because somewhere in that same city, on a day not so different from mine, a man named Shaun Thompson walked past a camera too. He was not late for a train. He was on his way home from a volunteer shift. And the machine decided he was someone else.
What happened to him — and what just happened in two courtrooms and one parliament, a short flight apart, in the space of a few months — is the closest thing we have to a controlled experiment on a question most of us never think to ask. Is your face yours? Or is it evidence the state is entitled to collect, every time you step outside, just in case?
First, the part that actually happened in a courtroom
Let’s deal in facts before we deal in feelings.
On 21 April 2026, two judges of the High Court in London handed down a ruling, and you can read the court’s own published summary of the judgment yourself — it is mercifully readable for a legal document. The case was The King (Shaun Thompson and Silkie Carlo) v The Commissioner of Police of the Metropolis, and the challenge was narrow but enormous: not whether police can use Live Facial Recognition (everyone agreed they can), but whether the rulebook governing when, where, and against whom they use it is clear enough to be lawful.
A word on the technology, in plain language, because the marketing fog is thick. Live Facial Recognition (LFR) is not a camera that records you for later. It scans every face in a crowd in real time, converts each one into a string of biometric numbers, and compares that string against a police “watchlist” — a database of faces the police are looking for. No match, and the system is supposed to blur your image and delete your data on the spot. A match, and an officer gets an alert, and you get approached — all in the time it takes you to cross a square.
So what did the court decide? It dismissed the challenge. In its own words, it concluded that the policy “does not authorise arbitrary decision-making, has sufficient clarity and foreseeability, and provides adequate safeguards against abuse.” The law firm CMS, reading the judgment, summed up the reasoning cleanly: the court found the policy “imposed sufficient constraints structured around why, who and where LFR could be deployed.” Three permitted “use cases,” watchlist rules, oversight at senior levels. Constrained, the judges said. Lawful.
Now, the human part the legal language sands away. The first claimant, Shaun Thompson, is a 39-year-old Black community worker who volunteers with young people in areas hit by knife crime. On 23 February 2024, walking near London Bridge, the system matched him to his brother — who was on a watchlist — and an alert went out. He was stopped, questioned, and, when he declined to give his fingerprints, threatened with arrest. As he put it afterward: “No one should be treated like a criminal due to a computer error. I was compliant with the police, but my bank cards and passport weren’t enough to convince the police the facial recognition tech was wrong.”
Read that last line twice. His own ID was not enough to overrule the machine. The burden of proof had quietly flipped. He was not innocent until proven guilty; he was guilty until he could prove the algorithm wrong.
The bias isn’t a glitch — it’s measurable
Here is where it gets uncomfortable, and where I have to be fair to both the worry and the numbers.
You might assume a misidentification like Thompson’s is a one-in-a-million fluke. The trouble is that the flukes are not distributed evenly — they cluster on certain faces. In the most-cited study of its kind, a landmark NIST study of the algorithms — that is the US government’s own standards lab, not an activist group — found that, depending on the algorithm, false-match rates varied “from a factor of 10 to 100 times” — and that the systems produced more false positives for Asian and African American faces than for white ones. Women fared worse than men; the elderly worse than the middle-aged. The machine is not equally blind to everyone. It is more likely to mistake you for a stranger if you are Black.
And that statistical tilt shows up in the field, not just the lab. The campaign group Big Brother Watch — whose director, Silkie Carlo, was the second claimant in the case — reports that “80% of people misidentified by facial recognition in London in 2025 were Black.” That is not a fringe claim, either. Britain’s own equality regulator, the Equality and Human Rights Commission, intervened in the case and concluded that the Met’s policy is “incompatible with the European Convention on Human Rights” — and found that “the number of Black men triggering an ‘alert’ by the technology is higher than would be expected proportionally when compared with the population of London.”
So we have a court that says the policy is lawful and a regulator that says it is unlawful, looking at the same technology, in the same city, in the same year. That is not a typo. That is the size of the disagreement.
But — and I mean this — the strongest counter-case is real
I do not want to win this argument by ignoring the best version of the other side. So let me make it for them, in its strongest form, because it is genuinely strong.
When the Metropolitan Police installed permanent facial-recognition cameras on lampposts in Croydon and ran them for five months, the results — by the Met’s own pilot figures — were not nothing. The cameras “scanned the faces of 470,000 people,” and over that period the police “recorded one false alert with no wrongful arrests.” Officers “made 173 arrests in 24 separate operations.” Crime in the area “fell 10.5 percent compared to the same period a year earlier.”
If you are the parent of a teenager in a neighbourhood with a knife-crime problem, that paragraph reads very differently than it does to a privacy lawyer. One false alert in 470,000 scans is, on its face, an extraordinary hit rate. A 10% drop in crime is a real number of real people not getting hurt. And “we caught 173 wanted people without a single wrongful arrest” is a sentence any honest critic has to sit with rather than wave away.
Here is the reframe, though — and it is the whole ballgame. A rate is not a person. “One false alert in 470,000” is a comfort right up until you are the one. Shaun Thompson is what a rounding error looks like from the inside: stopped, disbelieved, and made to prove his own face. And a low error rate, multiplied across millions of scans, is not actually small. As the equality regulator dryly noted, “even low error rates can affect a significant number of people by bringing unnecessary and unwanted police attention.” Scan four million faces and a 0.01% error is four hundred people — disproportionately, the data says, people who look like Thompson. The technology can be impressively accurate and a civil-rights problem at the same time. Both things are true. That is what makes this hard.
Now look across the Channel
Here is where things get genuinely strange, and where my own cross-border instincts kick in — because if you take a one-hour flight from London to Brussels, the answer to the same question flips entirely.
While the UK was busy approving live face-scanning of innocent crowds, the European Union was busy outlawing it. On 2 August 2026, the headline provisions of the EU AI Act’s biometric rules take full effect, and the centerpiece is a flat prohibition on exactly what London just blessed: real-time facial recognition by police in public spaces. Same technology. Same continent. Opposite verdict.
The prohibition is written into the law itself. Article 5 of the Act bans “the use of ‘real-time’ remote biometric identification systems in publicly accessible spaces for the purposes of law enforcement, unless and in so far as such use is strictly necessary” — and then lists the narrow exceptions. And here is where I have to be scrupulously honest, because the ban is not absolute, and anyone who tells you it is, is selling you something. Police in the EU can still switch on live face-scanning to find missing persons and trafficking victims, to stop “a genuine and present or genuine and foreseeable threat of a terrorist attack,” or to hunt suspects in serious crimes carrying a sentence of at least four years.
That is a meaningful list of holes — “foreseeable terrorist attack” can stretch to cover a lot of crowds. But notice what the EU did with the default. In London, the default is on: scan everyone, and trust the policy’s “use cases” to keep it proportionate. In Brussels, the default is off: scan no one, and require a specific, authorised, exceptional reason to flip the switch. The Future of Privacy Forum’s read of the red lines lays out how much friction sits on the EU side of that switch: prior authorisation from a court or independent authority, a fundamental-rights impact assessment, and two trained humans who must both confirm a match before anyone acts on it. The whole architecture is built around the worry that constant scanning creates a “feeling of constant surveillance” that chills “the exercise of freedom of assembly and other fundamental rights.”
That is the contrast in one line. Britain asks, what’s a good rule for scanning everyone? The EU asks, should we be scanning everyone at all? Those are not two answers to the same question. They are two different questions about who your face belongs to.
And lest you think the UK simply hasn’t gotten around to a law yet — it hasn’t, and that is the point. Privacy International calls a democratic vacuum the void where a facial-recognition statute should be: there is “no specific law in place pertaining to the use of FRT,” so the police lean on common-law powers and generic data-protection rules and, in effect, write the limits themselves. The court didn’t bless a carefully debated parliamentary framework. It blessed a police policy, in the absence of one.
Now imagine the next ten years
Let me get a little speculative, because the technology is sprinting in an obvious direction and it costs nothing to picture where it lands.
Today, live facial recognition is a van on a high street, or cameras bolted to a few lampposts in Croydon, switched on for an operation and off again. It is still, mostly, an event — something the police deploy. Now extend the line. The cameras get cheaper, smaller, permanent. The watchlists merge — not just wanted suspects, but anyone with an unpaid fine, anyone who missed a court date, eventually anyone the system is simply curious about. The scanning stops being an operation and becomes the weather: always on, everywhere, unremarkable.
Picture walking to work in that city. A camera clocks you leaving home, another at the bus stop, a third outside the office. None of them stop you — you’re not on a list today. But the system now knows your route, your timing, your habits, your associations, with a fidelity no human surveillance team could ever afford. You attend a protest; visit a clinic, a lawyer, a place of worship, a union meeting — the cameras note all of it. You have done nothing wrong, and you are nonetheless known — comprehensively, permanently, by a state that decided your face was its to read.
The chilling part isn’t the dramatic wrongful arrest. It is the quiet recalculation each of us would start to make — maybe I won’t go to that protest, maybe I’ll take a different route — the slow shrinking of how freely we move when we know we are always, faintly, on a list. That is not science fiction. It is just the Croydon pilot with the brakes off, and it is precisely the future the EU’s default-off architecture is trying to foreclose and the UK’s default-on architecture quietly invites.
What the smart people are saying
Here is the genuinely encouraging part: this is not a left-versus-right fight, however much it might look like one. The unease about state face-scanning runs clear across the ideological spectrum, which is exactly why I trust it.
On one side you have the civil-liberties campaigners you’d expect. Silkie Carlo called the ruling disappointing but vowed the “fight against live facial recognition mass surveillance is far from over,” while Thompson, with a phrase that lands harder than any legal brief, called it “stop and search on steroids.” Over in Brussels, the campaigners at European Digital Rights — who actually got most public biometric scanning banned — still warn that the AI Act left “human rights gaps” and that lawmakers “missed a crucial opportunity.” So even the people who won in Europe think the win was partial.
But this is not only a progressive worry, and that matters. The libertarian Cato Institute calls it a surveillance nightmare — a free-market, small-government think tank, not a protest group — warning that in the wrong hands the technology becomes “a dangerous tool, allowing them to identify protesters, journalists critical of their departments, and people simply engaged in legal activity,” and that “absent the right protections and regulations it’s a surveillance nightmare.” When the activists worried about police power and the libertarians worried about state power arrive at the same doorstep, that is not partisanship. That is a consensus the rest of us should probably notice.
The disagreement, in other words, isn’t really about whether unbounded face-scanning is dangerous. Almost everyone serious agrees it is. The disagreement is about whether you trust a policy to hold the line — the British bet — or whether you need the line written into law with the default set to off — the European one.
What does this mean for you?
You are not a policy directorate, and most days this feels abstract. But your face is the most permanent password you own — you can change a leaked email, reset a stolen card, even adopt a new name, but you cannot change your face — so a few concrete habits are worth forming now, before the cameras become the weather.
Know whether you live in a default-on or default-off place. If you’re in the UK, the US, or most of the world, scanning is permitted unless something stops it. If you’re in the EU after 2 August 2026, it’s prohibited unless an exception applies. That single fact tells you how much your own vigilance has to carry.
If you’re ever wrongly stopped, the algorithm is not evidence — your ID is. Thompson’s case is the playbook: stay calm, stay compliant, and state clearly that you believe you’ve been misidentified by facial recognition. You are not obliged to accept “the computer says it’s you” as the end of the conversation.
Support the boring local fight, because that’s where this is decided. The rules for your town’s cameras get set in council meetings and police-oversight boards, not in op-eds. The groups doing the unglamorous work of forcing transparency are how default-on places acquire guardrails.
Watch the watchlist, not just the camera. The real question is never only “are we being scanned” but “who decides whose face goes on the list, and how do they get off it?” Push your representatives for an answer in writing.
Don’t let one impressive accuracy stat end the conversation. “One false alert in 470,000” is a real number and a real comfort — and also exactly the framing designed to make you stop asking who the rounding errors are. Both questions deserve airtime.
The lesson, as I see it
We are watching two rich, rights-respecting democracies look at the identical machine and reach opposite verdicts — and that, oddly, is the most clarifying thing about this whole episode. It tells us the answer was never dictated by the technology. The cameras don’t decide whether your face is yours; we do, through the defaults we choose and the laws we either pass or never get around to passing.
I’ll admit I started this piece feeling nothing in that train station, and I’ll admit I’d probably feel that nothing again tomorrow. That is precisely why I don’t trust my own comfort as a guide. The test of a surveillance regime is never how it treats me on an ordinary day. It is how it treats Shaun Thompson on the day the machine gets it wrong — and whether, when his own passport wasn’t enough, anyone was required to believe him over the algorithm.
My vote? Set the default to off, and make the state ask permission to scan a free person’s face — not the other way around. A face is not a confession. It should not be treated like one just because we built a camera clever enough to read it.
The HAIA Foundation exists to keep human beings — not their biometric shadows — at the center of how we govern intelligent systems. If this one made you glance up at the nearest camera, that’s the right instinct: bring it with you to our Substack, where we keep working out loud on where the line should be.