On 4 November 2026 the Home Office published its response to the consultation on a new legal framework for biometrics and facial recognition. Its central commitment is plain: "The Government intends to introduce a new statutory framework for use of biometrics, facial recognition, and similar technologies." Reporting on the announcement says the measures will be carried in the Police Reform Bill, which has not yet been introduced.
For a technology that police forces in England and Wales have used for years under common law powers, data protection law and a patchwork of guidance, this is overdue. It is also the right instinct. Our view is that a democratic state should use powerful tools only under clear, published rules, and that clear rules are good for innovation too, because vendors and forces can build and buy against a known standard rather than litigation risk.
The strongest case for the new framework
Before criticising any part of this, the case for it deserves a fair statement. Live facial recognition (LFR) is a real operational gain. The Metropolitan Police's Croydon pilot ran static cameras at two locations on the High Street across 24 operations between October 2025 and March 2026 and produced 173 arrests, which the Met calls one every 35 minutes. Thirty-seven were for breaches of court-imposed conditions. The Met also says more than 470,000 people walked past the cameras and only one false alert was registered. Each watchlist, it says, was created no more than 24 hours in advance and deleted immediately afterwards.
If those figures hold up, supporters have a reasonable argument that well-run LFR is more targeted than the alternatives: it checks faces against a short list of people already wanted, rather than stopping people on suspicion. A statute that lets police use that capability with guardrails is better than leaving forces to improvise.
What the Home Office has committed to
The government response contains several commitments we think are sound:
- A single oversight body. "The Government will create a single oversight body to oversee law enforcement use of biometrics, facial recognition and similar technologies," with "enforcement powers to ensure adherence to these rules." ID Tech's report adds that in extreme cases the body could seek a court injunction barring a force from using the technology.
- Testing. The legislation will ensure any technology used is "adequately tested, scientifically valid and subject to appropriate monitoring."
- Authorisation. The statute will "stipulate the minimum rank of police officer (or equivalent) who can give operational authorisation."
- Proportionality beyond crime severity. The response says the seriousness of the crime should not be the sole criterion for necessity and proportionality.
- A private-sector code. The government is "committed to bringing forward a Code of Practice for private-sector use for the prevention and detection of crime."
The consultation drew 13,845 fully submitted responses, according to the same document. That is a substantial public signal, and the headline commitments reflect the main demand from respondents: put this on a statutory footing.
Where the framework could still fail
The danger is not that the statute exists. It is that it ends up legitimising whatever is already happening. Three points are worth watching.
First, the Croydon evidence is the Met's own. The 173-arrest figure and the single false alert come from a police press release about a police pilot. They are not an independent evaluation. The Register's report on the results also noted that Big Brother Watch calls the Croydon installations "chilling infrastructure," and that the group lost a High Court challenge in the Shaun Thompson case, reported in April 2026. A statute should require the new oversight body to publish audited deployment data, including false alerts, demographic error rates and outcomes for those arrested, rather than relying on forces to grade themselves.
Second, "intelligence-led" and "proportionate" are only as strong as their definitions. ID Tech reports that the rules require use to be intelligence-led and proportionate, and deployed only when officers believe wanted people could be present. Those words constrain little if a fixed camera in a busy shopping street is always, in some sense, intelligence-led. The Met plans to attach fixed cameras to street furniture in the West End and Soho by Christmas, according to the Guardian's report as summarised by Freevacy, with six more areas in 2027 and local councils expected to help pay. Cameras that can be moved with crime patterns are a different thing from a bounded, time-limited operation. The statute should say how long a deployment area can be authorised, and when it must be reviewed.
Third, bias testing needs a standard and a consequence. The commitment to testing is welcome, but the response text we reviewed gives no accuracy or bias figures. The framework should name who tests, to what protocol, on what population, and what happens when a system fails: withdrawal from use, not a footnote. An oversight body with real power to stop a force is the one feature that makes the rest credible. If the injunction power is diluted in the bill, the framework becomes a permission slip.
The sequencing problem
Big Brother Watch has argued the Met should pause its static-camera expansion until Parliament has spoken. We would not go that far on the Croydon evidence, which suggests careful use can work. But expanding to new districts before the bill is even introduced puts the cart ahead of the horse. A sensible compromise is for forces to keep operating existing, documented deployments while committing that any new fixed installations will be assessed against the standards in the forthcoming statute and code.
Why the private-sector code matters
Shops and other private operators are not police and do not hold police powers, yet they are increasingly using the same technology. A separate code is the right approach if it is proportionate: clear rules on signage, retention, watchlist sourcing and redress, enforced by an existing regulator, without imposing law-enforcement-grade compliance on a corner shop. Overbroad rules would push small businesses toward informal, unaudited tools, which is the worst outcome for privacy.
What to watch
The real test arrives when the Police Reform Bill is published. Look for four things: whether the oversight body is statutorily independent of the Home Office, whether it can issue binding stop notices, whether bias-testing results must be public, and whether authorisation expires. A framework that answers yes to all four would be a model for other democracies. One that leaves them to secondary guidance would be a missed chance to prove that proportionate regulation and effective policing are compatible.