The strongest case against police facial recognition is simple. A false match is not a typo. It can mean a stop, an arrest or a wrongful suspicion, and the burden falls unevenly across demographic groups. Critics who say the technology should be paused until the law catches up are making a serious argument, not a Luddite one.
The Information Commissioner's Office (ICO) has now produced evidence that bears on that argument. On 18 August 2026 it published its overview report on facial recognition technology in police forces. The report draws on consensual audits run between June 2025 and March 2026. The reports completed with West Yorkshire and Greater Manchester, alongside earlier ones for South Wales, Gwent, Essex and Leicestershire.
What the audits found
The ICO's own summary describes a "mixed picture". It found genuine assurance in some areas and urgent gaps in others. Forces generally had a documented lawful basis, limited the data used in live deployments, and had breach-reporting procedures. Compliance was generally stronger for live facial recognition than for retrospective facial recognition, where an officer runs an existing image against a database after the fact.
The gaps cluster in the less visible work:
- senior oversight and staff training
- records of how personal data is used
- where retrospective-search images come from and how long they are kept
- active testing for accuracy and bias
Greater Manchester Police shows the pattern. Its audit summary gave live facial recognition "reasonable" assurance but retrospective use only "limited", reportedly because of missing policy on using the Police National Database and undefined roles. Biometric Update's account of the findings reports the same split.
The ICO made 107 recommendations. Forces fully accepted 93 and partly accepted 14. Nobody rejected any. A regulator that gets that response is not facing an adversary. It is working with institutions that want to be told what good looks like.
The bias problem is real, and it is specific
The most serious finding is not about paperwork. It concerns the algorithm. In 2025, National Physical Laboratory (NPL) testing of the legacy Cognitec algorithm used for retrospective searches on the Police National Database found it more likely to produce incorrect matches for some demographic groups. The Home Office and the National Police Chiefs' Council (NPCC) have since added mitigations: staff training, oversight reporting and equality impact assessments. They plan to replace the algorithm.
The size of the differential depends heavily on the setting. Freevacy's summary of the NPL report reports false positive identification rates at a lower threshold of 0.04% for white subjects, 4% for Asian subjects and 5.5% for Black subjects. For Black women the rate was 9.9%. The same coverage reports that police raised the match threshold to cut bias, then reversed course after forces complained of fewer investigative leads, with the match rate reportedly falling from 56% to 14% at the higher setting.
That trade-off is the whole policy problem in miniature. A higher threshold reduces unfairness and also reduces police utility. The honest position is to say so out loud and let the decision be scrutinised. Quietly picking the lenient setting is not honest.
Why audit beats prohibition, with conditions
Our view is pro-innovation but not indifferent. Blanket bans would freeze a tool that, when properly governed, can help find serious offenders. They would also remove the one thing that produced these findings: forces willingly opening their processes to inspection. Nobody should expect that cooperation to survive a moratorium fight.
But consensual audits are not enforcement. Three things would make the model credible rather than decorative.
- Published, testable accuracy standards. The ICO urged forces to test actively for bias and inaccuracy. That should mean routine, independently verified testing at the operational threshold actually in use, with results published. Quoting performance at a threshold nobody runs is no substitute.
- Disclosure of threshold changes. If a threshold is lowered for operational reasons, affected oversight bodies should know and the reasons should be recorded. Per the same reporting, the Home Office has not disclosed the current threshold.
- A credible escalation path. The ICO says it is monitoring for harm from incorrect matches and reserves the right to take further regulatory action. That reservation only matters if the Commissioner is prepared to use it.
The record-keeping findings deserve more attention than they will get. Weak logging and incomplete records of processing are dull, and they are exactly what makes it impossible to investigate a wrongful match after the fact. Accountability for an algorithm starts with being able to reconstruct what it did.
The Met is the real test
The ICO's final audit, of the Metropolitan Police, is due later in 2026. The Met runs the largest deployments, so its results will matter more than the five forces already covered. The ICO says its recommendations are meant to guide all forces using the technology, which is sensible. But guidance bites only where forces adopt it voluntarily.
The lesson is that proportionate regulation is working at the level of process and has not yet been proven at the level of outcomes. The next measure of success is not another set of accepted recommendations. It is whether the replacement algorithm shows no meaningful demographic differential at operational settings, and whether that is demonstrated publicly.