What Biometric Data Is and Why It's Different

This article is part of a series explaining how the internet works. This article is about biometric data, which you quietly hand over regularly. Unlocking a phone. Clearing an airport gate. Proving your age to read a website. Each of those feels small. It’s not.

What Biometric Data Actually Is

Biometric data is information about your physical or behavioral characteristics, which is used to identify you. The US Department of Homeland Security defines it as automated recognition based on characteristics from which repeatable features can be extracted. The individual characteristics are called modalities.

The physical kind is what most people picture. Fingerprints. The geometry of your face. Iris and retina patterns. Your voice. Your DNA. Behavioral data is less obvious. How fast you type and the rhythm of your pauses. How you walk. The pressure and speed of your signature.

Both work on the same principle. They measure something stable over time and different between people.

The process has four steps, whether you're unlocking a phone or crossing a border. A scanner captures the trait. Software converts it to digital data. That data gets stored. Future readings will be compared against it.

The conversion step is the one people misunderstand. Most systems don't keep the photo or the scan. They extract measurements and store a template. Basically, your face or fingerprints get turned into numbers that can be read, identified, and measured.

Vendors often describe these templates as one-way, meaning you can't reconstruct the original. Researchers have challenged that. Either way, a stolen template can still help an attacker, because it may work against the system it came from.

The scale of this is larger than most people assume. DHS runs a biometric system called IDENT, holding more than 320 million unique identities and processing over 400,000 transactions a day, shared with the Departments of Defense and Justice.

The Law Treats It as a Higher Tier

Under the GDPR, biometric data used to uniquely identify someone isn't just personal data. It's a special category. That special category data sits in a stricter regime. Processing it is prohibited by default, and only permitted where a specific exception applies.

Other data of the same level of importance tells you how the law sees it. That includes health data, racial and ethnic origin, political opinions, religious beliefs, trade union membership, and other personal data about someone's sex life or sexual orientation.

Those are all things that can be used against a person in a way that ordinary data can't. Lawmakers put biometric identification in with them deliberately. Someone may discriminate against a person based on their religion or sexual orientation, but they won’t discriminate against you based on a bad password. That’s why keeping that sort of information private is so important.

Why It's Different From Everything Else

Three properties set biometric data apart. The first is the one people name, and the other two matter just as much.

• You can't replace biometric data: If a password leaks, you change it and the leaked copy becomes worthless. If a face scan or fingerprint template leaks, there's no equivalent step. You have one face. You (usually) have ten fingerprints, and that's the total supply for a lifetime. You may lose a finger, but you’re not going to grow a new one if the older ones get compromised.

This has already happened at scale. A 2015 breach at the US Office of Personnel Management exposed the fingerprints of 5.6 million people. None of them can get new ones.

• Biometric data can be collected without your participation: You have to type in a password. You don't have to do anything for a CCTV camera on the street to capture your face. That changes the consent question completely, because the usual model assumes you did something deliberate.

Biometric data is also probabilistic, not exact. This is the property almost nobody explains. A password either matches or it doesn't. A biometric check doesn't work that way. The system compares your scan to a stored template and produces a similarity score. Someone decides what score counts as a match.

There have been recorded instances of identification systems failing at this. Back in August 2026, a system in Moscow, Russia, decided a face scan was an 85–90% match for a teenager. Police beat the teenager. Turns out, he was innocent. The system made a mistake. Abuse happened anyway.

There's a related problem. Accuracy isn't evenly distributed. Testing has repeatedly found that facial recognition error rates vary across demographic groups, meaning the same system is more reliable for some people than others. 

We’ve covered a Guardian investigation that found that facial recognition and AI age-assessment tools used by UK immigration authorities exhibit significant bias, causing child refugees to be incorrectly classified as adults. Those children lost  access to child-specific protections, support, and legal rights — with consequences that can follow them through the entire asylum process.

Where This Is Showing Up Now

Biometric identification used to only appear at borders and in high-security buildings. Nowadays, it has moved considerably deeper into everyday life. Phones unlock by face or fingerprint. Payments authorize the same way. Some workplaces use it for attendance. Some shops use facial recognition to prevent loss.

And increasingly, it's attached to ordinary internet use. Facial age estimation is now one of the methods used to satisfy age verification requirements that have expanded well beyond adult content. This means the same special category of data the GDPR treats most carefully is being processed to let someone browse Instagram, scroll TikTok, or read Facebook.

Why This Matters

The usual online privacy advice assumes you can recover from a mistake or a data breach. You change the password, close the account, and go on your merry way.

Biometric data doesn’t follow that assumption. The biometric personal data being collected is permanent, the collection can happen passively, and the matching is a judgment call made by whoever runs the system.

This doesn’t mean you should never use it. Unlocking your phone with a fingerprint or a face scan is a reasonable trade for most people. But using face scans or uploading selfies to prove your identity and browse legal websites and platforms isn’t reasonable at all and should be avoided at all costs.