Mass Surveillance and Privacy

Surveillance used to be rationed by labour. Watching one person required people to do the watching, transcribing and filing, so states and companies had to choose targets. Machine perception removes that constraint. A camera network that recognises faces, a fleet of automatic number plate readers, and a model that can read millions of hours of audio all cost roughly the same whether they process one subject or ten million. The fear is that once the marginal cost of watching an extra person approaches zero, the default shifts from targeted observation to blanket collection.

Three capabilities are usually named. The first is identification at a distance without cooperation, which face and gait recognition provide. The second is retrospective search: a record collected for one purpose can be queried years later for another, so a person's past becomes permanently available to whoever controls the archive. The third is inference, where a system derives a sensitive attribute such as health status, political affiliation or immigration status from data that contains no such field.

The consequence people fear is not only the direct one of being wrongly identified. It is the indirect effect on behaviour. If attending a demonstration, visiting a clinic or meeting a journalist can be reconstructed later from records nobody knew were being kept, the argument runs, people will do less of it, and the loss falls on exactly the activities that democratic politics depends on. Dario Amodei of Anthropic put domestic mass surveillance in this category in January 2026, describing it as a line that should be treated as illegitimate inside democracies.^[1]

This is one of the few AI fears where the deployments are counted rather than projected. Steven Feldstein's AI Global Surveillance Index, published by the Carnegie Endowment for International Peace in September 2019, found at least 75 of 176 countries actively using AI technologies for surveillance, with facial recognition systems in 64, smart city or safe city platforms in 56 and smart policing in 52. It identified technology linked to Chinese companies, particularly Huawei, Hikvision, Dahua and ZTE, in 63 countries, with Huawei alone supplying at least 50. The index counts deployments as of 2019 and does not distinguish lawful from unlawful use.^[2]

The Metropolitan Police figures are the most detailed public account of a democratic deployment. Its six month pilot of static live facial recognition cameras in Croydon ran from October 2025 to March 2026, produced 173 arrests across 24 operations, and recorded one false alert against more than 470,000 people who walked past. The force reports a 10.5 percent fall in recorded crime in the area against the same period a year earlier and a 21 percent fall in offences of violence against women and girls, figures it has published itself rather than had audited externally. On 23 June 2026 Commissioner Mark Rowley said static cameras would be introduced across the West End and Soho by the end of the year, repositioned as crime patterns move rather than permanently fixed.^[3][4]

Private infrastructure has produced the clearest misuse record. Jason Koebler and Joseph Cox of 404 Media reported in May 2025 that local and state police had run more than 4,000 nationwide and statewide searches of Flock Safety number plate reader data at the request of Immigration and Customs Enforcement or as informal favours, even though the agency held no contract with the company, and that every lookup explicitly listing immigration as its reason was made after the January 2025 inauguration. The Electronic Frontier Foundation, reviewing audit logs covering June 2024 to October 2025, found more than 80 law enforcement agencies running searches that used the term roma or racial slurs against Romani people, often with no suspected offence recorded. Jay Stanley of the American Civil Liberties Union catalogued the municipal response in August 2025: Austin declined to renew, Denver rejected a proposal, Evanston revoked out of state access, and Richmond cut off data sharing with federal agents.^[8][10][11]

Government purchase of commercial data is the least visible channel. A report dated 27 January 2022 by a senior advisory group panel of the United States Office of the Director of National Intelligence, declassified in June 2023 after a request from Senator Ron Wyden, described the intelligence community acquiring a large and growing volume of commercially available information, and set out the privacy risk that follows when such data can be reassembled to identify individuals.^[12]

Public opinion tracks the concern without matching it to behaviour. In a June 2025 survey reported by Pew Research Center in March 2026, 50 percent of American adults said they were more concerned than excited about the growing use of AI in daily life, against 10 percent more excited and 38 percent equally both. An earlier Pew survey, published in October 2023, found 71 percent very or somewhat concerned about how the government uses the data it collects about them, up from 64 percent in 2019. The European Commission reported in February 2025 that 84 percent of Europeans think AI in the workplace requires careful management to protect privacy. Ipsos, surveying 23,532 adults across 32 countries between 20 March and 3 April 2026, found a 32 country average of 47 percent agreeing that they trust companies using AI to protect their personal data, from 74 percent in India down to 34 percent in the United States and 26 percent in France.^{[13][14][15][16]}

The most reliable failure is not a dystopia but an ordinary administrative error at scale. The Dutch childcare benefits affair is the reference case. Amnesty International found that the tax authorities used whether an applicant held Dutch nationality as a risk factor, so that non-Dutch nationals received higher risk scores, and that tens of thousands of parents and carers, mostly from low income families, were falsely accused of fraud. Benefits were suspended and repayments demanded with little effective route to human review, and the government of Mark Rutte resigned in January 2021. A court in The Hague had already ruled in 2020 that the separate SyRI fraud detection system breached human rights law and ordered it stopped, a decision Lighthouse Reports later showed had not ended equivalent profiling in Dutch neighbourhoods.^[17][18]

Retention converts yesterday's routine collection into tomorrow's targeting list. A number plate database assembled for stolen vehicle recovery becomes usable for immigration enforcement when the political weather changes, which is what the 4,000 federal lookups describe, and the audit logs the Electronic Frontier Foundation examined show the same network being queried with no stated offence at all. Nothing in the design of these systems distinguishes between the purpose for which data was gathered and the purpose for which it is later queried, which is why access rules rather than collection rules do most of the protective work.^[8][10]

Consolidation multiplies both risks. In the United States, staff associated with the Department of Government Efficiency obtained access to federal databases including Social Security records during 2025, and in January 2026 the Justice Department acknowledged in a court filing that a DOGE employee had moved Social Security data to a non-secure server without agency officials' knowledge and in breach of security protocols, having previously given the courts a different account. Separately, Immigration and Customs Enforcement awarded Palantir a 30 million dollar contract on 18 April 2025 for a platform called ImmigrationOS, which consolidates government data to prioritise enforcement targets and to track visa overstays and self-deportations.^[19][20]

Errors fall unevenly. Of the at least eight known United States wrongful arrests that followed a face recognition match, seven of the people arrested are Black. The Washington Post investigation published in 2025 found that police failed to check alibis in six of the cases, ignored contradictory evidence in two, and did not collect key evidence in five. The technology's contribution was the match and also the confidence it lent to an investigation that would otherwise have had to go further before an arrest.^[7]

The measured performance of the best current deployments is better than most predictions from a decade ago. One false alert against more than 470,000 people is not a system that misidentifies at random. The Thompson judgment records the underlying numbers: a National Physical Laboratory test in 2023 put the false positive identification rate at 0.017 percent for a watchlist of 10,000, the Metropolitan Police raised its similarity threshold from 0.6 to 0.64 during 2024, and between 11 September and 31 December 2024 the force generated 453 alerts of which none was false. On 21 April 2026 the Administrative Court dismissed the judicial review brought by Shaun Thompson, who had been stopped and questioned in February 2024 after being matched to his own brother, and by Silkie Carlo, director of Big Brother Watch, holding that the September 2024 policy is in accordance with the law under Article 8 and prescribed by law under Articles 10 and 11. Rowley says around 80 percent of Londoners support the technology.^[4][21][3]

Second, several of the most widely cited systems have been abandoned or curtailed. Chicago Police Department discontinued its Strategic Subject List on 1 November 2019, and the city's Office of Inspector General published an advisory in January 2020 finding the risk scores and tiers unreliable, the officers using them improperly trained, and the controls on internal and external access inadequate; the model had cost 3.8 million dollars in federal grants. The Los Angeles Police Department let its Flock Safety agreement lapse in June 2026 over what its chief information officer Dean Gialamas called serious concerns around civil liberties and civil rights, and has had no access to the company's stored data since. The pattern is closer to expensive procurement failure than to an efficient panopticon.^[24][25]

Third, the law is biting, which is not what a story of unstoppable technological drift would predict. The prohibitions in Article 5 of the European Union AI Act have applied since 2 February 2025 and cover untargeted scraping of facial images from the internet or closed circuit television, biometric categorisation to infer race, political opinion, trade union membership, religion or sexual orientation, emotion recognition in workplaces and schools, social scoring and, with narrow exceptions requiring judicial or independent administrative authorisation, real time remote biometric identification in public spaces by police. Clearview AI has been fined in France, Italy, Greece and the Netherlands, and in October 2025 the United Kingdom Upper Tribunal overturned a first instance ruling and held that the Information Commissioner does have jurisdiction over the company.^{[22][5][6][26]}

A fair statement of the sceptical case has to concede two things. Clearview has no establishment in Europe, and the Dutch authority had to attach further penalty payments of more than 5 million euros to its order to secure compliance, so a headline fine against a foreign company is a weaker deterrent than the number suggests. And the Thompson judgment upheld one force's policy under one legal framework, on evidence about that force's own thresholds and safeguards; it is not a finding that live facial recognition is harmless.^[5][21]

European law now sets outer limits, but general data protection law remains the sharper instrument in practice. The French CNIL fined Clearview 20 million euros on 20 October 2022 for failing to comply with an order issued the previous December, and a further 5.2 million euros on 10 May 2023 for continued non-compliance. Italy and Greece each imposed 20 million euro fines in 2022. The Dutch authority fined the company 30.5 million euros in September 2024 over a database of about 30 billion facial images, added penalty payments for continued breach, and said it was examining whether the directors could be held personally liable.^[5][6]

In the United States the action is at state level. Jake Laperruque, reviewing the position for Tech Policy Press in January 2025, counted 15 states with statutory restrictions on police face recognition by the end of 2024, ranging from body camera limits in Oregon and New Hampshire to warrant requirements, serious crime thresholds and defendant notification in Colorado, Maryland, Maine, Montana, Utah, Virginia and Washington. Montana and Utah were the first to require a warrant. Seven states, Alabama, Colorado, Maine, Maryland, Montana, Virginia and Washington, prohibit a face recognition match as the sole basis for an arrest.^[23]

Courts have become the main venue for testing individual deployments. In Glukhin v. Russia, decided on 4 July 2023, the European Court of Human Rights found unanimously that Russia had violated Articles 8 and 10 by using facial recognition to identify and arrest a man who had staged a solo protest on the Moscow metro, and described the technology as highly intrusive. In England the Thompson and Carlo judicial review produced the first substantial judicial account of what safeguards a live facial recognition policy needs, even though the claim failed. The Hague court's SyRI judgment remains the clearest European precedent that a state fraud detection system can be stopped outright on privacy grounds.^[27][21][18]

Measurement and audit are the quieter part. The United States National Institute of Standards and Technology runs the Face Recognition Technology Evaluation, publishing rolling one to one verification results for algorithms that developers submit. That measures algorithms under test conditions rather than deployments in the field. Independent audits of live systems remain rare, and where they have happened, as in Oxnard, California, they have found outside agencies accessing local camera data without authorisation.^[28][25]

The useful question is not whether a given system is accurate but who can query it, for what, and with what record. Accuracy has improved fast and will keep improving; retention rules, access logs and purpose limits have not improved at anything like the same rate. Almost every documented harm in this area, from the Dutch benefits affair to the immigration lookups on a private camera network, came from data collected lawfully for one purpose and used later for another.

Distinguish the three settings that get merged in coverage. State surveillance in an authoritarian system, police use in a country with judicial review, and commercial data brokerage that governments then buy from all raise different problems and yield to different remedies. A reader worried about the third will get little protection from a rule that only binds police, which is why the finding about purchased commercial data matters more than its low profile suggests.^[12]

Concrete indicators are available. Published false alert rates, whether defendants are told that a face match was used, whether audit logs exist and are inspected by anyone outside the agency, and whether fines against non-compliant vendors are actually collected are all observable, and each moves independently of the technology's capability.