The escalating risks of mass biometric surveillance in the age of AI | Part 2

As artificial intelligence (AI) capabilities scale, the technology amplifies mass surveillance efforts and the resultant impact on democracy, human rights, and our collective agency. What’s more, as government and corporate power converges, the regulatory landscape meant to protect citizens remains spotty and absent altogether in some regions.

In part one of this two-part series, we explained the fundamentals of mass biometric surveillance, whether ‘public safety’ is a pretext, and the impact of surveillance infrastructure on societies. In part 2, we explore how AI is amplifying the surveillance economy, power imbalances, and the governance gap, concluding with how transparency contributes to a culture of trust.

Written by Lindsay Langenhoven and co-authored by Rachel Fagen, in collaboration with Olivia Mora.

Scaling up mass surveillance with AI

AI can vastly amplify mass surveillance and its impact on society, automating data analysis, unifying disparate resources, and scaling infrastructure at a speed and scope that a human workforce would struggle to match. Research conducted on surveillance and AI accountability suggests that “each of these technologies changes the relationships between law enforcement operatives and citizens and requires the negotiation of new boundaries and revised accountability requirements.” We need policy guardrails that can keep pace and protect the public.

Today, the three main ways that AI is scaling surveillance include: 

1. Cost collapse: Cloud-based AI has made biometric processing affordable for actors like stadiums, retailers, and landlords, who could not previously afford dedicated infrastructure. 
2. Multimodal fusion: modern systems don’t just match a face; they fuse facial data with gait, voice, behavioral patterns, location history, and social graph analysis to produce identification that is harder to contest and harder to evade. 
3. Generative AI as a data laundering mechanism: synthetic, AI-generated faces used to augment training datasets can obscure the source of underlying real biometric data.

As AI capabilities scale, these systems pose a near-term threat to human autonomy that researchers call gradual disempowerment. In high-stakes domains like security and governance, handing over all our decisions to AI systems could “enable surveillance on a much larger, more pervasive, and more accurate scale, as well as increasingly capable autonomous military units,” researchers caution. Shifting away from a human-in-the-loop approach to surveillance risks not only our individual privacy but also democratic structures, human rights frameworks, and our collective agency. 

Considering that AI is a fundamental enabler for surveillance-state levels of control, policymakers from democratic and semi-authoritarian countries alike must closely guard against a shift from ambient AI-enhanced surveillance to an all-seeing, panopticon-style rule.

Image credit: Philipp Schmitt & AT&T Laboratories Cambridge / https://betterimagesofai.org / https://creativecommons.org/licenses/by/4.0/

Heightening power imbalances and the chilling effect

All too often, mass surveillance feeds power to those already in a position of power. As EDRi states, “[t]he use of biometric surveillance systems creates a dynamic where the powerful watch and the powerless are watched.” This imbalance plays out throughout the world, from ICE’s targeting of vulnerable populations and activists in the US to the digital authoritarianism in China, Bangladesh, Brazil, and Uganda, and dystopian migrant management in the EU.

According to researcher Virginia Eubanks, the root cause of this power imbalance stems from deeply embedded inequality. In her book ‘Automating Inequality,’ she demonstrates the concept of the “digital poorhouse”—how automated decision systems are tested on and deployed against people with the least political or economic wherewithal to resist them. 

The chilling effect is one phenomenon that clearly demonstrates such abuses of power. It is a mechanism that converts surveillance into social control without requiring any explicit enforcement action. This phenomenon is not hypothetical: the ACLU’s research on facial recognition cameras disproportionately installed in Black and Brown neighborhoods and the US Government Accountability Office’s (GAO’s) finding that six federal agencies used facial recognition to surveil Black Lives Matter protesters illustrate this.

A research paper documenting the chilling effect in Uganda and Zimbabwe revealed how interviewees’ fear of state surveillance prompted the following behaviors: 

• Self-censorship 
• An unwillingness to engage with individuals or organizations believed to be subject to surveillance 
• An erosion of trust which affected a group’s ability to organize and mobilize, and therefore to be effective politically

One respondent shared their lived reality:

There is a lot of fear. People can see the brutalization that is happening to activists now and they have opted to stay quiet for their own protection. Not a lot of people are willing to compromise their safety and the safety of their families, they would rather just conform and not be involved in those discussions. The risk of surveillance has cowered people into submission.

But these control mechanisms also extend beyond authoritarian states. Within the last few years, Austria used FRT to surveil protesters. Germany conducted mass biometric trials on travelers and monitored G20 demonstrators. Sweden’s police were fined for unlawfully deploying Clearview AI. More recently, the French government prioritized security over individual privacy in its approach to mass surveillance at the Paris Olympics, deploying AI-powered camera systems across public spaces.

[Recommended reading: A detailed timeline of AI-related human rights violations by SPAR fellow Olivia Mora]

When state power and corporate resources operate in alignment, the imbalance becomes structural and far harder to contest.

The growing influence of tech companies in surveillance

The major players in Big Tech—Google (Alphabet), Facebook (Meta), Amazon, Apple, and Microsoft—hold most of the market power, forming an information oligopoly.

Critically, these companies are not neutral vendors. They have commercial interests in expanding use cases, lobbying against regulation, and winning government contracts, making them powerful actors in governance itself. In her research, Shoshana Zuboff elaborates how surveillance capitalists, like Google, harness information capabilities in the service of state power, while states protect corporations from regulatory accountability. 

Drawing again on Clearview AI, their expansion during and after the Capitol attack on January 6, 2021, demonstrates this dangerous symbiosis. Their ties to immigration enforcement and near-impunity in the face of European fines reveal a clear power asymmetry. 

The sad reality is that Clearview is still operating today and expanding their surveillance operation after signing a contract with US Customs and Border Protection (CBP) to identify people and map their connections for national security and immigration operations. The unethical practices that they, and other Big Tech elites, have been normalizing in the shadows are laying the groundwork for surveillance powerhouses. Researchers warn that these organizations are secretly harvesting billions of the public’s photos and building a facial recognition tool so powerful “that law enforcement worldwide adopted it, often with little oversight.”

As surveillance capitalism grows, the worst-case scenario is a government that doesn’t just spy on its citizens but uses AI-powered corporate data to quietly control how we think and behave, all the while calling it “public safety.”

While countries like the US and China develop their own AI-driven surveillance tools, blurring the line between commerce and governance, in the Global South, those same tools are often imported, leading to wholesale digital authoritarianism.

Mass surveillance in the Global South

In Bangladesh, approximately 160 surveillance technologies and other spyware systems were imported by the government between 2015 and 2025. Research by the Tech Global Institute indicates that purchases increased notably just before or just after the country’s national elections in 2018 and 2024, suggesting “these technologies were likely used to suppress political and civic opposition, and maintain regime continuity.” 

Similar cases of misuse are spread across Africa. “Egypt, Kenya, Nigeria, Senegal, South Africa and Sudan have recently used digital surveillance to illegally monitor their citizens,” researchers note. In Uganda, human rights researchers warn that “the main objective behind using the intrusive surveillance on the citizens is to obtain their personal information, monitor their activities to be able to intimidate, manipulate, blackmail and execute citizens in order to keep them silent.”

Across the ocean, in Latin American regions, researchers report that the normalization of surveillance is directly eroding democracy, “creating conditions conducive to authoritarian governance. When states can systematically monitor journalists, human rights defenders, political opponents, and civil society, the essential mechanisms of democratic accountability are fundamentally undermined.” 

The convergence of government and corporate surveillance power, in an already fraught geopolitical climate, exposes the gaps in a lagging regulatory response.

Accountability and legal gaps

The legal landscape that should regulate biometric surveillance is patchwork at best, and nonexistent in many regions. 

In the EU, the EU AI Act (fully applicable August 2026) is the strongest binding framework globally, prohibiting real-time biometric identification in public spaces for law enforcement with narrow exceptions. Yet, Privacy International notes that domestic legislation remains a prerequisite for lawful use, and some national laws already appear to contravene the Act by using facial recognition to investigate minor offenses. Beyond the AI Act, the General Data Protection Regulation (GDPR), Law Enforcement Directive, and European Convention on Human Rights technically classify biometric data as requiring strict protection. Yet, all three can potentially be undermined by broad exceptions, vague thresholds, and inconsistent national application.

The UK has broad data privacy laws: the UK GDPR, the Data Protection Act, and the Data (Use and Access) Act, but none specifically govern mass biometric surveillance. The gap is evident: when Privacy International surveyed UK MPs about facial recognition use in their own constituencies, most were ill-informed or entirely unaware. Meanwhile, police and private actors are deploying FRT in retail spaces and transport hubs with little public consent or oversight.

In the US, despite data collection being a multi-billion-dollar industry, there is no federal privacy law. State-level protections are becoming more common but remain largely inadequate, with one exception, Illinois’ Biometric Information Privacy Act (BIPA). BIPA is currently the most effective, mainly because it creates a private right of action. Unfortunately, President Trump’s rescission of Biden’s Executive Order 14110 ultimately strips away algorithmic accountability measures and civil rights protections in favor of an AI race with minimal guardrails.

What we’re looking at is an accountability gap that’s epistemic, not merely legislative. Canada lacks a specific federal statute for facial recognition. Brazil has the General Data Protection Law (LGPD), but specific facial recognition regulation is still in development. Russia and China explicitly prioritize state security interests over individual privacy. Meanwhile, facial recognition use in schools is on the rise across the US, Canada, and Australia, with virtually no binding framework to govern it.

Beyond the binding laws that exist in specific regions, a collection of international instruments guides the ethical responsibilities of biometric surveillance. Notable examples, such as the OECD Recommendation on Artificial Intelligence (and its accompanying Privacy Guidelines) and the UNESCO Recommendation on the Ethics of Artificial Intelligence, establish baseline principles of transparency, accountability, and human rights that mass biometric surveillance routinely violates. 

Unfortunately, legal frameworks alone are a weak counterforce without transparency infrastructure.

Reducing mass biometric surveillance harms through transparency

Mitigating the growing risks of mass biometric surveillance in the age of AI begins with transparency. But it’s important to unpack what transparency requires in practice: who audits, with what authority, using what technical access, and what are the consequences for non-disclosure. 

Transparency as a concept can be co-opted easily, appearing as vague “AI principles” documents—a form of transparency theater.

Drawing a distinction between disclosure (telling people a system exists), auditability (enabling meaningful independent scrutiny of how it works), and accountability (consequences for misuse) is key. The component parts are not interchangeable, and conflating them is one of the most common ways that governance frameworks create the appearance of oversight without the substance of it.

Interestingly, safety and transparency don’t have to be mutually exclusive. In a public setting, surveillance technology, used ethically, can serve both security and transparency objectives, helping to build public trust.

Public Surveillance Transparency project

Transparency is not a sufficient solution on its own. It is the prerequisite for consent, accountability, and meaningful governance. Regulation, public education, civic organizing, and legal challenge all require first knowing what systems exist and how they operate.

As Alice Pavaloiu, Co-founder, Open Ethics explains: “Through transparency, organizations can transform surveillance from a threat to a social contract. By empowering citizens with tools to better understand how their personal data is used, you start to build trust.  Surveillance in public spaces can be done in an ethical way that balances people’s safety and privacy. Trust begins with transparency.”  

At Open Ethics, we’re working on ways to change the status quo with our Public Surveillance Transparency Project. This initiative helps municipalities, local governments, transportation authorities, and civil society organizations improve the transparency of their surveillance in public spaces, like transport hubs. 

The solution entails displaying transparency labels in a surveilled public location, enabling a bottom-up governance model through standardized disclosures. 

Example of a Public Surveillance Transparency Project label

To implement this, the system owner first needs to acquire the necessary information for the disclosure. This includes a description of what data is collected, the data source like an open dataset, how it’s processed, and how it informs decision-making. They’ll need that data from all vendors involved with the surveillance system: from the AI-powered CCTV camera providers to companies that analyze the data, integrate the data with other systems, and store the data. While the disclosure process does require effort from the system owner, they benefit by building a foundation for responsible and accountable use.

Next, the owner installs transparency labels (which include a QR code) in the surveilled location after setting up their infrastructure. By scanning the code, citizens instantly learn who is collecting their data, why, and how it’s processed. The label displays core information: the owner of the system, their contact details, surveillance scope, location, and other essential elements. Citizens can then submit feedback directly to their data protection authority and the system owner, creating measurable transparency.

However, this approach is not without its limitations. Success relies on active public engagement, and independent verification of disclosures may be needed. What’s more, without mandatory compliance, enforcement remains a challenge.

Despite this, institutions are incentivized to adopt the project to demonstrate accountability and balance public safety with individual privacy. Implementation can help shift public sentiment away from the “chilling effect” toward a culture of trust. 

———

If your organization is interested in more transparent and accountable surveillance practices in public spaces, we’d love to chat with you. Let’s explore what a successful pilot project would look like for your particular use case.