Facial recognition technology and the Right of Publicity: Could this hot tech trend violate state laws?

If someone uses a photograph of your face for commercial purposes they could be breaking the law. In an odd way, this statement connects two areas of my life, information security and movie making. Photographs of faces are used in some security systems and lots of movies. When you make a movie it is standard procedure to ask permission to use a person's picture. You record that permission with an "Image Release" that is signed by the person, or their guardian if they are under 18. Here is part of a standard release like the one we used for our movie:

"I grant permission to The Movie and its producers, to take and use visual/audio images of me for their production. The images may be used in any manner or media such as publication, promotions, broadcasts, advertisements, posters and theater or home video distribution. I wave any right to inspect or approve the finished images...I release The Movie and its producers and agents...from any claims, damages, or liability which I may ever have in connection with the taking of and use of the images or printed material used with the images."

The reason for such broad language is the breadth of a legal right with which many Americans are not familiar: The Right of Publicity or RoP. Now might be a good time for venture capitalists and Silicon Valley engineers to familiarize themselves with RoP. Why? Consider what my good friend and colleague Cameron Camp recently wrote about over on the ESET Threat Blog: the use of facial recognition for commercial purposes. Cameron provided some interesting commentary on a startup venture that had the following idea, something that might sound like a cool marketing ploy but which might also be, as I will argue, illegal:

Networked cameras in shops scan the faces of customers and try to match them with faces of Facebook users who have signed up for special deals.

At first blush this sounds like an automated version of my brother's butcher. The analogy goes like this: My brother works from home so he tends to be the one cooking dinner and, because he and his wife like to live in small villages in Europe, he buys the meat for those meals fresh, almost every day of the week, not in a weekly trek to a big supermarket. So my brother gets to know his local butcher and the local butcher rewards local customers with special deals, made on the spur of the moment, based on a form of facial recognition that I like to call: "Hi Mike, how's it going?"

The problem with the computerized version is that having your picture taken by a digital camera is a lot different from your local butcher memorizing your face in his brain. Transferring that digital image over the public Internet to a vast server farm that might be thousands of miles away, possibly in a different country, introduces concerns way beyond any misgivings you might have about the butcher remembering your face. Consider what has to happen to reward people who have opted in to this facial-deal scheme:

1. Take a picture of every customer.


2. Isolate the face within each image and send to a server which can scan it against a database of known faces belonging to people who have opted in.


3. Return a result when there is a match.

In other words, you are photographing people in such a way that their identity is clear, then using those photographs for commercial purposes (specifically deciding who gets a particular deal but in general promoting your business so it is more appealing than your competition). Now consider this piece of law, on the books since 1903, namely Article 5, Section 50 of New York State Consolidated Laws:

Sec. 50. Right of privacy. A person, firm or corporation that uses for advertising purposes, or for the purposes of trade, the name, portrait or picture of any living person without having first obtained the written consent of such person, or if a minor of his or her parent or guardian, is guilty of a misdemeanor.

I know this statute is labeled "Right of privacy" but lawyers assure us it is the basis of the Right of Publicity. The key words are: Uses the picture of any living person for the purposes of trade.

So, if you design a facial recognition deal scheme based on photographing everyone, regardless of permission, in order to pick out specific individuals who have given permission, you would seem to be violating this law and the Right of Publicity, which is enshrined in many state statutes, as described on the Right of Publicity website, rightofpublicity.com:

As of this writing, nineteen states recognize the Right of Publicity via statute (California, Florida, Indiana, Illinois, Kentucky, Massachusetts, New York, Nebraska, Nevada, Ohio, Oklahoma, Pennsylvania, Rhode Island, Tennessee, Texas, Utah, Virginia, Washington and Wisconsin). The majority view is that the right exists by common law in every state that has not defined its position through legislation. The American Law Institute’s Third Restatement of Unfair Competition (1995) §46 also recognizes the Right of Publicity as a distinct and viable legal theory.

I don't want this blog post to come across as an attack on a particular startup or technology, but I do note that one of the states in the above list is Tennessee, which is where the startup described by Cameron is located. One might argue that the Right of Publicity is more widely known in Tennessee than some other states because Tennessee law extends the right to deceased persons, Elvis Presley being the most frequently cited example. Unfortunately, this emphasis on celebrity cases leads some people to assume that only celebrities have a Right of Publicity but this is not the case. Numerous states have made this quite clear: You don't have to be famous for use of your face, without permission, for commercial purposes, to be against the law.

Facial recognition technology is currently hotter than hot in VC and startup circles, partly driven by Facebook's massive accumulation of facial data (it reportedly scans 300 million photos a day for faces). The hottness of facial recognition seems to have increased of late despite the fears expressed by privacy advocates. Yet I don't hear many people loudly proclaiming that commercial facial recognition, through its requirement that non-opt-in faces be checked for opted-in faces, violates the Right of Publicity. (There are some instances of people raising aspects of this point: Tim Bukher, Derek Bambauer, and hopefully it was considered at the FTC forum on the topic.)

Of course, I need to put the standard disclaimer out there: I am not a lawyer. On the other hand I have spent 25 years thinking hard about the spaces where privacy, security, and technology intersect. I have also started several successful companies and produced an award-winning movie. While it is entirely possible that I am missing something that invalidates my argument, I have a strong hunch that some forms of facial recognition violate the Right of Publicity.

(Unless someone points out a big hole in my argument I will try to write more about this topic when I get time, perhaps looking at how facial recognition in a commercial security system is affected by RoP, but my immediate task is to review the terms and conditions over on Facebook to make sure they include, as I suspect they do, permission to use my face for commercial purposes--I'm sure the lawyers at Facebook took heed of RoP, right?)