Facebook's Face Recognition Privacy Setting Missing for Some Users

Consumer Reports finds uneven access to the setting nearly 18 months after it was announced

screen capture
A video posted by Facebook in 2017 explains the Face Recognition setting and says that any user can opt out of the company's facial recognition program.
FB screen capture

Update: In September, after this Consumer Reports investigation was published and a settlement with the Federal Trade Commission over privacy practices was announced, Facebook announced it was rolling out the Face Recognition setting to all users. This article was originally published on May 20, 2019.

Facebook users don’t all have access to an important privacy setting for controlling whether the company can collect facial recognition data, Consumer Reports has found.

Facebook announced the new setting in a blog post on Dec. 19, 2017. That was three months before the Cambridge Analytica scandal broke, at a time when the company was already under scrutiny for its privacy practices and misinformation on the platform.

“The words ‘face recognition’ can make some people feel uneasy,” read the post, which was signed by Rob Sherman, the company’s deputy chief privacy officer. “When it comes to face recognition, control matters.” A video on the same page said, “Anyone can opt out of face recognition entirely through their Facebook account settings.”

Nearly 18 months later, many Facebook users have been granted that control, but others have not.

Consumer Reports examined the accounts of 31 Facebook users across the U.S. The participants let us record video as they navigated their Facebook settings under our direction. We found the Face Recognition setting missing from eight of the accounts we documented, or just over 25 percent.

More on Privacy

“This was a small, qualitative study, and we don't know exactly how many people are missing the setting. But, we can infer that many Facebook users may be affected,” says Bobby Richter, who leads privacy and security testing for Consumer Reports.

Unlike other Facebook users, people without the setting have no clear way to opt out of facial recognition.

Privacy experts we consulted were surprised. “If Facebook is purporting to provide a setting that is missing for some users, that’s a problem. At the very least it demonstrates a lack of commitment to protecting consumers’ privacy,” says Justin Brookman, director of privacy and technology policy at Consumer Reports. (On Monday, Consumer Reports sent a complaint to the Federal Trade Commission, which is currently investigating Facebook, detailing what we found.)

Facial recognition is a powerful tool that is of increasing interest to police departments, airports, retailers, and even some schools for surveillance and security, along with advertisers for targeted marketing. The technology can be used to identify individuals’ races, ages, and genders.

In its online Help Center, Facebook says that facial recognition is used to assist users in tagging photos and videos with the names of other Facebook users, to aid the visually impaired, and to help the company spot fake accounts. The technology works by creating a mathematical “template” that corresponds to your features.

The Help Center promises, “If your face recognition setting is set to off, we delete the template.”

“Since the company has one of the largest name-face databases in the world and the power to infer significant things about people whom it identifies, it’s especially important that it craft and execute appropriate policies for face recognition,” says Evan Selinger, who studies the technology as a philosophy professor at the Rochester Institute of Technology and a senior fellow at the Future of Privacy Forum.

“All users should be able to access the same easy-to-use setting for preventing Facebook from recognizing them in photos and videos, and for deleting their templates,” he says.

Facebook has not responded to requests for information on how many people are missing the Face Recognition setting, or why it is available to some Facebook users but not to others.

facebook concept
A slideshow on Facebook's Privacy Basics page explains the Face Recognition setting. It reads, in part, "You can turn the setting on or off at any time."

FB screen capture FB screen capture

Facial Recognition at Facebook

Facebook started using facial recognition to help users tag friends in photos in December 2010. At the time, the company introduced a setting called Tag Suggestions, which gave users a way to prevent their names from popping up on the platform when Facebook identified their faces in photos. However, the company didn’t provide a clear way for users to stop Facebook from scanning their photos, or to delete facial recognition data it had already gathered.

When the Face Recognition setting was introduced, it replaced the Tag Suggestions setting for most users.

“We learned in our research that people want a way to completely turn off face recognition technology rather than on a feature-by-feature basis,” the 2017 blog post on Face Recognition read. “Our new setting is an on/off switch. Some may criticize this as an ‘all or nothing’ approach, but we believe this will prevent people from having to make additional decisions among potentially confusing options.”

Every account Consumer Reports examined has either the old Tag Suggestions setting or the new Face Recognition one, but not both. (Users who no longer have the Tag Suggestions option still have other settings for tagging, including a way to control who sees tagged posts.)

Consumer Reports couldn’t spot any factors that seemed to predict which setting a user would have. We looked at whether people had uploaded photos of themselves and whether they were using a photograph as their profile picture. We also noted when their accounts were created, how many Facebook friends they had, and where they lived. And we asked users questions such as how often they use the platform, and even what kind of phone they have.

“Without more data, it’s difficult to make a conclusive judgment. But from the outside, none of these factors seem to affect whether or not you get the setting," CR’s Richter says. "It appears to be random.”

We also conducted some other small experiments. About a half-dozen new test accounts we created lacked the Face Recognition setting, and Tag Suggestions was turned on by default. We did spot checks on Facebook’s mobile apps for both iPhones and Android devices to make sure the settings matched what we saw on desktops.

In addition, we asked members of two Consumer Reports Facebook groups to check whether they had the Face Recognition setting. Most said they did have it, but a number did not.

“Honestly, I didn't really even know Facebook was doing” facial recognition, says Brian Mitchell, a member of CR's Consumer 101 Facebook group from Cleveland, Ohio. “I think since the feature is there, everyone should have the ability to turn it on or off. It's bizarre that not everyone can.“

facebook concept
Under Privacy Shortcuts, some users have a link labeled, "Control face recognition." Others users do not.

FB screen capture FB screen capture

Few Rules on Facial Recognition

Facebook says it does not use facial recognition for advertising or marketing purposes.

However, the company has filed multiple patents for additional uses of facial recognition, such as linking shoppers in stores to their social media accounts, identifying users’ emotions, and spotting faces and objects in family photos.

No federal laws specifically govern the use of facial recognition or other biometric data such as fingerprints and retinal scans, but a handful of states and municipalities have passed regulations. San Francisco recently approved a city-wide ordinance restricting the use of facial recognition technology by government agencies such as the police. And a lawsuit by consumers alleges that Facebook’s facial recognition practices violate Illinois’ Biometric Information Privacy Act.

The Federal Trade Commission says it’s studying whether Facebook has violated a 2011 consent decree over "unfair and deceptive" claims concerning privacy, and Facebook told investors in April that it might be fined $3 to $5 billion. Brookman says this new information could create more legal trouble for the company.

Prior to joining Consumer Reports, Brookman was policy director of the FTC's Office of Technology Research and Investigation.

Consumer Reports found a number of places on Facebook that tell users how to control their data by using the Face Recognition setting. For instance, a slideshow in the company’s Privacy Basics section explains the technology and provides a link to the setting. But if you don’t have the Face Recognition option, the link instead brings you to the main account settings page. No explanation is given—it’s up to you to figure out that the Face Recognition setting hasn’t been provided for your account.

“The FTC has brought a number of cases on the theory that companies offered privacy controls that didn't work and against companies who made misleading statements about privacy practices in consumer-facing material,” Brookman says.

Experts we spoke to said that confusing privacy settings can hurt consumers by discouraging them from even trying to exert control over their personal data.

“Making these settings selectively available—or not available for certain people at all—means that users will be confused about whether the setting exists or not,” says Florian Shaub, an assistant professor at the University of Michigan School of Information. “This is really a mess.”

Many people are concerned about collection of personal data by technology companies. In a nationally representative survey of more than 2,000 U.S. adults conducted by Consumer Reports in 2019, nearly 25 percent of Facebook users said they were “extremely” or “very” concerned about the volume of personal information the company collects and stores.

One participant in our online study from Green Bay, Wis., who did have the Face Recognition setting, says she had no idea the control was turned on until we directed her to it. During our test, she switched it off. “I was shocked,” she says. “That was very upsetting.”

facebook screen grab
Facebook users seem to get one of two settings (above). The one on the left asks: "Do you want Facebook to be able to recognize you in photos and videos?"

Consumer Reports Consumer Reports

How to Adjust the Settings

If you have access to the Face Recognition setting, you’ll find it on your main account settings page. You can navigate there by opening the menu in the top right corner of any Facebook page if you're using a desktop browser. If the control is available to you, you’ll see a link to the Face Recognition setting page about halfway down the list of options.

To delete the facial recognition template and opt out of any features that use the technology, open the Face Recognition tab. The text reads “Do you want Facebook to be able to recognize you in photos and videos?” Click "Edit" and choose "No."

If you do have Face Recognition, you won’t have Tag Suggestions, but you will have other controls unrelated to facial recognition under Timeline and Tagging.

If you don’t see the Face Recognition setting, you should have the Tag Suggestions setting. From your main account settings page, click “Timeline and Tagging.” (This appears in the left-hand column if you’re using a desktop browser.) Then select “Who sees tag suggestions when photos that look like you are uploaded?” From the drop down menu, select “No one.”

The Facebook mobile app has the same settings.

Open the app, and tap the menu icon with three stacked horizontal lines in the corner of the screen. Then scroll down to Settings & Privacy, near the bottom of the list of options. Tap on Settings to find Face Recognition, if it’s available to you. You’ll also see Timeline and Tagging. (Instead of Settings, you can also tap on Privacy Shortcuts to navigate to the Face Recognition page.)

Headshot image of Electronics editor Thomas Germain

Thomas Germain

I want to live in a world where consumers take advantage of technology, not the other way around. Access to reliable information is the way to make that happen, and that's why I spend my time chasing it down. When I'm off the clock, you can find me working my way through an ever-growing list of podcasts. Got a tip? Drop me an email ( thomas.germain@consumer.org) or follow me on Twitter ( @ThomasGermain) for my contact info on Signal.