Face ID

Face ID is a biometric authentication facial-recognition system designed and developed by Apple Inc. for the iPhone and iPad Pro. The system can be used for unlocking a device, making payments, accessing sensitive data, providing detailed facial expression tracking for Animoji, as well as six degrees of freedom (6DOF) head-tracking, eye-tracking, and other features. Initially released in November 2017 with the iPhone X, it has since been updated and introduced to all iPhones outside of SE models and all iPad Pro models from 2018 onwards. Users on iOS 18 and newer can choose to lock specific apps, requiring Face ID to access them.

The Face ID hardware uses a TrueDepth Camera that consists of a sensor with three modules; a laser dot projector that projects a grid of small infrared dots onto a user's face, a module called the flood illuminator that shines infrared light at the face, and an infrared camera that takes an infrared picture of the user, reads the resulting pattern, and generates a 3D facial map.

Face ID has sparked a number of debates about security and privacy. Apple claims that Face ID is statistically more advanced than Touch ID fingerprint scanning. It exhibits significantly fewer false positives. Multiple security features are in place to limit the risk of the system being bypassed using photos or masks, and only one proof-of-concept attempt using detailed scans has succeeded.

Debate continues over the lack of legal protections offered by biometric systems as compared to passcode authentication in the United States. Hackers have been able to use combinations of FaceID data and SMS messages to enter various locked information on Apple users iPhones protected by FaceID technology. Privacy advocates have also expressed concern about third-party app developers' access to "rough maps" of user facial data, despite rigid requirements by Apple of how developers handle facial data. Privacy concerns also exist regarding the use FaceID data to retrieve other personal information stored on Apple technology. Use of FaceID technology and biometric data in criminal cases as been of much debate due to lack of legal regulation. FaceID has been compared to fingerprint and passcode locking mechanisms to evaluate the ethics behind use of FaceID in criminal cases. Finally, infiltration on Apple products has been a concern of the public as twins and close relatives have been successful in fooling the FaceID technology. Facial replication into realistic masks has been an infiltration concern, but has thus far been unsuccessful.

With the onset of the COVID-19 pandemic, it was noted that Face ID was unable to recognize users wearing face coverings on some devices. Apple responded to criticism by offering faster fallback to passcode input, and the option for Apple Watch users to confirm whether they intended to unlock their iPhone. In March 2022, Apple released iOS 15.4 which adds mask-compatible Face ID for iPhone 12 and later devices.

History

Apple announced Face ID during the unveiling of the iPhone X on September 12, 2017. The system was presented as the successor to Touch ID, Apple's previous fingerprint-based authentication technology embedded in the home button of the iPhone 8 and earlier devices in addition to the second and third-generation iPhone SE. On September 12, 2018, Apple introduced the iPhone XS and XR with faster neural network processing speeds, providing a significant speed increase to Face ID. On October 30, 2018, Apple introduced the third generation iPad Pro, which brings Face ID to the iPad and allows face recognition in any orientation. iOS 13 included an upgraded version of Face ID which is up to 30% faster than Face ID on previous versions.

In February 19, 2025, following the announcement of the iPhone 16e and the discontinuation of the iPhone SE (3rd generation), all the iPhone models have transitioned from the Touch ID to Face ID.

Technology

Face ID's technology is based on PrimeSense's previous work with low-cost infrared depth perception that was the basis of the Kinect motion sensor for the Xbox console line from Microsoft; Apple had acquired PrimeSense in 2013 after Microsoft started to wane on the use of Kinect.

Face ID is based on a facial recognition sensor that consists of two parts: a vertical-cavity surface-emitting laser dot projector module that projects more than 30,000 infrared dots onto the user's face, and an infrared camera module that reads the pattern. The pattern is projected from the laser using an Active Diffractive Optical Element which divides the beam into 30,000 dots.

The TrueDepth Camera uses infrared light to create a 3D map of users unique facial identity. This map is compared with the registered face using a secure subsystem, and the user is authenticated if the two faces match sufficiently. The system can recognize faces with glasses, clothing, makeup, and facial hair, and it adapts to changes in appearance over time. Concerns regarding the safety of longterm infrared facial screening has been debated and studied.

The pattern is encrypted and sent to a local " Secure Enclave" in the device's CPU to confirm a match with the registered face. The stored facial data is a mathematical representation of key details of the face, and it is inaccessible to Apple or other parties. To avoid involuntary authentication, the system requires the user to open their eyes and look at the device to attempt a match, although this can be disabled through an accessibility setting. Face ID is temporarily disabled and the user's passcode is required after 5 unsuccessful scans, 48 hours of inactivity, restarting the device, or if both of the device's side buttons are held briefly.

Apple claimed the probability of someone else unlocking a phone with Face ID is 1 in 1,000,000 as opposed to Touch ID at 1 in 50,000. During initial setup, the user's face is scanned twice from a number of angles to create a complete reference map. As the system is used, it learns about typical variations in a user's appearance, and will adjust its registered face data to match aging, facial hair growth, and other changes using the Neural Engine. The system will recognize a face wearing hats, scarves, glasses, most sunglasses, facial hair or makeup. When significant facial changes occur, FaceID may not recognize the person when comparing the image to stored data. In such cases, the user will be prompted to verify using their passcode and the facial recognition data will update to the changes. It also works in the dark by invisibly illuminating the whole face with a dedicated infrared flash module.

Authentication with Face ID is used to enable a number of iOS features, including unlocking the phone automatically on wake, making payments with Apple Pay, and viewing saved passwords. Apps by Apple or third-party developers can protect sensitive data with a system framework; the device will verify the user's identity and return success or failure without sharing face data with the app. Additionally, Face ID can be used without authentication to track over 50 aspects of a user's facial expression and positioning, which can be used to create live effects such as Animoji or camera filters. In recent years, third-party developers have developed more use cases for FaceID such as e.g. Eyeware Beam, an iOS app that provides a reliable and precise, multi-purpose head and eye-tracking tool. It is used to enable control of the camera angle through head-motion-in games and eye-tracking to share attention with audience in streams, but also augmentative and alternative communication (AAC) and biometric research.

Devices with Face ID

* iPhone X (2017) and newer, except the 2nd and 3rd generation iPhone SE
* iPad Pro (3rd generation, 2018) and newer

Safety

Face ID uses an infrared flood illuminator and laser infrared dot projector. Prolonged exposure to infrared light has been known to cause harm to skin and the eyes. Apple has stated that the output is low enough that it will cause no harm to the eyes or skin, and meets 'international safety standards'. FaceID infrared output has been compared to what is put out from TV remotes. They do not, however, recommend the sensor be repaired by third parties, citing security concerns. There is also an in-built feature to deactivate Face ID should unauthorized components be found.

Issues

Twins and close relatives

Inconsistent results have been shown when testing Face ID on identical twins, with some tests showing the system managing to separate the two, while other tests have failed. The system has additionally been fooled by close relatives. Apple states that the probability of a false match is different for twins and siblings, as well as children under 13 years of age, as "their distinct facial features may not have fully developed".

Law enforcement access

Face ID has raised concerns regarding the possibility of law enforcement accessing an individual's phone by pointing the device at the user's face. United States Senator Al Franken asked Apple to provide more information on the security and privacy of Face ID a day after the announcement, with Apple responding by highlighting the recent publication of a security white paper and knowledge base detailing answers.

In August 2018, the FBI obtained a warrant to search the property (which includes electronic devices) of a man, Grant Michalski, accused of transmitting child pornography; they unlocked the suspect's iPhone by holding it up to his face, without needing his passcode.

''The Verge'' noted that courts in the United States have granted different Fifth Amendment rights to keycode and biometric unlocking systems. Keycodes are considered "testimonial" evidence based on the contents of users' thoughts, whereas fingerprints are considered physical evidence, with some suspects having been ordered to unlock their phones via fingerprint. Debates are ongoing regarding the use of FaceID technology in law enforcement and criminal cases as laws and regulations have not yet been put in place. Currently, law enforcements' need for evidence is to be balanced with individual privacy rights in regards to biometric data.

Infiltration

Verification experts claim that if biometric technology does not account for skin texture or blood flow, sophisticated masks may be successful in bypassing FaceID technology. However, many people have attempted to fool Face ID with sophisticated masks, though most have failed. In November 2017, Vietnamese security firm Bkav announced in a blog post that it had created a $150 mask that successfully unlocked Face ID, but ''WIRED'' noted that Bkav's technique was more of a "proof-of-concept" rather than active exploitation risk, with the technique requiring a detailed measurement or digital scan of the iPhone owner's face, putting the real risk of danger only to targets of espionage and world leaders.

Third-party developers

If the user explicitly grants a third-party app permission to use the camera, the app can also access basic facial expression and positioning data from Face ID for features such as precise selfie filters such as those seen in Snapchat, or game characters mirroring real-world user facial expressions. The data accessible to third parties is not sufficient to unlock a device or even identify a user, and Apple prohibits developers from selling the data to others, creating profiles on users, or using the data for advertising. The American Civil Liberties Union and the Center for Democracy and Technology raised privacy questions about Apple's enforcement of the privacy restrictions connected to third-party access, with Apple maintaining that its App Store review processes were effective safeguards. Jay Stanley, a senior policy analyst with the ACLU, has stated that the overall idea of letting developers access sensitive facial information was still not satisfactorily handled, with Stanley telling ''Reuters'' that "the privacy issues around of the use of very sophisticated facial recognition technology for unlocking the phone have been overblown. The real privacy issues have to do with the access by third-party developers".

Hacking concerns

Mobile hackers have been able to combine data from FaceID and SMS one-time verification codes to access information from other accounts of Apple devices. Bank accounts of users in Asia and the Pacific Islands have been breached in isolated attacks by mobile hackers using FaceID data. Hackers were able to use facial images, stored in FaceID data, to make deepfake images that open information secured on Apple users devices with FaceID security. Combining FaceID data and one-time SMS verification codes gave hackers access to various FaceID protected accounts. While these cyber attacks have been isolated in Asia and the Pacific Islands, it raises concerns about the security of FaceID technology.

On the dark web, users have been selling their personal FaceID images and identity for acute financial gain. Hackers are using identities bought off the dark web for "sophisticated impersonation fraud". This type of "hacking" or fraud is extremely difficult to detect because the FaceID documents submitted are real, as they are coming directly from the user, meaning they match biometric FaceID data almost perfectly.
iProov
a biometric data verification service, has suggested various ways to prevent FaceID biometric data from being successfully used to hack user data. "Embedded imagery and meta data analysis" can be used detect if FaceID images are a real person or a media image. Technology can be used to quickly detect and respond to threats on verification systems using FaceID through ongoing monitoring and proactively searching for threats. With adequate training, engineers can learn how to reverse potential hacking situations to better understand how to prevent them. Without understanding how hackers are using FaceID biometric data to bypass verifications, ways to prevent cyber attacks can better be initiated to protect users.

Use with face masks

During the COVID-19 pandemic, face masks were employed as a public and personal health control measure against the spread of SARS-CoV-2. Face ID at the time was incompatible with face masks, with Apple stating "Face ID is designed to work with your eyes, nose and mouth visible." With the release of iOS 13.5, Apple added a feature that automatically brought up the passcode screen if it detected that the user was wearing a mask. Apple was criticized for not addressing these issues with the release of the iPhone 12, but was praised for the lack of inclusion of Face ID in favor of Touch ID integration into the power button on the fourth-generation iPad Air. In April 2021, Apple released iOS 14.5 and watchOS 7.4 with an option to allow Apple Watch to act as a backup if Face ID fails due to face masks. In March 2022, Apple released iOS 15.4 which adds mask-compatible Face ID for iPhone 12 and later devices.

See also

* Touch ID
* Vertical-cavity surface-emitting laser
* Structured-light 3D scanner

References

External links

Official website

{{Apple

Computer-related introductions in 2017
Facial recognition software
IOS
Authentication methods