Why Parents Should Think Carefully Before Kids Use Face ID

Passwords are annoying. Face ID is fast. That’s the entire sales pitch, and it works. Most parents set up Face ID on a kid’s phone without a second thought — it’s just a convenience feature, right?

Here’s what the convenience trade-off actually looks like: when your child enrolls their face in Face ID, Apple’s TrueDepth camera projects 30,000 infrared dots onto their face, creates a 3D depth map, and converts it into a mathematical representation called a facial embedding. That embedding is stored in the Secure Enclave on the device. The face itself is never stored — just the math. Apple can’t read it, and it never leaves the device under normal circumstances.

That’s Apple. The question worth asking is: what about the other systems your kid encounters that use facial recognition, fingerprints, or voice? Not all of them are Apple. Not all of them store data locally. And unlike a compromised password, a compromised facial embedding cannot be reset.

Why Parents Don’t Know This

The word “biometrics” sounds technical and distant — something from spy movies or airport security. But your kid is probably using some form of biometric authentication daily: Face ID or Touch ID on a phone, fingerprint login on a school Chromebook, voice recognition for a smart speaker. These feel mundane because they’ve been normalized.

What most parents haven’t been told: biometric data is categorically different from other personal data. A stolen credit card number gets cancelled. A leaked password gets changed. A leaked facial recognition model built from your child’s face cannot be un-leaked. The underlying face doesn’t change. This is the permanence problem, and it’s why biometric data collected from minors deserves a different level of scrutiny than, say, an email address.

The data privacy landscape for kids’ biometrics is patchy. Federal law (COPPA) offers some protections for children under 13. A handful of states — Illinois, Texas, Washington — have biometric-specific laws. Most states have nothing. Schools are actively collecting biometric data in some districts, often without adequate legal clarity on retention and deletion.

What the Research and Data Show

The technology behind facial recognition has improved dramatically over the past decade. Google’s FaceNet architecture, published in 2015, achieved 99.63% accuracy on the LFW (Labeled Faces in the Wild) benchmark — close to human-level accuracy on standard identification tasks (Schroff et al., 2015). ArcFace, a 2019 improvement, pushed accuracy higher still and became the standard architecture for production facial recognition systems (Deng et al., 2019).

What both systems do: they don’t store a photo of your face. They run a neural network over the photo and produce a 128- or 512-dimensional vector — a list of numbers representing abstract features of your face geometry. Two vectors representing the same person will be very close together in that mathematical space. Two vectors representing different people will be far apart. Authentication works by checking whether a new vector is close enough to the stored one.

The key insight for parents: once that vector is extracted and stored somewhere, it represents your child’s face permanently. Even if the database deletes the original photos, the vector can be used to match your child’s face against future photos. This is called a “face print,” and it’s exactly what Illinois’s Biometric Information Privacy Act (BIPA) was designed to regulate.

Biometric Type	How It’s Stored	What Happens If Leaked	Can It Be Changed?
Face ID (Apple)	Math embedding, local Secure Enclave only	Very limited — not transmitted off-device	No — the face doesn’t change
Third-party facial recognition	Varies — often cloud-stored embedding	Could be used to identify person in future photos	No
Fingerprint (Touch ID / sensor)	Minutiae points (ridge endings, bifurcations)	Could be used to forge fingerprints	No — fingers don’t change
Voice recognition	Voice print (acoustic feature vector)	Could enable voice spoofing	Partial — voice changes somewhat with age
Password	Hashed value (if done correctly)	Password can be changed	Yes — immediately
PIN	Hashed or plaintext	Can be changed	Yes — immediately

A 2022 investigation by the Electronic Frontier Foundation found that at least 50 U.S. school districts had deployed facial recognition technology for student identification or security, with minimal parental notification and widely varying data retention policies (EFF, 2022). Some vendors retained biometric data for years after students graduated; none had a clear breach notification protocol specific to biometric data.

The legal framework matters here. BIPA — the Illinois Biometric Information Privacy Act, passed in 2008 — is the strongest biometric privacy law in the U.S. It requires: written notice before biometric collection, stated purpose and retention schedule, written consent, and prohibition on selling or profiting from biometric data. Critically, it gives individuals a private right of action — meaning you can sue a company that violates it without waiting for a government agency to act. Texas and Washington have similar laws but without the private right of action. The vast majority of states have nothing.

COPPA (Children’s Online Privacy Protection Act) covers children under 13 and requires verifiable parental consent before collecting personal information — which the FTC has interpreted to include biometric identifiers. But COPPA only applies to online services; it does not apply to school-based systems or apps used in a school context, where FERPA (Family Educational Rights and Privacy Act) applies instead. FERPA has weaker biometric protections than COPPA.

How the Technology Actually Works

Facial recognition: FaceNet and ArcFace

When Apple’s Face ID scans your child’s face, the process runs entirely on-device. The neural network extracts facial landmarks — the geometry of eye spacing, nose bridge, jawline — and compresses them into the embedding vector. Apple’s Secure Enclave is a dedicated processor isolated from the main iOS operating system; even Apple’s own software cannot read the stored embedding.

Most third-party facial recognition systems don’t use the Secure Enclave model. A school check-in system, for example, typically captures an image via a camera, sends it to a cloud API, receives a matched identity back, and logs the result. Where the embedding is stored, for how long, with what security, and whether it’s ever shared with other parties depends entirely on the vendor’s contract and privacy policy — documents that most parents have never seen.

Fingerprint scanners: minutiae extraction

Fingerprint readers don’t store your fingerprint image. They extract a set of “minutiae” — the specific points where a fingerprint ridge ends or splits. A typical fingerprint has 40–100 usable minutiae. The scanner converts these points into a template (another vector), stores the template, and compares future scans against it. The template is smaller than the original image and cannot be used to reconstruct the fingerprint visually — but it can absolutely be used to confirm a match.

Voice recognition: voiceprint modeling

Voice authentication systems analyze spectral features of speech — the acoustic signature produced by your vocal tract, which is anatomically distinctive. A 2021 study in Computer Speech & Language demonstrated that voiceprint models built from as little as 10 seconds of speech could be used to verify identity with greater than 90% accuracy (Nagrani et al., 2021). Crucially, voice changes somewhat with age, illness, or injury — which is why voice authentication typically has wider matching thresholds than facial or fingerprint recognition, and slightly lower security.

What This Means for Your Kid’s Career Future

Biometric security is a growing field with a genuine talent shortage. The National Institute of Standards and Technology (NIST) runs the Face Recognition Vendor Test (FRVT) — a continuous evaluation of facial recognition system accuracy and bias across different demographics. NIST engineers who run this program represent a career path in federal technology policy that most kids have never heard of.

Private-sector roles include biometric systems engineer, identity verification specialist, and AI security researcher. The AI safety and privacy space — which includes adversarial attacks on biometric systems, bias testing, and privacy-preserving machine learning — is expanding rapidly. The skills required overlap substantially with computer vision and machine learning, but with a legal and ethical dimension that distinguishes it from pure engineering.

If your child is drawn to both technical and policy questions — the “is this legal” and “how does this work” questions simultaneously — biometric privacy and AI security is one of the few fields where both matter equally. A student who understands FaceNet architectures AND Illinois’s BIPA statute is genuinely rare and genuinely valuable.

For more on the career intersection of AI and social impact, the article on AI literacy for kids in middle school covers how to build foundational understanding of how AI systems make decisions — the same framework that applies to biometric AI.

What Parents Should Do

1. Audit which biometric systems your child currently uses

Start with inventory. Face ID or Touch ID on the phone — note whether it’s stored on-device only (Apple) or synced anywhere. Fingerprint login on a school device — contact the school’s IT department and ask: where is the biometric data stored? Who has access? What is the retention policy? How would they notify you of a breach?

2. Read any school technology use agreements before signing

Many schools send home “acceptable use policies” and technology consent forms without any biometric-specific language. If your school uses a fingerprint lunch system, facial recognition attendance, or voice-activated learning tools, ask to see the vendor’s privacy policy and data processing agreement. If the school district is in Illinois, BIPA requires written disclosure regardless of whether you ask.

3. Teach the permanence concept directly

Tell your child: “You can change a password in two minutes. You cannot change your face. That’s why the data that describes your face needs to be protected differently.” This is a concept that lands well with kids ages 10 and up. It’s not about fear — it’s about understanding why some data is treated as more sensitive than others.

4. Choose on-device biometrics where possible

For household device use, prefer platforms where biometric data stays on-device. Apple’s Face ID and Touch ID are designed with local storage as a core security principle. Android’s built-in fingerprint and face recognition (via Google’s TEE/Secure Element architecture) also stores templates locally on most devices. Third-party apps that request facial recognition access should be treated with more scrutiny.

5. Know your state’s biometric laws

If you live in Illinois: BIPA gives you legal recourse if a company collects your child’s biometric data without written consent. If you live in Texas or Washington: similar laws exist but you cannot sue directly. In most other states: you are relying on COPPA for under-13s and company privacy policies for teens. The Electronic Frontier Foundation maintains a state-by-state privacy law tracker at eff.org.

6. Have the consent conversation

When your teen encounters a new app or system asking for facial scan or fingerprint access — “Sign in with your face” — teach them to ask three questions before agreeing: Where will this data be stored? Can I delete it later? What happens to it if this company is sold or hacked? Most apps won’t answer clearly. That answer is itself informative.

What to Watch Over the Next 3 Years

Federal biometric privacy legislation has been introduced in Congress repeatedly since 2020. The American Data Privacy and Protection Act (ADPPA) — which would create a national standard — has stalled, but versions of it continue to be reintroduced. If a federal standard passes, it will likely preempt state laws like BIPA and may strengthen or weaken protections depending on the final text.

School biometric systems are also under increasing scrutiny. The Department of Education’s Privacy Technical Assistance Center (PTAC) issued guidance in 2022 recommending schools conduct privacy impact assessments before deploying biometric systems, but the guidance is advisory, not mandatory. Several states are considering legislation that would require explicit parental consent for any biometric data collection in schools.

Watch also for developments in the EU’s AI Act, which took effect in 2024 and classifies real-time remote biometric identification systems as “high-risk AI” subject to strict requirements. EU rules often foreshadow U.S. policy directions by three to five years.

Frequently Asked Questions

Is Apple’s Face ID safe for kids to use?

Apple’s Face ID is designed with local storage — the facial embedding never leaves the device’s Secure Enclave and is not accessible even to Apple. For unlocking a personal device, Face ID is a reasonable choice. The caution applies to third-party apps that request facial recognition access, or to school/institutional systems that send data to cloud servers.

Can schools legally collect my child’s fingerprints?

It depends on your state. In Illinois, schools must comply with BIPA — written consent, stated retention schedule, prohibition on selling data. In most other states, schools fall under FERPA rather than COPPA, and FERPA’s biometric protections are limited. Contact your district’s IT or privacy officer to ask specifically about their biometric data policies.

What is a facial embedding and why can’t it be changed?

A facial embedding is a list of numbers (a vector) that describes the mathematical geometry of a face — not the photo itself. It’s generated by a neural network trained to represent faces. Because the underlying face doesn’t change (barring significant physical alteration), the embedding generated from it is essentially permanent. If an embedding is stolen from a database, the person it represents cannot change their face to invalidate it.

Does COPPA protect my child’s biometric data?

COPPA requires verifiable parental consent before collecting personal information from children under 13, and the FTC has interpreted biometric identifiers as covered personal information. However, COPPA applies to commercial online services; it does not apply to school-administered technology, which falls under FERPA. For teens (13+), no federal biometric privacy law exists.

What is BIPA and does it apply where I live?

BIPA (Illinois Biometric Information Privacy Act) is an Illinois state law that requires written notice and consent before collecting biometric data, sets retention limits, prohibits sale of biometric data, and allows individuals to sue for violations. It applies to any business that collects biometric data from Illinois residents. Texas and Washington have similar laws. Most other states do not have equivalent biometric-specific legislation.

Can voice recognition be fooled or spoofed?

Yes. “Deepfake audio” — AI-generated voice clones — can in some cases fool voice authentication systems. A 2023 investigation by the Guardian demonstrated that AI-generated voice clones could bypass HSBC’s voice authentication system. This is why voice recognition is generally considered lower security than facial or fingerprint recognition and is not recommended as the sole authentication factor for sensitive accounts.

---

About the author

Ricky Flores is the founder of HiWave Makers and an electrical engineer with 15+ years developing consumer technology at Apple, Samsung, and Texas Instruments. He writes about how kids learn to build, think, and create in a tech-saturated world. Read more at hiwavemakers.com.

---

Sources

1. Schroff, F., Kalenichenko, D., & Philbin, J. (2015). “FaceNet: A Unified Embedding for Face Recognition and Clustering.” Proceedings of the IEEE Conference on Computer Vision and Pattern Recognition (CVPR). https://doi.org/10.1109/CVPR.2015.7298682
2. Deng, J., Guo, J., Xue, N., & Zafeiriou, S. (2019). “ArcFace: Additive Angular Margin Loss for Deep Face Recognition.” Proceedings of CVPR 2019. https://doi.org/10.1109/CVPR.2019.00482
3. Electronic Frontier Foundation. (2022). “Face Recognition in Schools: A Privacy Crisis.” https://www.eff.org/deeplinks/2022/05/face-recognition-schools-privacy-crisis
4. Nagrani, A., Chung, J. S., & Zisserman, A. (2021). “VoxCeleb: Large-Scale Speaker Verification in the Wild.” Computer Speech & Language, 60, 101027. https://doi.org/10.1016/j.csl.2019.101027
5. National Institute of Standards and Technology. (2023). “Face Recognition Vendor Test (FRVT).” https://www.nist.gov/programs-projects/face-recognition-vendor-test-frvt
6. Federal Trade Commission. (2013). “Children’s Online Privacy Protection Rule (COPPA).” https://www.ftc.gov/legal-library/browse/rules/childrens-online-privacy-protection-rule-coppa
7. Illinois General Assembly. (2008). “Biometric Information Privacy Act (BIPA).” 740 ILCS 14. https://www.ilga.gov/legislation/ilcs/ilcs3.asp?ActID=3004
8. U.S. Department of Education, Privacy Technical Assistance Center. (2022). “Protecting Student Privacy While Using Online Educational Services.” https://studentprivacy.ed.gov