Your face unlocks your phone. Your fingerprint authenticates a transaction. Your voice can verify your identity. Facial recognition, voice cloning and biometric surveillance are turning personal identity into valuable data. But if this information is stolen, who can give you a new face, fingerprint or voice? That is the fundamental weakness of biometrics. Unlike a password, a physical characteristic cannot simply be reset after a breach. And as facial recognition, voice cloning and AI-generated impersonations spread, the risks extend beyond stolen data to surveillance, fraud and the unauthorised use of a person’s identity. The question is no longer just who holds your data. It is who can use it, for what purpose and with whose permission.
The body becomes data
Fingerprints, facial features, iris patterns and voice characteristics can all serve as biometric identifiers. Technology converts these characteristics into digital representations that can be used to verify identity or identify a person against a database. The distinction matters. Unlocking a phone using facial recognition is authentication. Scanning CCTV footage to identify an unknown person is identification, potentially without that person’s knowledge. Banks, employers, technology companies and law-enforcement agencies use or can deploy biometric systems for different purposes. But a face visible in public is not, by itself, permission for unrestricted identification, tracking or commercial reuse. Nor is every photograph or voice recording automatically biometric data. Its treatment depends on how it is processed, the purpose of the processing and the applicable law.
Consent: a choice or a condition?
An employee asked to register a fingerprint, a customer required to complete facial verification or a person seeking a service may have little practical choice but to comply. Consent is meaningful only when people understand what they are agreeing to. Who stores the information? Is it shared with third parties? How long is it retained? Can it be used to train AI systems or create a digital imitation? These are not merely technical questions. They determine whether people retain meaningful control over their identity. India’s Digital Personal Data Protection Act, 2023, and the Digital Personal Data Protection Rules, 2025, establish a framework for protecting digital personal data. However, implementation is phased. As of 26 October 2026, the Act’s principal provisions governing lawful processing, consent, individual rights and data-fiduciary obligations are scheduled to commence on May 13, 2027. They should not be presented as fully enforceable rights already available under that framework.
Aadhaar: safeguards against misuse
India’s Aadhaar framework illustrates why the purpose of biometric collection matters. Section 29 of the Aadhaar Act, 2016, restricts the sharing and use of core biometric information collected under the Act. Such information cannot be shared with anyone or used for purposes other than generating Aadhaar numbers and authentication under the Act. The law also places restrictions on the use and disclosure of other identity information. In its landmark 2018 Aadhaar judgment, the Supreme Court examined the scheme against the constitutional right to privacy. The judgment neither prohibited all biometric identification nor granted the state an unrestricted right to collect personal information. It assessed the scheme’s legal framework and constitutional limits. The broader principle is clear: technological capability does not, by itself, establish legal authority.
When your face becomes a commercial asset
AI has opened another front. Facial images and voice recordings can be used to create synthetic videos, imitate speech or make it appear that someone has endorsed a product or made a statement they never did. The consequences can include financial fraud, reputational damage and harassment. A photograph supplied for identity verification does not automatically amount to permission to use that person’s likeness in an advertisement or AI-generated video. Depending on the circumstances, such misuse may raise questions of data protection, contractual obligations, personality rights and criminal law. No single legal provision resolves every case. Retention poses a related risk. Information collected for a specific purpose should not be kept indefinitely merely because storage is cheap. Clear retention periods, restricted access, secure deletion and limits on secondary use are essential.
What can victims do?
The available remedies depend on the nature of the misuse and the law applicable to the case. Aadhaar-related violations may engage the Act’s specific safeguards and complaint mechanisms. Fraud, impersonation or unlawful disclosure may trigger other legal provisions. Unconstitutional state action may also be challenged through appropriate judicial remedies. The forthcoming substantive provisions of the DPDP framework are intended to establish broader rights and obligations, but their scheduled commencement must be distinguished from the protections already in force. Until then, individuals must rely on applicable existing laws and sector-specific mechanisms. For victims, preserving evidence, notifying the responsible organisation and reporting suspected fraud to the appropriate authorities are practical first steps.
The right to remain yourself
Biometrics can make identification faster and more secure. The challenge is to prevent convenience from becoming a justification for indiscriminate collection or surveillance. That requires more than a consent checkbox. Organisations need to explain why biometric information is collected, restrict its use to legitimate purposes, protect it against unauthorised access and delete it when retention is no longer justified. People also need effective remedies when safeguards fail. A face is not a password that can be changed. It is part of a person’s identity, visible to the world but not thereby surrendered to it. The real question is not whether we own our faces. It is whether we control what others are allowed to do with them.
