1. How Can You Tell a Security Camera's Purpose from Its Look?
The Personal Information Protection Commission (PPC) calls cameras placed for security that do not extract face data "traditional security cameras." In contrast, a system that takes face images and extracts data to identify people is called a "camera system with face recognition function." [1]
For traditional cameras, if it is obvious from the location that they are for security, the operator does not need to notify or publish the purpose of use. However, if you cannot easily notice you are being filmed, things like posting a sign that the camera is active are necessary. [1]
For face recognition cameras, you cannot tell from the outside that face recognition is being used. Therefore, operators must clearly state that they are using face recognition, not just that it is for crime prevention. It is recommended to post signs at entrances with the operator’s name, the purpose, contact info, and a QR code for more details. [1]
2. Why Photos and Face Feature Data Both Count as Personal Information
A photo of a specific person is personal information. Also, "face feature data," which is a code created from your bone structure, skin color, and the position of your eyes, nose, and mouth, counts as a "personal identification code" under the law. [1]
Imagine trying to remember a friend without a name tag. A camera does not "remember" like a human. Instead, it compares a number sequence made from your face features against registered sequences to see if it is the same person. The accuracy depends on the system, and it is not the same as human judgment. [1]
The important point is that even without a name or address, your face itself can be a clue to identify you. [1]
3. Why Face Feature Data Is Hard to Change Like a Password
If a password leaks, you can change it. You cannot change your face features easily. The PPC notes that face feature data is hard to change and allows tracking of a person’s actions. Because of this, safety measures are required. [1]
"Hard to change" means it is not easy to alter, like a fingerprint. It does not mean it never changes at all. Operators should decide how long to keep the data based on necessity and delete it promptly when no longer needed. [1]
Note: The PPC says companies must take safety measures because face feature data is hard to change and can make it possible to track a person's actions. [1]
4. Can Security Camera Footage Be Used for Marketing?
Using security camera images or face data for marketing requires your prior consent. If a camera on a digital billboard estimates age and gender to show ads, it is handling personal information. They must specify the purpose, notify you, and post signs that filming is happening, even if they delete the face image quickly. [1]
However, if they only keep data about gender, age, or silhouettes of people moving, it is not personal information, unless it can be easily matched back to the original camera image or identification code. [1]
For face recognition databases, the crimes targeted must be clear first. People should only be added if they are highly likely to commit those specific crimes. [1]
5. Japan's 2023–2026 Guidelines and Laws on Face Recognition Cameras
In March 2023, the PPC published guidelines for using face recognition cameras for safety. This covered privacy rights, personal information laws, and voluntary efforts by companies. [2]
In July 2026, a law amending the Personal Information Protection Act was passed. It creates a new category called "specific biometric personal information." This covers body features that can be collected without special technology or high cost, where you might not easily notice it is happening. [3]
This includes face feature data, not just photos. Companies must tell you the name, purpose, and how to stop the use of this data. Sharing this data with others via the "opt-out" method (where data is shared unless you say stop) is prohibited. [4]
The law is not in full effect yet. Most parts will start within 2 years of publication, but the exact date is not set. Some penalty rules start on January 17, 2027. [3][10]
Note: The PPC published guidelines in March 2023 on using face recognition cameras for crime prevention and safety. [2]
6. What the EU AI Act Bans About Scraping Face Images
The EU AI Act bans AI systems that scrape face images from the internet or security cameras without targeting specific people to build or expand face recognition databases. This ban started on February 2, 2025. [5]
German regulators describe this as "vacuuming up" data indiscriminately. [6]
The law also generally bans real-time remote biometric identification in public spaces for law enforcement, allowing it only in strict cases where it is necessary, such as searching for missing persons or preventing imminent threats. Permission is usually needed in advance from a court. [6]
Private stores using face recognition cameras are not covered by this specific ban. So, saying "the EU banned all face recognition" is not accurate. [5]
7. Clearview AI and the Legal Cases Over Collecting Face Images
Clearview AI, a US company, reportedly built a database by collecting face images from the public web. In February 2022, Italian authorities found they had no legal basis for processing this biometric data. They fined the company 20 million euros (according to reports) and ordered the deletion of data for Italian residents, as well as a ban on collecting their data. [7]
In Canada, federal and provincial authorities found in 2021 that Clearview had collected over 3 billion images without consent. [8]
In the US, Illinois has a law (BIPA) requiring written consent before collecting biometric data. In a case about Facebook’s photo tagging, a settlement of 650 million dollars was approved in February 2021 for users in Illinois. [9]
8. How to Check Signs at Store and Station Entrances
Try looking for signs at store or station entrances. Check if they list the operator, the purpose, contact info, and a QR code. This helps you see if the "recommended" disclosures are actually happening. [1]
However, just because a sign is there does not prove face recognition is being used. And if there is no sign, you cannot judge whether face recognition is being used or not. The fact that you cannot tell from the outside is the start of this problem. [1]
Please do not film people’s faces or store staff, and do not cause trouble for stores. If you want to read more, the PPC’s Q&A on cameras is available in Japanese. [1]