Face ID is a facial recognition system designed and developed by Apple Inc. for the iPhone and iPad Pro. The system allows biometric authentication for unlocking a device,^[1] making payments, accessing sensitive data, providing detailed facial expression tracking for Animoji, as well as six degrees of freedom (6DOF) head-tracking, eye-tracking, and other features. Initially released in November 2017 with the iPhone X, it has since been updated and introduced to several new iPhone models, and all iPad Pro models.^[2]

The Face ID hardware consists of a sensor with three modules; a laser^[3] dot projector that projects a grid of small infrared dots onto a user's face, a module called the flood illuminator that shines infrared light at the face, and an infrared camera which takes an infrared picture of the user, reads the resulting pattern and generates a 3D facial map. This map is compared with the registered face using a secure subsystem, and the user is authenticated if the two faces match sufficiently. The system can recognize faces with glasses, clothing, makeup, and facial hair, and adapts to changes in appearance over time.

Face ID has sparked a number of debates about security and privacy. Apple claims that Face ID is statistically more advanced than Touch ID fingerprint scanning.^[4] It exhibits significantly fewer false positives. Multiple security features largely limit the risk of the system being bypassed using photos or masks, and only one proof-of-concept attempt using detailed scans has succeeded. Debate continues over the lack of legal protections offered by biometric systems as compared to passcode authentication in the United States. Privacy advocates have also expressed concern about third-party app developers' access to "rough maps" of user facial data, despite rigid requirements by Apple of how developers handle facial data.

With the onset of the COVID-19 pandemic, it was noted that Face ID was unable to recognize users wearing face coverings on some devices.^[5][6] Apple responded to criticism by offering faster fallback to passcode input, and the option for Apple Watch users to confirm whether they intended to unlock their iPhone.^[7] In March 2022, Apple released iOS 15.4 which adds mask-compatible Face ID for iPhone 12 and later devices.^[8]

History

Apple announced Face ID during the unveiling of the iPhone X on September 12, 2017.^[9] The system was presented as the successor to Touch ID, Apple's previous fingerprint-based authentication technology embedded in the home button of the iPhone 8 and earlier devices in addition to the second and third-generation iPhone SE.^[10] On September 12, 2018, Apple introduced the iPhone XS and XR with faster neural network processing speeds, providing a significant speed increase to Face ID. On October 30, 2018, Apple introduced the third generation iPad Pro, which brings Face ID to the iPad and allows face recognition in any orientation.^[11] iOS 13 included an upgraded version of Face ID which is up to 30% faster than Face ID on previous versions.^[12]

Technology

Face ID's technology is based on PrimeSense's previous work with low-cost infrared depth perception that was the basis of the Kinect motion sensor for the Xbox console line from Microsoft; Apple had acquired PrimeSense in 2013 after Microsoft started to wane on the use of Kinect.^[13][14]

Face ID is based on a facial recognition sensor that consists of two parts: a vertical-cavity surface-emitting laser dot projector module that projects more than 30,000 infrared dots onto the user's face, and an infrared camera module that reads the pattern.^[15] The pattern is projected from the laser using an Active Diffractive Optical Element which divides the beam into 30,000 dots.^[16]

The pattern is encrypted and sent to a local "Secure Enclave" in the device's CPU to confirm a match with the registered face.^[17][18] The stored facial data is a mathematical representation of key details of the face, and it is inaccessible to Apple or other parties.^[17] To avoid involuntary authentication, the system requires the user to open their eyes and look at the device to attempt a match, although this can be disabled through an accessibility setting.^[17] Face ID is temporarily disabled and the user's passcode is required after 5 unsuccessful scans, 48 hours of inactivity, restarting the device, or if both of the device's side buttons are held briefly.^[19]

Apple claimed the probability of someone else unlocking a phone with Face ID is 1 in 1,000,000 as opposed to Touch ID at 1 in 50,000.^[10][20] During initial setup, the user's face is scanned twice from a number of angles to create a complete reference map. As the system is used, it learns about typical variations in a user's appearance, and will adjust its registered face data to match aging, facial hair growth, and other changes using the Neural Engine. The system will recognize a face wearing hats, scarves, glasses, most sunglasses,^[21] facial hair or makeup.^[22] It also works in the dark by invisibly illuminating the whole face with a dedicated infrared flash module.^[23]

Authentication with Face ID is used to enable a number of iOS features, including unlocking the phone automatically on wake, making payments with Apple Pay, and viewing saved passwords. Apps by Apple or third-party developers can protect sensitive data with a system framework; the device will verify the user's identity and return success or failure without sharing face data with the app. Additionally, Face ID can be used without authentication to track over 50 aspects of a user's facial expression and positioning, which can be used to create live effects such as Animoji or camera filters. In recent years, third party developers have developed more use cases for FaceID such as e.g. Eyeware Beam, an iOS app that provides a reliable and precise, multi-purpose head and eye-tracking tool. It is used to enable control of the camera angle through head-motion-in games and eye-tracking to share attention with audience in streams, but also augmentative and alternative communication (AAC) and biometric research.^[24]

Devices with Face ID

Safety

Face ID uses an infrared flood illuminator and laser infrared dot projector, though Apple insists that the output is low enough that it will cause no harm to the eyes or skin, and meets 'international safety standards'. They do not, however, recommend the sensor be repaired by third parties, citing security concerns. There is also an inbuilt feature to deactivate Face ID should unauthorized components be found.^[25]

Issues

Twins and close relatives

Inconsistent results have been shown when testing Face ID on identical twins, with some tests showing the system managing to separate the two,^[26] while other tests have failed.^[27] The system has additionally been fooled by close relatives.^[28] Apple states that the probability of a false match is different for twins and siblings, as well as children under 13 years of age, as "their distinct facial features may not have fully developed".^[29]

Law enforcement access

Face ID has raised concerns regarding the possibility of law enforcement accessing an individual's phone by pointing the device at the user's face.^[30] United States Senator Al Franken asked Apple to provide more information on the security and privacy of Face ID a day after the announcement,^[31] with Apple responding by highlighting the recent publication of a security white paper and knowledge base detailing answers.^[32][33]

The Verge noted that courts in the United States have granted different Fifth Amendment rights to keycode and biometric unlocking systems. Keycodes are considered "testimonial" evidence based on the contents of users' thoughts, whereas fingerprints are considered physical evidence, with some suspects having been ordered to unlock their phones via fingerprint.^[34]

In August 2018, the FBI obtained a warrant to search the property (which includes electronic devices) of a man accused of transmitting child pornography; they unlocked the suspect's iPhone by holding it up to his face, without needing his passcode.^[35]

Infiltration

Many people have attempted to fool Face ID with sophisticated masks, though most have failed.^[36] In November 2017, Vietnamese security firm Bkav announced in a blog post that it had created a $150 mask that successfully unlocked Face ID, but WIRED noted that Bkav's technique was more of a "proof-of-concept" rather than active exploitation risk, with the technique requiring a detailed measurement or digital scan of the iPhone owner's face, putting the real risk of danger only to targets of espionage and world leaders.^[37][38]

Third-party developers

If the user explicitly grants a third-party app permission to use the camera, the app can also access basic facial expression and positioning data from Face ID for features such as precise selfie filters such as those seen in Snapchat, or game characters mirroring real-world user facial expressions. The data accessible to third parties is not sufficient to unlock a device or even identify a user, and Apple prohibits developers from selling the data to others, creating profiles on users, or using the data for advertising. The American Civil Liberties Union and the Center for Democracy and Technology raised privacy questions about Apple's enforcement of the privacy restrictions connected to third-party access, with Apple maintaining that its App Store review processes were effective safeguards. Jay Stanley, a senior policy analyst with the ACLU, has stated that the overall idea of letting developers access sensitive facial information was still not satisfactorily handled, with Stanley telling Reuters that "the privacy issues around of the use of very sophisticated facial recognition technology for unlocking the phone have been overblown. The real privacy issues have to do with the access by third-party developers".^[39][40]

Use with face masks

During the COVID-19 pandemic, face masks were employed as a public and personal health control measure against the spread of SARS-CoV-2. Face ID at the time was incompatible with face masks, with Apple stating "Face ID is designed to work with your eyes, nose and mouth visible."^[41] With the release of iOS 13.5, Apple added a feature that automatically brought up the passcode screen if it detected that the user was wearing a mask.^[42][43] Apple was criticized for not addressing these issues with the release of the iPhone 12, but was praised for the lack of inclusion of Face ID in favor of Touch ID integration into the power button on the fourth-generation iPad Air.^[5][44] In April 2021, Apple released iOS 14.5 and watchOS 7.4 with an option to allow Apple Watch to act as a backup if Face ID fails due to face masks.^[7] In March 2022, Apple released iOS 15.4 which adds mask-compatible Face ID for iPhone 12 and later devices.^[8]