The Street That Stopped Being Anonymous

The idea for the essay was inspired by the series “The Capture,” but by the time I finished writing it, I realized that the plot of the series is closer than ever.

Contemporary public space is undergoing a transformation whose significance is still difficult to overstate: the quiet and almost never examined premise of urban life, the anonymity a person possessed simply by virtue of being one body among millions of other bodies, is being replaced by an infrastructure of systematic biometric identification. It is characteristic that this transformation is being carried out not by a state act, not by a law, and not by public debate, but through the gradual rollout of consumer technologies, each update of which looks like a modest convenience. The class action lawsuit against Amazon concerning the Ring Familiar Faces feature is, in this sense, not a private legal curiosity but a symptom of a deeper shift: the displacement of the default standard from anonymity to identification.

From the user’s point of view, the Familiar Faces feature is arranged with the utmost simplicity: instead of a neutral notification about detected motion, the camera’s owner receives a message about who exactly is standing at the door. For this to work, however, the system scans the face of every person who enters the camera’s field of view, extracts a so-called faceprint, a set of facial measurements converted into a numerical sequence, and stores it on the company’s servers. The mail carrier, the canvasser, the child selling cookies, the neighbor cutting across the lawn: all of them end up measured and catalogued without their knowledge or consent. It is significant that the plaintiff in the case is a person who has never owned a Ring device: his biometric data was collected during visits to friends and relatives whose cameras were switched on.

Here a fundamental asymmetry of consent is laid bare. The camera’s owner accepts the terms of use and manages the settings, yet the camera points outward, at the street, the sidewalk, the building entrance, that is, at the places through which people who are party to no agreement are compelled to pass. The passerby has no interface through which to express refusal; his biometric identity becomes a condition of his physical presence in public space. Given the scale at which such devices have spread, with smart cameras installed in roughly a third of American households with internet access, we are no longer dealing with a sum of private security decisions but with a distributed biometric sensor network assembled house by house and, as a consequence, with an involuntary biometric database of non-users.

The selective nature of the feature’s rollout deserves particular attention: Amazon conspicuously did not make Familiar Faces available in Illinois, Texas, and Portland, that is, precisely in those jurisdictions where biometric privacy legislation has real teeth. Illinois grants private individuals a right of action and statutory damages for each violation, which has already led to Facebook paying 650 million dollars. Texas, long considered toothless owing to the absence of a private right of action, demonstrated its effectiveness when Google paid 1.375 billion dollars and Meta 1.4 billion. Portland introduced a direct ban on facial recognition in places of public accommodation.

This selectivity amounts, in essence, to an admission expressed through geography: the company is evidently capable of complying with biometric privacy norms, yet does so only where non-compliance is costly. Settlements and fines did not restrain the technology; they merely marked out three zones in which its use is economically unprofitable. This is not regulation but a tariff on surveillance.

A common counterargument is a simple one: anonymity on the street has never been legally guaranteed to anyone. People have always appeared in news footage, on dashcams, and in other people’s videos on video-hosting sites. Formally this is true, yet an essential substitution lies hidden here. The difference between the former situation and the present one lies not in the fact of filming but in its character. Formerly, anonymity was secured by the practical impossibility of total recognition: recordings remained scattered, and nobody indexed, searched for, or cross-matched a face in a crowd. Now the face is turned into a number, the number is stored centrally and automatically matched against other faces, and all of this happens without the subject’s knowledge. There is a fundamental difference between being noticed and being identified: the first has always existed, the second is new, and it is precisely the second that requires a consent that no one has asked for.

The analogy with the “I agree” button on a website does not work here and cannot work. Consent through inaction on a website, whatever legal fiction it may be, is at least tied to a voluntary action: a person came in, a person stayed, a person can close the tab. The street presupposes neither an interface, nor a moment of choice, nor the possibility of leaving; a person cannot avoid leaving the house. Consent that cannot be given or withdrawn is not consent.

However, the authorities do not need to introduce a consent button in cities, since the mechanism by which public space is changed has historically worked differently, through the formation of a norm. The campaign against smoking is illustrative: no one held a referendum among smokers, yet the chain “medical fact, moral category, social norm, law” consistently displaced smoking from public space altogether. Each step seemed a logical continuation of the previous one, and an objector found himself in the position of a person arguing not with an argument but with morality. The same scheme worked after the events of September 11, when warrantless surveillance turned from a scandal into a necessary security measure. Biometrics is now traveling the same path: “these are just numbers,” “this is for your safety,” “everyone has already gotten used to cameras,” and at each step consent is not required, because the agenda replaces it. Moreover, the initiator is not even the state: a private company creates the infrastructure through millions of private cameras pointed at public space, and all that remains for the state is to plug into the ready-made network.

The least obvious but perhaps the heaviest consequence of total biometric recording concerns the presumption of innocence. The classical principle holds that the prosecution proves guilt and the accused is not obliged to prove innocence. A biometric network, without formally abolishing this principle, renders it practically inoperative. If a camera has recorded two people entering a building entrance where a corpse is discovered in the morning, the system automatically produces a ready-made circle of suspects, Smith and Johnson. The investigation begins to work inside this list rather than outside it; presence recorded by the system is perceived as an objective fact, and each person recorded is expected to give an explanation. The absence of an alibi turns into evidence, and a refusal to explain into a sign that the person has something to hide.

This is not a hypothesis: in the United States there are already documented cases of arrests made solely on the basis of erroneous facial matches by recognition systems, with the detainees having to prove their innocence themselves. Actual judicial practice in disputes over digital access already proceeds from the premise that if a system recorded a login under someone’s credentials, the burden of proving that it was another person falls on the one whom the system named. Formally a person is innocent until proven otherwise; in practice, if he is in the system, he must prove that he was not there.

At the foundation of this construction lies a fundamental substitution: the registration of an event is identified with the event itself. That the system recorded a face means only that the system recorded a face. Pixels may be distorted, the algorithm may err, the template in the database may be outdated, and the match threshold is a setting, not a truth. An entry in the system is not a fact of reality but the result of an algorithm operating under certain parameters, that is, someone’s decision disguised as objective data. Yet the word “data” possesses the rhetorical force of fact: data does not argue, data does not err, and the person finds himself forced to contest not an accusation but the conclusion of a machine, to whose logic he has no access.

This vulnerability is aggravated by the possibility of hacking. If an intruder enters someone else’s faceprint into the system’s log, the falsified record will be indistinguishable from the genuine one from the outside: “the system recorded” sounds the same in the case of an error and in the case of forgery. For the accused, proving falsification is practically impossible, since he has neither access to the logs, nor independent expertise, nor even knowledge that a compromise has taken place. It is precisely here that the true price of total control is revealed: not the errors themselves, but the impossibility of contesting them.

The problem of interpreting what has been recorded is as old as time. A person with a raised hand: is he calling, pointing, or threatening? This question does not disappear even when a video recording exists, since a gesture has meaning only in context. The history of recording is a spiral, on each turn of which something that had previously offered protection was eliminated: a witness can be cross-checked, a photograph can be challenged, a video can be examined frame by frame in context, whereas a faceprint leaves nothing of the sort. A number has no context, contains no doubt, and is not subject to review. A system created to help establish what happened eliminates the very possibility of asking that question, because it answers before the question is asked, answering incompletely and sometimes incorrectly, but conclusively.

The spiral closes on a paradox that is hard to consider accidental: a system created in the name of security and order inevitably becomes an instrument in the hands of those who control it, and control sooner or later ends up with those who seek power. An instrument of control cannot be neutral; it always serves someone, and the question is not who created it but who wields it. The street that used to be anonymous now generates a biometric record, and this change has taken place without a law, without a referendum, and without the consent of those it affects. A particular lawsuit may be won or lost, yet the central conclusion does not depend on the outcome of the proceedings: the corporation has already demonstrated that it is capable of respecting biometric privacy where the law demands it, and deliberately fails to do so where the law is silent. A reasonable response would be not regulation on a leftover basis but a consent-by-default model: a private right of action grounded in the dignity of the person, the consent of the data subject himself, strict limits on storage and reuse, and a federal minimum standard independent of geography. A person’s face must not be turned into an object of measurement and storage solely because that person dared to go out onto the street.