A problem with opt-in data collection is that whenever the law allows a user to opt in, businesses will require the user to opt in.

A ban on facial recognition doesn't mean much if every hotel, gym, and pizza parlor has a shrink-wrap contract or cookie banner [1] forcing you to opt in to their data collection if you want a room or a pizza.

[1] https://news.ycombinator.com/item?id=23090393

...which is fine and well within their rights. Businesses don't have to offer people any services if those people don't want to follow their rules. Under federal anti-discrimination laws, businesses can refuse service to any person for any reason, unless the business is discriminating against a protected class.

> ...which is fine and well within their rights.

Not anymore. :)

Portland decided that the rights of the individual outweigh the rights of businesses when it comes to this issue. Strongarming people into giving up their privacy won't work. The argument that "if you don't like it, you can go elsewhere" has also been shown to not work when every business is harvesting every bit of personal data they feasibly can.

Well it is within their rights, in the hypothetical scenario being discussed where the law was opt-in rather than prohibition.

The argument that "if you don't like it, you can go elsewhere" has been shown to work extraordinarily well when it comes to businesses choosing to go elsewhere rather than serve high crime neighborhoods. In fact it's a big part of why people from those neighborhoods lack opportunity.

Another way of looking at it is that your counterargument to 'business just does what it wants with no regard to the needs of consumers' is 'business just does what it wants with no regard to the needs of consumers.'

You're not really helping your own case here. Especially as you're basically using an example of a case whereby having the state not act in the public's interest by addressing the high crime problem, it leads to poor outcomes for the populace; actually justifying the prohibition in the interests of the public's privacy in general over the freedom of private individuals to create a facial recognition based privacy free zone through their own volition and recognizance by leaving contractual acceptance of facial recognition based programs and data sharing open in much the same way as functioning and effective law enforcement prograns are justifiable in maintaining public safety.

Those neighborhoods lack opportunity because they lack funds and have ethnic names and or faces. When the same resume gets a fraction of the bites when you put the name Jamal on it vs John its pretty easy to identify the issue. Furthermore I don't think disallowing facial recognition is going to materially effect the services offered in a city so this seems like you shimmed it in there.

This doesn't work unless you have a choice. We've already gone from "free, but we collect your data" to "paid, but we also collect your data and didn't decrease the price." Just look at TVs or ISPs.

Before you say "well that's user's rights" I think we're all aware that most people are tech illiterate. They are starting to become aware of the problem but everyone feels completely helpless because they don't even know the first steps (and quite frankly it isn't just laziness, they don't have the literacy rate).

And we are changing those rights, which is fine and well within our rights.

It is so refreshing to see this asserted, that citizens can update the societal contract through legislation when deemed necessary instead of simply being at the mercy of corporate interests.

This is literally the point of legislation and I haven't seen the opposite asserted even once.

As a practical matter, how could opt in work? Suppose you've opted in and I haven't. We both walk into the pizza parlor. How does the system know that you've opted in without attempting to recognize both of us?

Failing to recognize someone does not detract from their privacy. If they fail to recognize everyone who isn't opted in, who is harmed?

Sure it does. Failing to recognize someone at scale can very much impact someone's privacy. Holes in data are, in and of themselves information.

For example, if an unrecognized face was logged on 47th street, then an unrecognized face was logged on 50th, then 52nd, then 55th (where a crime occurred), then back down to 47th, you might be able to draw some patterns about where to look for your suspect even if they hadn't opted in.

Edit: Also, you are trusting that the system isn't storing markers for people it doesn't recognize. My concern would be that if I opt in later, suddenly all my past history becomes discoverable. That's a lot of trust to put in the hands of private firms (or the police), neither of which I'm comfortable holding that information.

Excellently put. Also, just because it didn't generate a facial ID hit, doesn't mean they can't use ReID and track the descriptor vector.

In fact if I were a not-quite ethical user of facerec, I'd flag and bin all vectors and image chips that failed to ID.

I work on facerec and ReID. But it's for deep fake detection and the like, blue team stuff. But the deep ID technologies are very concerning to me in general.

Honestly this is a really, really good point I hadn't thought of (and well articulated) and I think you've changed my mind on prohibition v. opt-in.

The problem with this argument is the assumption that everyone gets a facial scan and the computer processes the data all the same, in order to recognize whether the individual is recognizable or not. How can we be sure that that data is not getting saved for later? The system is too ripe for abuse and everyone loses their privacy.

It will try to recognize you but you will not be in the database, so it will say match not found. Presumably nothing would be stored about you in that interaction

> Presumably nothing would be stored about you in that interaction

Given how prevalent the tracking of users is, anonymous or otherwise, I'd be extremely pessimistic about this assumption.

Same here. I don't want the system to even try to recognize me. No one's doing this stuff on site, which means that they'd be uploading my face to a cloud provider and using their system, which means they'd be doing the things people are having a problem with in the first place.

And no one would ever lie about such things for a profit.

Are there logs?

I may be naive and misunderstanding, but if a private entity is using facial recognition on their property, that doesn't appear to be prohibited? Like if a gym wanted to do a face scan to "log you in" that seems like that'd be permissible? I'm not a lawyer. I found the actual draft:

D.“Places of Public Accommodation”

1.means: Any place or service offering to the public accommodations, advantages, facilities, or privileges whether in the nature of goods, services, lodgings, amusements, transportation or otherwise.

2.does not include: An institution, bona fide club, private residence, or place of accommodation that is in its nature distinctly private.

https://static1.squarespace.com/static/5967c18bff7c50a0244ff...

IANAL, but I think "distinctly private" here means your house, or the private clubhouse you rent with some friends, etc. In other words, places that the general public isn't welcome to visit (as opposed to even a gym where anyone with $100 can sign up).

A private country club would certainly fall under this exemption, but a normal gym might not unless it's already qualifying for the private club tax exemption.

Approximately, a business that's open to the public is considered to be a public space, even if it's on private property.

A restaurant dining room is public, but the kitchen would be private (IIUC). A private club (ie you register for membership and only members are allowed inside) is private. (Aside: That's how indoor smoking establishments like hookah bars get around anti-smoking laws in Washington state.)

This leaves me uncertain about gyms - that seems more like a country club than a restaurant or hotel?

I'm suspicious having seen how the GDPR is effectively being circumvented by making nonessential cookies more or less opt-out, and by making the process so annoying that the average person doesn't care enough to do it. It's a lot easier to enforce "not allowed" than "do it in a user-friendly way".

Plus, in a public place, how do you only apply facial recognition technology to a single person? It seems like in most cases, you must first apply it to everyone else nearby to discriminate them from anyone who opted in.

The GDPR isn't being circumvented in those cases. It is being blatantly and flagrantly violated. The GDPR explicitly requires that refusal to be tracked have no more friction than accepting being tracked. If the banner has a "Accept and Continue" button, then it must have a "Refuse and Continue" button as well. Adding any more steps than that is a violation, not merely a circumvention.

Would the scanner have to do the recognition stuff _before_ it knows whether the person on-camera has actually opted in?

Good opt-in regulation doesn't exist currently - think of all the click-through legalese and cookie popups/gdpr consent popups etc.

We'd need something like a once in a lifetime registered consent that service providers would be required to respect quietly and provide non-degraded service to people without the opt-in.

Even this would probably require multiple rounds of regulation iteration to fix the loopholes.