Facial Recognition Training Data: The Real-World Dilemma of Consent and Bias

A Core Problem That's Been Overlooked

Facial Recognition (FR) technology keeps breaking accuracy records on paper, but the training data behind these achievements often exists in a state of chaos. Recently, a practitioner posed a pointed question on Reddit: How are teams actually handling consent and bias issues with facial recognition training data?

Facial recognition technology is built on Convolutional Neural Networks (CNN) in deep learning, completing identity verification or identification by learning high-dimensional vector representations of facial features. Current mainstream algorithms like ArcFace and CosFace have achieved over 99.8% accuracy on standard benchmarks such as LFW (Labeled Faces in the Wild). However, the composition of these benchmarks is itself biased—over 77% of images in the LFW dataset come from white males, meaning those high accuracy numbers may mask significant performance gaps on specific populations.

The poster bluntly pointed out: many well-known datasets were scraped from the internet without consent, and bias across skin tones, ages, and lighting conditions remains a very real problem. They asked all peers building FR systems—are you licensing data from vendors, collecting it yourselves, or relying on public datasets and hoping for the best?

This question seems simple but touches the pain point the entire computer vision industry is least willing to confront head-on: beneath the polished appearance of technological progress, the legitimacy and representativeness of data sources have long existed in a gray area.

Three Paths to Facial Recognition Data and Their Respective Costs

From the discussion framework in the post, there are roughly three paths for obtaining facial training data in practice, each accompanied by different ethical and practical costs.

Scraping Public Datasets: Cheap but Dangerous

Over the past decade, academia and industry have heavily relied on publicly scraped facial datasets from the internet. The biggest advantage of this type of data is large scale, low cost, and quick access. But the problems are equally prominent: the vast majority of photographed individuals never consented to their facial images being used to train AI models.

In recent years, several well-known datasets have been taken down due to compliance controversies—a concentrated eruption of this problem. In 2019, Microsoft quietly deleted the MS-Celeb-1M dataset containing approximately 10 million facial images, which had scraped photos of about 100,000 public figures from the web, many of whom were unaware. IBM's Diversity in Faces dataset was similarly withdrawn due to comparable controversies. Duke University's Duke MTMC surveillance dataset was also taken down after being discovered to have been used for training Chinese surveillance systems. These events marked the beginning of academia and industry confronting the legal and ethical consequences of collecting data without consent.

As GDPR, CCPA, and various biometric information protection regulations progressively tighten, teams relying on scraped data are essentially accumulating potential legal liability—data usable today may become the trigger for lawsuits and regulatory penalties tomorrow. The EU's General Data Protection Regulation (GDPR) explicitly classifies facial images as biometric data, categorizing them as "special category personal data," requiring explicit consent from data subjects or satisfying other strict legal bases for processing. Illinois' Biometric Information Privacy Act (BIPA) in the United States stipulates compensation of $1,000 to $5,000 per violation for collecting biometric data without written consent—Meta (Facebook) paid a $650 million settlement as a result. California's CCPA grants consumers deletion rights and the right to know. These regulations are redefining the boundaries of lawful use of facial data.

Licensed Procurement from Vendors: Compliant but Limited

The second path is licensed procurement from professional data vendors. The benefit of this approach lies in responsibility transfer—vendors theoretically bear the compliance obligations of the collection process, and buyers receive data with an authorization chain.

But this path also carries hidden risks. The validity of authorization depends heavily on whether the vendor's collection process truly obtained informed consent, and buyers often cannot fully audit this chain. Additionally, costs increase significantly, and the diversity of vendor-provided data may not meet the needs of specific application scenarios. Some vendors may recruit participants through crowdsourcing platforms, where the articulation and comprehension of informed consent varies widely; others may collect data in developing countries at lower compensation standards, raising ethical questions about whether informed consent was truly "freely given."

Self-Collection: Controllable but Expensive

The third path is for teams to organize data collection themselves, proactively recruiting diverse participants and obtaining explicit informed consent forms. This is the ethically cleanest approach, allowing precise control over the distribution across dimensions like skin tone, age, and lighting.

The cost, however, is extremely high in terms of time and money. Building a dataset that covers sufficient population diversity and is representative across various real-world lighting conditions often requires months or even years of continuous investment, which is unsustainable for most teams. Taking a medium-scale dataset covering the world's major populations as an example, recruitment, venue, equipment, and legal review costs alone could reach several million dollars—and this doesn't include the long-term operational costs of maintaining participants' consent status (such as data deletion after consent withdrawal).

Synthetic Data: An Emerging Fourth Path

It's worth noting that synthetic face data has been emerging as a potential fourth path in recent years. By generating non-existent virtual faces through Generative Adversarial Networks (GAN) or diffusion models, one can theoretically bypass consent issues while precisely controlling the distribution of attributes like skin tone, age, and lighting. Microsoft's DigiFace-1M and synthetic data company Synthesis AI are both exploring this direction. However, synthetic data faces the "domain gap" problem—whether models trained on virtual faces can generalize to real faces still requires further validation. Moreover, the bias problem in synthetic data doesn't disappear but transfers to the training data of the generative model itself. This path is promising but not yet mature, currently serving more as a supplement to real data rather than a replacement.

Why Facial Recognition Bias Is So Hard to Eliminate

The poster specifically emphasized that bias across skin tones, ages, and lighting conditions remains a real problem. This point deserves deeper analysis.

The root of bias is not merely insufficient data quantity, but structural imbalance in data distribution. Historically, large facial datasets have been dominated by light-skinned, adult, frontal-facing, well-lit samples, causing models to perform significantly worse on dark-skinned populations, elderly and child demographics, and low-light environments.

This problem has rigorous quantitative evidence. The 2018 Gender Shades study published by MIT researcher Joy Buolamwini found that commercial facial recognition systems from Microsoft, IBM, and Face++ had error rates as high as 34.7% for dark-skinned women, while the error rate for light-skinned men was only 0.8%. A 2019 large-scale test by the National Institute of Standards and Technology (NIST) further confirmed: in one-to-one matching scenarios, false positive rates for African and Asian faces were 10 to 100 times higher than for white faces. These data show that bias is not a theoretical hypothesis but a quantifiable systemic flaw that directly affects real-world law enforcement, financial, and public safety applications.

Even more troublesome is the inherent tension between this bias and the "consent" issue: the more one wants to cover diverse populations to eliminate bias, the more one needs to proactively reach out to and recruit participants from different backgrounds—which is precisely the most costly and organizationally complex collection method. In other words, pursuing bias-free data and pursuing compliant consent, in practice, often point to the same most expensive path.

From a technical perspective, bias can also be amplified through model architecture and loss functions. When a particular population group is underrepresented in training data, the model tends to allocate its limited representational capacity to the majority group during optimization, compressing the feature space of minority groups and creating a Matthew effect in recognition performance. Even if post-hoc remediation through resampling or loss weight adjustment is attempted, results are often inferior to ensuring balanced data distribution from the source.

The Line Between Ethics and Practice

The poster's final question is highly representative: Where exactly do people draw the line between ethics and practice?

This actually reveals the industry's universal dilemma. Ideally, every face used for training should come from informed consent, and the overall distribution should be sufficiently diverse. But real-world commercial pressure, competitive pace, and cost constraints force many teams to compromise between compliance and efficiency.

This compromise manifests differently across organizations of varying sizes. Large tech companies have the resources to establish internal data governance teams and ethics review boards, and can absorb the high cost of compliant collection; startups often face "iterate fast or die" pressure, where compliance investment is seen as a competitive disadvantage. However, the Clearview AI case demonstrates that a "build first, ask questions later" strategy can bring devastating consequences—the company has faced lawsuits and massive fines in multiple countries for scraping over 10 billion facial images from social media.

In the long run, as biometric regulation tightens globally, the "scrape and pray" strategy is becoming unsustainable. Compliant collection, traceable authorization chains, and proactive data balancing to address bias are transforming from "nice-to-haves" into "barriers to entry." For any team building facial recognition systems, the sooner they confront the ethical and compliance issues at the data source, the better they can avoid systemic risks in the future.

Points for Practitioners to Consider

Although this discussion didn't provide a standard answer, it offers the industry several questions worth repeatedly examining:

• Can your data authorization chain withstand regulatory scrutiny? Specifically, can you trace back to each data subject's informed consent record, and does the scope of consent cover the current use case?
• Has the distribution of your dataset across skin tone, age, and lighting dimensions been quantitatively assessed? Has it been audited against standardized frameworks like the Fitzpatrick skin type classification?
• When compliance costs rise, does your team choose to narrow the scope of functionality, or bear the potential legal and reputational risk?
• Have you considered using synthetic data as a supplementary means to expand data diversity while maintaining compliance?
• Has your model undergone disaggregated evaluation for group fairness, rather than only reporting overall accuracy?

The technical ceiling for facial recognition may continue to rise, but what truly determines whether these systems can sustain long-term is precisely those less glamorous details of data governance. In an era of increasingly strict regulatory environments and growing public privacy awareness, data ethics is no longer an optional moral decoration—it is the infrastructure of technological sustainability.