A Face Credential for the Whole Trip: Pieces Exist, Shared Rules Do Not

The problem

At Milan Linate airport, the Italian data-protection authority found a face-recognition boarding system holding each passenger's template in the operator's central system, stored unencrypted at inspection, and found that gates created templates for passengers who had not enrolled¹².

The earlier AI in Practice paper on biometric boarding found high laboratory accuracy but old audited gate data. A Department of Homeland Security audit of a pilot at nine airports found 98% of identities matched at departure gates, yet biometric confirmation reached only 85% of passengers, because of network availability, staffing and boarding time (audit without a control group, September 2018, older than three years)³. At Linate, 24,550 passengers had enrolled, about 0.75% of traffic on the affected routes (operator-reported, to July 2025)¹². That paper asked whether one airport's system works. This paper adds a different question: what could change if the face data stayed with the traveller and one credential served several stages of a trip, instead of each operator enrolling travellers in its own system.

The legal objection is specific. In an opinion adopted on 23 May 2024, the European Data Protection Board examined four designs for facial recognition at airports. It found that the two designs storing templates centrally, under the control of the airport operator or of the airline and its cloud provider, cannot be compatible with Article 25 of the General Data Protection Regulation (GDPR), the rule on data protection by design⁴. The repetition at the centre of the problem, a traveller proving identity at stage after stage, was not quantified in any source read; no study counting identity checks per trip was found.

What already works

A phone-held ID checked against a live photo. The US Transportation Security Administration (TSA) states that mobile driver's licences and ID passes in Apple Wallet, Google Wallet, Samsung Wallet or a state app are accepted at select checkpoints. A passenger who agrees has a picture taken that is compared with the physical or digital ID, and TSA states that the photo and personal data are deleted after verification. Participation is optional, and TSA states that all passengers must still carry a physical ID (operator-reported, page undated)⁵. The page gives no airport count and no accuracy figures. The mechanism therefore runs at checkpoints, but it replaces nothing yet.

A travel-credential standard in draft. The International Civil Aviation Organization (ICAO) Facilitation Panel met in Montréal from 20 to 24 April 2026 with a working paper from New Zealand proposing two standards and one recommended practice for Digital Travel Credentials. The paper describes a "Virtual Component" as a copy of the passport chip's data, including the facial biometric and the issuing authority's digital signature, which airlines, airports or states could place in a wallet. It proposes that border authorities verifying such credentials check the signature. Creating or accepting one would not be mandatory. The paper says technical and policy issues remain and describes no face-matching or liveness step⁶. The panel's decision was not found.

A design the privacy regulators leave open. The European Data Protection Board found that a template held only by the individual, for example on their own device and compared one-to-one, could in principle be compatible with the GDPR subject to safeguards. A centrally stored template encrypted with a key held solely by the passenger could also be compatible in principle. In both cases the controller must show that no less intrusive alternative achieves the same objective as effectively⁴.

A European wallet in rollout. Regulation (EU) 2024/1183, of 11 April 2024, establishes the European Digital Identity Framework; its recital 32 says use of the wallets should not result in processing beyond the data necessary for wallet services⁷. According to Biometric Update, member states face an end-2026 deadline to offer a wallet, and an EU committee agreed on 18 June 2026 that the wallet may carry a biometric facial image, with states allowed but not required to let users opt out⁸.

What does not exist. The research found no deployment or trial in which one phone-held face credential served several stages of a trip, such as airline, border and hotel, and none with independent measurement of capture and match rates.

The possibility

One way this could work: the passport's issuing authority signs the facial image, and the traveller's wallet holds a copy, as in the ICAO virtual component. At check-in, a security checkpoint, a gate or a border, the traveller could choose to present it. The operator's camera would take a live photo, software would compare it with the signed portrait on the phone, and the operator would check the issuer's signature. The result would be a yes or no, and the photo would be discarded. That follows the safeguards of the first design the European Data Protection Board examined: local processing and deletion in the individual's hands⁴. A hotel or car-hire desk could ask for far less, and the European Commission has said, as reported, that the wallet's selective disclosure means the portrait is presented only when a relying party requests it and the user approves, and that it could not be requested for simple age verification⁸.

The role of AI. The comparison step is the only part of the idea that clearly depends on AI. Matching a live face against the stored portrait, and the liveness and injection checks that try to tell a live face from a replayed or synthetic one, would typically rely on machine learning. Everything else is ordinary systems and policy: digital signatures and the public-key infrastructure behind them, wallet software, lists of trusted issuers, consent screens, a staffed manual route, and the law. If the credential only had to prove who issued a document, little AI would be needed; AI enters because the credential is a face.

What would have to be true

1. A shared standard that states and operators accept. The ICAO proposals are in draft and make acceptance optional⁶. A credential accepted by some borders and not others would leave the traveller carrying documents as well.
2. A specified and independently measured face-match step. The ICAO paper describes none⁶, the strongest accuracy evidence in the earlier paper is laboratory-based, and the only audited gate data are from 2018³. A phone-held credential does not remove the capture problem the audit found.
3. Enrolment and presentation that resist synthetic faces. A January 2026 World Economic Forum report reviewed 17 face-swapping and 8 camera-injection tools from July 2024 to April 2025, based solely on claims in the tools' documentation and not on testing. It reported genuine real-time face swapping in 5 tools, 3 of them with a path into a verification flow, and judged most tools limited against modern verification that uses challenge-response and software integrity checks⁹. The tools mostly fall short today; a credential that unlocks many stages would be a more valuable target if that changed.
4. Data kept in the traveller's hands, with a real opt-out. The design must match one the Board found potentially compatible⁴, and the opt-out must exist in practice, which the EU wallet rules leave to each member state⁸.
5. A working route for travellers without a phone or wallet. TSA still requires a physical ID⁵.
6. Someone willing to pay. No cost per gate, per airport or per passenger was found in the sources read.

What could stop it

What the evidence shows

Law. The Board found that the centrally stored designs under operator or airline control cannot be compatible with GDPR Article 25, and that even the passenger-held design requires the controller to show no less intrusive alternative exists. The opinion does not cover border control⁴. A border step would therefore rest on other rules that were not examined here.

Standards. ICAO states that technical and policy issues remain, that a digital credential cannot come at the expense of aviation security or interoperability, and that acceptance is not mandatory. Its implementation guide is listed as under development⁶.

Biometric opt-out. The European Commission pushed for a mandatory biometric portrait in the wallet; the compromise lets member states offer an opt-out without requiring it. The digital-rights groups Epicenter.works and European Digital Rights argue that people may be pressured to share the image, for example by employers or authorities⁸.

Spoofing. The World Economic Forum review rests on tool documentation, not testing⁹.

Capture and design failures. The 2018 audit found the gate shortfall came from network, staffing and boarding time, not from matching³. Linate's system was ruled unlawful for its data design, not its accuracy¹².

Current practice. TSA's phone-ID checks still require a physical ID⁵.

Reasoning

If a credential is optional at every stage, operators might need to run the old route in parallel, so the cost of two systems could fall on them while the time saving accrues partly to the traveller. If each operator prefers its own enrolment, for loyalty programmes or for data it already holds, it could have little reason to accept a credential issued elsewhere. The risk of a lost, stolen or flat phone would sit mostly with the traveller. Travellers without a compatible phone could be left with a slower line.

Simpler non-AI options might do much of the job. Passport-chip gates and boarding-pass scans already confirm a document without a face match, and a single face check at the border, with documents trusted downstream, might remove most repeated checks without a shared credential. Whether the repetition is large enough to justify the effort was not established.

Signs to watch

• The outcome of the ICAO Facilitation Panel's April 2026 meeting on the Digital Travel Credential proposals, and any resulting amendment to Annex 9⁶.
• Formal adoption of the EU rule that lets states allow an opt-out from the wallet's facial image, reported in June 2026 as awaiting adoption⁸.
• The end-2026 date by which member states face a requirement to offer a wallet, as reported⁸.
• Publication of ICAO's implementation guide for Digital Travel Credentials, listed as under development⁶.
• A published trial of a phone-held face credential across more than one travel stage, with capture and match rates measured by someone other than the supplier. None was found.