Biometric Boarding: Accurate in Tests, Uneven in Service, Ruled Unlawful in Milan

The use case

At Milan Linate airport, a face-recognition boarding system went live on 7 May 2024 on ITA Airways and SAS flights, at 3 of the 12 security gates. By the time Italy's data-protection authority inspected it in July 2025, 24,550 passengers had enrolled against 3,288,744 passengers on the affected routes, about 0.75% of traffic by the operator's own figures (operator-reported, to July 2025)⁵⁶. The authority later declared the processing unlawful. The case frames the three questions this paper asks of every airport deployment: whether the matching works, whether it works at the gate, and whether the data design survives scrutiny.

Biometric boarding replaces the check of a boarding pass or passport at a gate with a camera photo. The system compares the live face with stored images. One-to-many (1:N) matching searches a gallery of many faces, for example every passenger on a flight. One-to-one (1:1) matching compares the face with a single stored template, for example the one the passenger enrolled.

Scope note. Artificial intelligence here means the face-recognition matching software. The sources read evaluate such algorithms, for example 29 one-to-many algorithms in a NIST test¹, but they do not state the technique used in each deployed system, so deployments are treated as face recognition in general. Older technology does similar work and is not credited as AI: barcode scans of boarding passes, officers comparing a passport photo with a face, and passport-chip gates. Immigration clearance by face and iris, such as Singapore's passport-less clearance at Changi (close to 1.5 million travellers, 25 seconds cut to 10 seconds per traveller, to 15 October 2024, operator-reported), is a neighbouring use and is left out². Security-checkpoint identity checks are also out of scope, but are used where they supply the best independent accuracy evidence for the same matching technology.

Where it is running

Older deployments exist. A CBP exit pilot ran at nine airports in 2017⁸, and Delta used facial recognition for boarding at Atlanta by 2018⁹. Both are older than three years and are used below only for the evidence they produced. All the figures in the CBP and India rows mix several checkpoints or uses and are not counts of boarding-gate passengers. Outside the United States, the evidence read covers Italy and India only; no European deployment other than Linate was examined in detail.

What the evidence shows

Laboratory accuracy is high. NIST simulated 567 flights of 420 passengers each and tested 29 one-to-many algorithms (July 2021, controlled laboratory simulation). The seven best identified at least 99.5% of passengers on the first presentation when the gallery held one image per passenger. The best algorithm made no false negatives on up to 428 of the 567 flights with one image, and on 545 flights when the gallery averaged six images per passenger. Differences by sex and national origin were small, with false negatives slightly more common for women. NIST did not test cameras and the subjects wore no masks¹. Gallery quality therefore matters as much as the algorithm: more reference images gave fewer errors.

An independent government test of a neighbouring use agrees. The DHS Science and Technology Directorate tested TSA's checkpoint system with more than 1,600 volunteers in 2023 and 2024 (controlled scenario test, reported January 2025). Face capture and recognition worked more than 99% of the time, with 98% overall accuracy for the lowest-scoring group, volunteers who identified as Black or African American. In a separate TSA pilot, face capture succeeded 93% of the time while recognition stayed above 99%. These figures come from a news account; the report itself was not read⁴.

The audited gate data are weaker, and old. The DHS Inspector General examined the CBP exit pilot at nine airports (report September 2018, audit without a control group). The pilot matched 98% of passengers' identities at departure gates, yet biometric confirmation was limited to 85% of all passengers processed. The causes were poor network availability, no dedicated staff and compressed boarding times⁸. The gap between the laboratory and the gate is the central finding. The match step was accurate, but photos were not always captured, and a passenger not captured is not matched. A 2019 DHS test of ten vendor image-capture systems points the same way: 4 of 10 met the 1% failure-to-acquire objective (controlled test, 430 volunteers, May 2019)¹⁰.

Current operating figures are self-reported. CBP states an average technical match rate of 99.4% on entry and 98.1% on exit (operator-reported, statement for a July 2022 hearing). CBP notes that lighting and other environmental factors outside its control may explain the lower exit figure³. No newer independent audit of boarding-gate capture was found.

Time savings are claimed, not independently measured. Delta said facial recognition removed up to nine minutes from boarding (operator-reported, November 2018, older than three years)⁹. India's civil aviation ministry reports that entry processing fell from 15 to 5 seconds per passenger (government-reported, May 2026)⁷. No independent time-and-motion study was found.

What it takes: cost, integration, governance

Money and integration. No cost per passenger or per gate was found in the sources read. The audited requirements are operational: network bandwidth, dedicated staff, and enough time in the boarding process for the photo to be taken⁸. The reference gallery has to be built. In the CBP pilot, gallery photos came from State Department and DHS records⁸; at Linate, passengers enrolled through an app or at kiosks⁵.

Data rules in the United States. CBP holds US citizens' images for no more than 12 hours after verification. Photos of non-citizens can be kept for up to 75 years in a DHS identity system. US citizens may ask an officer for a manual document check instead (operator-reported, 2022)³. A bill in the US Senate, the Traveler Privacy Protection Act, would require most airports to offer manual identity checks and delete images within 24 hours. Its Senate Commerce Committee vote was cancelled in August 2025 after lobbying by airlines and travel companies, according to a news report that also relays a senator's claim that TSA worked against it¹³. A 2025 staff report of the Privacy and Civil Liberties Oversight Board is summarised by an advocacy group as finding that DHS had not carried out the privacy compliance review its own directive requires (advocacy-group summary, May 2025)¹⁴.

Data rules in the European Union. In Opinion 11/2024, adopted on 24 May 2024, the European Data Protection Board examined four storage designs for airport facial recognition. Designs that store the template centrally under the airport's or airline's control were found incompatible with the General Data Protection Regulation. Designs where the passenger holds the data, on a personal device or with a key only the passenger controls, could be compatible with safeguards¹¹.

Governance in India. DigiYatra is run by a private foundation. An independent technology-policy outlet reported in December 2024 that requests under the right-to-information law cannot reach it and that the ministry did not list airports reportedly making the system mandatory¹².

Where it falls short

A lab-versus-gate gap. The strongest accuracy evidence is laboratory-based and excludes cameras¹. The only audited gate data are from 2018⁸. A DHS Inspector General audit of TSA's facial recognition and identification technologies was reported as under way in January 2025; its result was not found¹⁵.

Uneven effects cannot be checked from operator data. NIST found small demographic differences in the laboratory¹, and DHS testing found the lowest group at 98% against above 99% overall⁴. CBP says it does not track race and reports a negligible effect by country of citizenship, age or gender (operator-reported, 2022)³. Without independent, group-level operating data, the size of any gap in service is unknown.

Opt-out is available but rarely tested. In the 2018 pilot, the Inspector General saw 16 passengers decline across 12 flights at 4 airports⁸. Whether passengers in other settings know they can decline was not established by the sources read.

Uptake can be low, and design can fail. At Linate, 0.75% of traffic on the affected routes had enrolled by the operator's figures⁵. The Italian authority found the template held in the operator's central system, stored unencrypted at inspection, retained for up to 12 months in the long-term programme, and described wrongly in the privacy notice as staying on the phone. It also found that gates created templates for passengers who had not enrolled⁶⁵. The operator stopped the service on 16 September 2025 and reported deleting all biometric data by 8 October 2025⁵. The authority declared the processing unlawful, and said in 2025 that airport facial recognition is not generally banned but needs designs such as those the Board identified¹⁶. The failure concerned data design, not matching accuracy.

Dependence on people and process. The 2018 audit tied the shortfall to staffing, bandwidth and boarding time rather than to the algorithm⁸. Gains in speed therefore depend on a working manual fallback and on gate operations, not only on the software.

Phase: In early use — why

The hypothesis of early use is kept. Matching is mature in the laboratory and US federal programmes are large, but most large counts combine entry, checkpoint and boarding uses. For boarding gates specifically, the independent operating evidence is old, current operating figures are self-reported, the technique of deployed systems is not confirmed in the sources read, and the best-documented European system was ruled unlawful. Where scale and method cannot be established, the lower plausible phase is chosen.

What to watch next

• The DHS Inspector General audit of TSA facial recognition, reported as under way in January 2025; its publication would give the first recent audited accuracy and notice findings¹⁵.
• The European Ombudsman inquiry into how the Board adopted Opinion 11/2024 (case 850/2026/VSF); the Board's written reply is due by 17 November 2026¹⁷.
• Any rescheduled Senate Commerce vote on the Traveler Privacy Protection Act; no 2026 status was found¹³.
• DigiYatra's planned extension to 27 more airports by next year, as stated by the civil aviation minister in May 2026⁷.

Questions to ask before adopting

• Where is each passenger's template stored, for how long, and who holds the encryption key?
• Does the design match one of the passenger-controlled storage options the European Data Protection Board found potentially compatible?
• What share of boarding passengers is captured and matched with our own cameras and gate conditions, measured by someone other than the supplier?
• What is the manual alternative, how long does it take, and what happens when the network fails?
• How will opt-outs, errors and delays be reported by passenger group, and who audits them?