S. 1691: Traveler Privacy Protection Act of 2025

The Traveler Privacy Protection Act of 2025 aims to regulate the use of facial recognition technology in airports. It introduces specific limitations and requirements for how the Transportation Security Administration (TSA) handles biometric information to protect passenger privacy.

Key Provisions

• Limitations on Facial Recognition Technology: The bill restricts the TSA from capturing, collecting, or processing biometric information from passengers using facial recognition technology, with some exceptions.
• Defined Terms: Several definitions are provided, including:
  • 1:1 matching software: Technology comparing a passenger's biometric data with photographs on their identification documents.
  • 1:N identification software: Tech that compares a passenger's biometric data against existing records held by the Department of Homeland Security.
• Consent Requirements: Passengers must provide 'affirmative express consent' for their biometric information to be collected. This consent cannot be obtained through general terms of service or by merely entering a security area.
• Privacy Measures: Generally, the TSA is prohibited from using facial recognition to track passengers outside of security checkpoints, and they cannot store biometric information longer than necessary.
• Options for Trusted Traveler Programs: Passengers enrolled in programs like Global Entry may opt-in for identity verification using facial recognition, provided they are informed about how their biometric data will be used and can choose to opt-out without facing negative consequences.
• Notifications: The TSA must provide clear notifications about consent options and treatment for those who choose different identity verification methods.
• Testing and Evaluation: The TSA may conduct testing of facial recognition software but must notify participants about data handling and must delete images not used for identity verification within a specified time frame.
• Annual Reporting: The Government Accountability Office (GAO) is required to study the effectiveness and safety of the TSA's use of biometric technologies and report these findings to Congress annually.

The overarching goal of the bill is to enhance the privacy rights of passengers while ensuring that security measures at airports are effectively managed.

Exceptions to the Limitations

• The TSA can use biometric technologies for verifying documents during security inspections.
• For those not in Trusted Traveler Programs, biometric data may only be collected with explicit consent prior to each use.
• Specific cases exist for identity verification when travelers do not have acceptable forms of ID.

Reporting and Oversight

• The bill mandates regular reviews of facial recognition technology's performance and its impact on privacy and civil rights.
• The reports will analyze the incidence of false matches and discrimination and suggest improvements for privacy protections.

Prohibition of Passive Surveillance

• The TSA is not allowed to use facial recognition for general surveillance or profiling outside of the defined scope of identity verification. This ensures that data is not used for widespread monitoring of passengers.

Relevant Companies

• ADBE (Adobe Inc.): May be impacted as facial recognition and identification software developers, aligning with state and federal regulations on the use of their technologies.
• ORCL (Oracle Corporation): As a provider of biometric identification software, Oracle’s business practices may need to adapt in response to the new legal requirements on passenger biometric data management.
• IBM (IBM Corporation): Known for its work in facial recognition software; may have to adjust offerings to comply with stricter regulations outlined in the bill.