| Known limitation flagged by vendor<\/td> | Small\/low-res faces (under ~80\u00d780px) need extra processing<\/td> | N\/A specified<\/td> | N\/A specified<\/td> | Not reliable on illustrated\/cartoon faces<\/td> | N\/A specified<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n
\n\n\nWhat the Law Actually Says About Tagging Faces<\/h2>\n\n\n\nFacial recognition in a DAM tool is a lower-risk use case than public surveillance, but it isn’t a legal blind spot. The moment software extracts facial geometry from a photo to identify someone, most privacy regimes treat that extracted data \u2014 not the photo itself \u2014 as biometric information.<\/p>\n\n\n\n In the United States, Illinois’ Biometric Information Privacy Act (BIPA) is the one that actually gets enforced through private lawsuits. BIPA specifically excludes ordinary photographs from its definition of a biometric identifier \u2014 but a face-geometry scan extracted<\/em> from a photo is covered, and companies are required to get written consent before collecting it. The law’s teeth were on full display in 2021, when Facebook paid $650 million to settle a BIPA class action over its old “Tag Suggestions” feature, which had extracted facial templates from users’ photos without consent; roughly 1.6 million Illinois users were part of the class, and Facebook agreed to turn face recognition off by default going forward. A 2024 amendment (SB 2979) narrowed future exposure by treating repeated collection of the same person’s biometric data via the same method as a single violation rather than one violation per scan \u2014 and in April 2026 the Seventh Circuit confirmed in Clay v. Union Pacific Railroad<\/em> that this change applies retroactively. That lowers the ceiling on damages, but it doesn’t remove the underlying consent requirement.<\/p>\n\n\n\nUnder the EU’s GDPR, biometric data processed for the purpose of uniquely identifying a person is a “special category” of data under Article 9, which generally requires explicit consent or another narrow legal basis, and carries fines up to \u20ac20 million or 4% of global annual turnover. In the UK, the Information Commissioner’s Office has already acted on this outside the DAM context specifically: in February 2024 it ordered Serco Leisure to stop using facial recognition and fingerprint scanning to track attendance for more than 2,000 employees across 38 leisure facilities, and to delete the biometric data it wasn’t legally required to keep.<\/p>\n\n\n\n \n“Biometric data is wholly unique to a person so the risks of harm in the event of inaccuracies or a security breach are much greater.”<\/p>\nJohn Edwards, UK Information Commissioner, on the Serco Leisure enforcement action<\/cite><\/blockquote>\n\n\n\nWorth separating clearly from all of this: the EU’s AI Act, which entered into force in 2024 with its first prohibitions taking effect in February 2025, bans real-time, remote<\/em> biometric identification in public spaces (mainly a law-enforcement restriction) and bans untargeted scraping of the internet or CCTV footage to build facial recognition databases. That’s a different target \u2014 think Clearview AI, not a marketing team tagging its own campaign photos. Recognizing your own employees or models in your own asset library, with consent, is a materially different use case. But “different” isn’t “exempt”: you still need a lawful basis to process the biometric data, and you still need to be able to answer a deletion request for it.<\/p>\n\n\n\n
\n\n\n\nRolling It Out Without Creating a Liability<\/h2>\n\n\n\nNone of the above means you should skip facial recognition \u2014 it means you should roll it out deliberately instead of just flipping a switch because a vendor rep says it’s included. A few things worth doing before launch:<\/p>\n\n\n\n \n- Ask where the matching actually happens.<\/strong> If your vendor uses Amazon Rekognition (Canto, Acquia, and Bynder all do), your face data leaves your infrastructure. Get that documented in your data-processing agreement, not just assumed.<\/li>\n\n\n\n
- Get consent before you tag employees or event attendees<\/strong>, in writing, before rollout \u2014 not after someone notices they’ve been tagged. This is the exact gap that triggered the Facebook and Serco cases.<\/li>\n\n\n\n
- Test on your ugliest photos first.<\/strong> Group shots, backlit stages, side profiles, and low-resolution scans are where accuracy actually breaks \u2014 not the polished demo the sales team showed you.<\/li>\n\n\n\n
- Confirm you can delete a face template on request<\/strong> without deleting the underlying photo. A deletion request under GDPR or BIPA targets the biometric data specifically, and your workflow needs to be able to separate the two.<\/li>\n\n\n\n
- Decide who’s allowed to confirm tags.<\/strong> Nearly every platform here treats recognition as suggest-then-confirm rather than fully automatic \u2014 that human checkpoint is also your record that a person reviewed and approved each identification.<\/li>\n<\/ul>\n\n\n\n
\n\n\n\nWhy Daminion Stands Out<\/h2>\n\n\n\nGiven the checklist above, Daminion<\/strong> has one structural advantage worth calling out: because face matching runs on your own server rather than through a third-party API, you’re not adding a cloud processor (and the vendor agreement that goes with it) to your compliance picture. That doesn’t make the legal obligations disappear \u2014 you still need consent and a deletion process \u2014 but it does mean one fewer party has a copy of your biometric data.<\/p>\n\n\n\n\n- On-Premise by Design<\/strong>: face data doesn’t leave your infrastructure, simplifying the data-processing conversation with legal or compliance teams.<\/li>\n\n\n\n
- Confirm-and-Learn Accuracy<\/strong>: tagging accuracy improves as your team confirms or rejects suggested matches over time.<\/li>\n\n\n\n
- Team-Centric Access Controls<\/strong>: user roles and permissions govern who can view, tag, or export sensitive assets.<\/li>\n\n\n\n
- Documented Limitations<\/strong>: rather than glossing over edge cases, Daminion’s own docs flag exactly where accuracy degrades, which makes it easier to plan around.<\/li>\n<\/ul>\n\n\n\n
That said, if your team is already deep into the AWS ecosystem, or you specifically need a vendor-managed backfill tool for a legacy library, Acquia DAM<\/strong>‘s bulk recognition run is a genuinely useful feature Daminion doesn’t advertise an equivalent to. Canto<\/strong>, Bynder<\/strong>, and Brandfolder<\/strong> are all solid picks too, depending on whether branding workflows, an existing AI-tooling relationship, or zero-setup availability matters most to you.<\/p>\n\n\n\n
\n\n\n\nFinal Thoughts<\/h2>\n\n\n\nFacial recognition in a DAM system earns its keep fast \u2014 it turns “who’s in this photo” from a manual search into an instant one. But it’s also the one DAM feature that comes with a genuine paper trail of legal obligations attached, from BIPA’s written-consent requirement to GDPR’s special-category rules. Pick a platform based on where your priorities actually sit: Daminion’s on-premise processing if data residency and a simpler compliance story matter most, Acquia’s backfill tooling if you’re sitting on a large legacy library, or Canto, Bynder, and Brandfolder if their broader workflow fits your team better and you’re comfortable with the Amazon Rekognition data path.<\/p>\n","protected":false},"excerpt":{"rendered":" Facial recognition can turn a ten-thousand-photo library into a searchable-by-person archive in minutes \u2014 but it also creates biometric data that BIPA and GDPR regulate specifically. Here’s how Daminion, Canto, Acquia DAM, Bynder, and Brandfolder actually differ in where the matching runs, what’s on by default, and what to check before you roll it out.<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":"","faq":[{"question":"What is Facial Recognition in Photo Management Software?","answer":"Facial recognition is an AI-driven feature that automatically identifies and tags individuals in photos. Instead of manually labeling images, the system analyzes faces and applies metadata, making it faster and easier to organize large image libraries."},{"question":"Why is Facial Recognition Important for Businesses?","answer":"For businesses, time is money. Facial recognition automates tagging, reducing manual effort and making it easier to locate specific images. It also enhances team collaboration by streamlining access to photos of key individuals, whether for marketing, HR, or event documentation."},{"question":"Can Facial Recognition Handle Large Photo Libraries?","answer":"Yes, most modern DAM systems are built to scale. Whether you have thousands or millions of images, AI-powered facial recognition can process and categorize them efficiently, making it a great solution for businesses with extensive visual assets."},{"question":"How Accurate is Facial Recognition in DAM Systems?","answer":"Accuracy depends on the software. Most DAM platforms use AI that improves over time by learning from user input. For example, Daminion is known for its high-accuracy tagging and ability to refine results based on manual corrections."},{"question":"Is Facial Recognition Secure?","answer":"Security is a top priority for DAM providers. Reputable systems follow strict data protection guidelines, including compliance with GDPR and other privacy laws. Always review the security protocols of your chosen DAM platform before implementation."},{"question":"Can Facial Recognition Identify People Across Different Devices?","answer":"Facial recognition in DAM systems typically works within a centralized library, meaning it doesn\u2019t track faces across multiple devices. However, within the DAM itself, it can identify and organize faces consistently across an entire collection."},{"question":"How Does Facial Recognition Improve Team Collaboration?","answer":"By automating the tagging process, teams can quickly find and share images, eliminating the frustration of searching through folders manually. This is especially useful for marketing, PR, and creative teams that need to work efficiently with visual content."},{"question":"Can I Manually Correct Facial Recognition Tags?","answer":"Yes, and you should. Most DAM systems allow manual tagging adjustments, which not only ensures accuracy but also helps the AI refine its recognition over time. The more corrections you make, the smarter the system becomes."},{"question":"Which DAM System is Best for Small Teams?","answer":"If you're working with a small team, simplicity and affordability matter. Daminion and Canto are solid choices, offering intuitive interfaces and cost-effective plans without sacrificing core DAM functionality. Daminion's AI-powered facial recognition automatically tags people and refines its accuracy from user feedback, while Canto's cloud-based platform emphasizes seamless team collaboration, letting members collaborate directly on face tagging and verification to keep small libraries organized without a steep learning curve."},{"question":"Which DAM System is Best for Large Enterprises?","answer":"Enterprises with complex workflows and vast asset libraries need robust solutions. Acquia and Daminion provide enterprise-grade asset management, in-depth analytics, and advanced collaboration tools designed for large-scale operations. Acquia offers role-based face access control and advanced face matching algorithms accurate even in low-light or partial-occlusion conditions, plus custom face analytics for tracking usage patterns. Daminion complements this with centralized storage, version control, and advanced reporting to track asset usage and performance across large teams."},{"question":"Does Facial Recognition Work with Old or Low-Quality Photos?","answer":"While facial recognition works best with high-resolution images, some systems can still identify faces in older or lower-quality photos. However, results may vary depending on lighting, resolution, and facial clarity."},{"question":"Can I Use Facial Recognition to Create Custom Photo Collections?","answer":"Absolutely. Most DAM platforms allow you to create collections based on facial recognition tags. Whether you're organizing photos by team members, event attendees, or VIPs, this feature makes it easy to group and retrieve relevant images."},{"question":"How Does Facial Recognition Handle Photos with Multiple People?","answer":"Most AI-powered DAM systems can detect and tag multiple faces in a single image. This means you can search for photos that include one or more specific individuals, making it easier to find the right assets."},{"question":"Is Facial Recognition Available in Cloud-Based DAM Systems?","answer":"Yes, cloud-based DAM solutions like Canto, Daminion, and Brandfolder all offer facial recognition features, allowing users to access and manage their image libraries from anywhere. Canto continuously updates its face recognition results in real time as new images are added, while Brandfolder detects and tags faces instantly upon upload, speeding up the overall workflow. This means teams can search, tag, and retrieve photos of specific individuals from anywhere, with recognition results kept current as new images are uploaded."},{"question":"What\u2019s the Best DAM System for Marketing Teams?","answer":"For marketing teams, branding consistency and workflow efficiency are key. Bynder, Daminion and Brandfolder stand out with features like brand guideline enforcement, automated workflows, and secure asset sharing\u2014all critical for fast-moving marketing departments."}],"checked_date":"2026-08-07","sources":[{"statement":"Daminion's facial recognition processes data on the user's own server and does not share it with third parties","source_name":"Daminion \u2014 Facial Recognition feature page","url":"https:\/\/daminion.net\/features\/facial-recognition\/","checked":"2026-08-07"},{"statement":"Daminion's documentation warns that low-resolution previews and faces under ~80\u00d780 pixels reduce recognition accuracy, and that its higher-resolution mode for small faces can push server memory usage to around 10 GB on v10.5","source_name":"Daminion Docs \u2014 Face Recognition: Functionality","url":"https:\/\/daminion.net\/docs\/artificial-intelligence\/face-recognition-functionality\/","checked":"2026-08-07"},{"statement":"Canto's facial recognition, powered by Amazon Rekognition, launched in 2019 and compares facial geometry (eyes, nose, brow, mouth) across images","source_name":"Canto \u2014 The ultimate guide to AI facial recognition","url":"https:\/\/www.canto.com\/blog\/ai-face-recognition\/","checked":"2026-08-07"},{"statement":"Canto keeps facial recognition off by default; an account manager must enable it per account due to varying privacy laws","source_name":"DataBasics \u2014 Facial Recognition in Canto: Best Practices","url":"https:\/\/www.databasics.com.au\/blog\/facial-recognition-in-canto-best-practices","checked":"2026-08-07"},{"statement":"Acquia DAM's facial recognition runs on Amazon Rekognition, is opt-in, includes a bulk backfill tool for legacy libraries, and the vendor states it 'is not biometric processing'","source_name":"Acquia Docs \u2014 How does facial recognition work in Acquia DAM?","url":"https:\/\/docs.acquia.com\/acquia-dam\/how-does-facial-recognition-work-acquia-dam","checked":"2026-08-07"},{"statement":"Bynder's face recognition, delivered via Bynder Labs, matches faces using feature vectors and does not reliably support cartoon\/illustrated faces","source_name":"Bynder Labs \u2014 Face Recognition","url":"https:\/\/labs.bynder.com\/features\/face-recognition\/","checked":"2026-08-07"},{"statement":"Brandfolder's 'People Tagging' facial recognition feature is available to all Brandfolder customers, framed partly as a usage-rights tracking tool","source_name":"Brandfolder \u2014 Introducing People Tagging","url":"https:\/\/brandfolder.com\/resources\/AI-people-tagging\/","checked":"2026-08-07"},{"statement":"BIPA excludes photographs from the definition of a biometric identifier, but a face-geometry scan extracted from a photo is a covered biometric identifier requiring consent","source_name":"Recording Law \u2014 BIPA Explained (740 ILCS 14)","url":"https:\/\/www.recordinglaw.com\/us-laws\/data-privacy-laws\/bipa\/","checked":"2026-08-07"},{"statement":"Facebook's $650 million BIPA settlement (approved Feb 26, 2021) covered ~1.6 million Illinois class members over its Tag Suggestions facial-recognition feature; Facebook agreed to turn the feature off by default","source_name":"American Bar Association \u2014 Historic Biometric Privacy Suit Settles for $650 Million","url":"https:\/\/www.americanbar.org\/groups\/business_law\/resources\/business-law-today\/2021-february\/historic-biometric-privacy-settlement\/","checked":"2026-08-07"},{"statement":"Illinois' 2024 BIPA amendment (SB 2979) redefined repeated collection of the same biometric identifier via the same method as a single violation; the Seventh Circuit confirmed in April 2026 (Clay v. Union Pacific Railroad) that this applies retroactively","source_name":"Davis Wright Tremaine \u2014 Seventh Circuit Holds BIPA Amendment Applies Retroactively","url":"https:\/\/www.dwt.com\/blogs\/privacy--security-law-blog\/2024\/08\/illinois-bipa-biometrics-law-amended-for-damages","checked":"2026-08-07"},{"statement":"Under GDPR Article 9, biometric data processed to uniquely identify a person is special-category data requiring explicit consent or another narrow legal basis, with fines up to \u20ac20 million or 4% of global turnover","source_name":"Secure Privacy \u2014 GDPR Article 9 Special Categories: Compliance Guide","url":"https:\/\/secureprivacy.ai\/blog\/gdpr-article-9-special-categories-lawful-processing-and-compliance-guide-2026","checked":"2026-08-07"},{"statement":"In February 2024 the UK ICO ordered Serco Leisure and associated trusts to stop using facial recognition and fingerprint scanning to monitor attendance for 2,000+ employees at 38 leisure facilities and to delete unnecessary biometric data","source_name":"Jenner & Block \u2014 The ICO Continues to Clamp Down on Biometric Recognition Technology","url":"https:\/\/www.jenner.com\/en\/news-insights\/client-alerts\/the-ico-continues-to-clamp-down-on-the-use-of-biometric-recognition-technology","checked":"2026-08-07"},{"statement":"Quote: John Edwards, UK Information Commissioner, on the Serco Leisure facial recognition enforcement action","source_name":"City A.M. \u2014 ICO tells Serco Leisure to stop 'unlawfully' using facial recognition and fingerprint data","url":"https:\/\/www.cityam.com\/ico-tells-serco-leisure-to-stop-unlawfully-using-facial-recognition-and-fingerprint-data-to-monitor-staff\/","checked":"2026-08-07"},{"statement":"The EU AI Act bans real-time remote biometric identification in public spaces (with narrow law-enforcement exceptions) and untargeted scraping to build facial recognition databases; first prohibitions took effect February 2025","source_name":"Biometric Update \u2014 Real-time remote biometrics banned in EU with final green light for AI Act","url":"https:\/\/www.biometricupdate.com\/202405\/real-time-remote-biometrics-banned-in-eu-with-final-green-light-for-ai-act","checked":"2026-08-07"}],"kicker":"","fact_checker":0,"reading_time":0,"revisions":[],"seo_title":"Facial recognition in photo management: setup and BIPA\/GDPR rules","seo_description":"Simplify your photo management with advanced DAM systems featuring facial recognition. Discover top platforms, expert tips, and best practices to streamline your workflow and enhance team collaboration!","noindex":false},"categories":[9,11],"tags":[],"silo":[18],"class_list":["post-1810","post","type-post","status-publish","format-standard","hentry","category-software","category-tools","silo-software"],"_links":{"self":[{"href":"https:\/\/picajet.com\/articles\/wp-json\/wp\/v2\/posts\/1810","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/picajet.com\/articles\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/picajet.com\/articles\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/picajet.com\/articles\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/picajet.com\/articles\/wp-json\/wp\/v2\/comments?post=1810"}],"version-history":[{"count":18,"href":"https:\/\/picajet.com\/articles\/wp-json\/wp\/v2\/posts\/1810\/revisions"}],"predecessor-version":[{"id":3726,"href":"https:\/\/picajet.com\/articles\/wp-json\/wp\/v2\/posts\/1810\/revisions\/3726"}],"wp:attachment":[{"href":"https:\/\/picajet.com\/articles\/wp-json\/wp\/v2\/media?parent=1810"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/picajet.com\/articles\/wp-json\/wp\/v2\/categories?post=1810"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/picajet.com\/articles\/wp-json\/wp\/v2\/tags?post=1810"},{"taxonomy":"silo","embeddable":true,"href":"https:\/\/picajet.com\/articles\/wp-json\/wp\/v2\/silo?post=1810"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}} |