Face grouping and privacy, explained

Face grouping is the feature that makes a photo library feel organised: every photo of each person, gathered in one place. It's also the feature people are most unsure about, and they're right to ask questions. It involves biometric data about you and everyone in your photos. This article explains, in plain words, what face grouping does, what face data is, where it lives and how to stay in control, using the Photohawk app as the example.

What face grouping does

Face grouping has three steps:

1. Find the faces. The app looks through each photo and finds the faces in it.
2. Describe each face. Each face is turned into a face template: a set of numbers describing its features.
3. Group similar faces. Templates similar enough to each other are put in one group, which becomes a person once you name them.

The app doesn't know who anyone is. It only knows "these faces look alike". You supply the names and fix the mistakes.

What face data is, and isn't

Face data is the templates, plus the groups and names built on them. It isn't your photos. A template is a list of numbers, not a picture of a face, and it's only useful for comparing faces.

It is sensitive, though. Face templates are biometric data, which privacy laws treat as some of the most sensitive personal data there is. That's why it deserves clear answers to three questions: where is it made, where is it kept, and how is it deleted?

Where it's made: on your phone

In Photohawk Family, our app for your family's photos (coming soon to iPhone), faces are found on your phone. Your photos aren't uploaded to group them.

Where it's kept

• On your phone, in the app's own storage, kept out of your phone backups.
• In the cloud, only if you choose. To group people more accurately, Photohawk offers cloud face matching as a separate choice. Only small face cut-outs are sent, never your photos, to our secure cloud run by Amazon Web Services. That face data is only yours and isn't used for anything else. You can choose to keep it all on your phone instead.

Consent: off until you turn it on

• Face grouping is opt-in. It's off until you turn it on, and the consent box starts unticked.
• Cloud matching is a second consent, on its own screen: continue, or keep it on your phone only.
• Not everywhere. Face grouping isn't offered to people who live in Illinois, because of the state's biometric privacy law.

Without face grouping, you can still search your photos for things, places and the words in them.

Deleting it

You can delete face data at any time, and deleting means deleting:

• Turn face grouping off, or choose Delete all face data: it's deleted on your phone and in the cloud.
• Turn cloud matching off: the cloud copy is deleted, and your people stay on your phone.
• Delete your account: your data goes with it.

The people in your photos

Your library is full of people who didn't choose an app: friends, relatives, other children at a party. A few principles keep things fair to them:

• Grouping is for finding, not for profiling. The app groups faces so you can find photos. Nothing is shared about anyone unless you share a photo.
• Photos leave your phone only when you share them, and only the people you share with can see them.
• Children are never share recipients. Photos of a child can go to adults you choose, but a child can't be invited or sent photos.
• Circles stay private. Labels like "My family" are just for you and are never sent anywhere.

Getting the best results

Face grouping works best when faces are clear. Expect a few gaps with babies and young children, who change quickly, and with photos where faces are small, turned away or in shadow. Merge groups that are the same person and take out photos that don't belong. Your corrections always win. Our guide to finding every photo of your child has practical tips.

Questions to ask any app

• Is face grouping off until I turn it on?
• Are my photos uploaded to group faces, or is it done on my phone?
• If anything is sent, what exactly, and can I say no?
• Is face data in my backups?
• How do I delete it, and does deleting really delete it?

For a wider look at privacy, read keeping family photos private, or see how to organise photos by person, privately.

Photohawk Family is coming soon to iPhone, with Android to follow. Keep an eye on photohawk.com for the launch.