Facial recognition is not mandatory: if other methods can do the same job, they cannot make face scan the only option; if you refuse, they must offer alternatives

As long as another method can achieve the same purpose, they cannot require face scan alone. If you refuse face verification, they must offer card swipe, password, ID document, or similar alternatives, and they may not force you with “then we cannot serve you.” No one may install face recognition equipment inside hotel guest rooms, public baths, changing rooms, or restrooms.

Cost

No cost. When asked to scan your face, ask “is there another way to verify?” If they say no, demand one. The hard part is asking out loud on the spot.

Benefit

The Administrative Measures for the Safe Application of Facial Recognition Technology (人脸识别技术应用安全管理办法) state: “Where the same purpose can be achieved or equivalent business requirements met, and other non-facial-recognition methods exist, facial recognition must not be the sole verification method. Where an individual does not agree to identity verification via facial information, other reasonable and convenient methods shall be provided.” The measures also state: “No organization or individual may, under the pretext of handling business or improving service quality, mislead, defraud, or coerce an individual into accepting facial recognition to verify identity.” If processing relies on consent, there must be “separate consent given voluntarily and explicitly with full knowledge”: asked separately for this matter, and you agree separately. You may withdraw consent, and the processor must provide a convenient way to withdraw. Processing facial information of minors under 14 requires consent from a parent or other guardian. Face recognition devices in public places must be “necessary for maintaining public security” and carry prominent notices. Inside private spaces in public venues such as hotel guest rooms, public baths, public changing rooms, and public restrooms, no organization or individual may install them. Facial information shall be stored on the device and must not be transmitted over the internet, except as otherwise provided by laws or administrative regulations, or with separate consent (nationwide, effective 1 June 2025)

Notes

Common cases are residential gate access, rental platforms, gyms, and hotels asking you to enroll your face. When they say “the system only supports face scan,” quote the measures verbatim: “Where the same purpose can be achieved or equivalent business requirements met, and other non-facial-recognition methods exist, facial recognition must not be the sole verification method.” Then demand card, password, or ID alternatives. If they still refuse, report to the local cyberspace authority (网信部门). Where national rules require face verification for identity, such as some financial and government scenarios, follow those rules. Unlike a password, a face cannot be changed after leak, so treat it more carefully than a password. Entities storing facial information on 100000 or more people must file with provincial-level or higher cyberspace authorities within 30 working days; that filing is also a question to ask about whether they are legitimate. Rights to access, correct, and delete personal information are in item 8. Someone using your face to take out their own loan is a different matter; see Section 8, item 45 (helping with a face scan).

Sources · 1

1. 国家互联网信息办公室、公安部 (2025). 人脸识别技术应用安全管理办法（第 19 号令，第十条、十二条、十三条、十五条，2025 年 6 月 1 日起施行）. cac.gov.cn/2025-03/21/c_1744174262156096.htm