--- title: "Is Facial Recognition Legal in Germany? AI Act & GDPR Rules (2026)" description: "Facial recognition in Germany is legal only in narrow cases. See what the AI Act prohibits, when Article 9 GDPR applies, and what to do before 2 August 2026." image: "https://compound.law/assets/images/og-image-en.webp" source: "https://compound.law/en-DE/compliance/facial-recognition-germany/" language: "en" --- ![Facial recognition in Germany under AI Act and GDPR](https://compound.law/assets/images/compliance/compliance_2.webp) compliance # Is Facial Recognition Legal in Germany? AI Act & GDPR Rules (2026) 29 June 2026 Short answer Facial recognition in Germany is not generally banned, but it is tightly restricted. Real-time biometric identification in public spaces and database scraping are prohibited under Article 5 of the EU AI Act. Most private-sector uses such as access control or identity verification are high-risk and also trigger GDPR Article 9, a DPIA, and often German works council rules. - Public-space live identification and biometric database scraping are prohibited under Article 5 AI Act rules already in force. - Access control, KYC, and similar deployments are usually high-risk AI and must be ready for the 2 August 2026 compliance deadline. - Biometric data is special-category data under GDPR Article 9, so Article 6 alone is not enough. - Employee-facing deployments usually need a DPIA, a works agreement, and a real non-biometric alternative. **Facial recognition in Germany is legal only in limited use cases.** The short answer is: **public-space live identification is prohibited, most commercial use cases are high-risk, and biometric data triggers GDPR Article 9 from the start**. If your business wants to use facial recognition for access control, KYC, or workforce purposes, you should assess legality under the **EU AI Act**, the **GDPR**, and, where employees are affected, the **German Works Constitution Act (BetrVG)** before rollout. ## Quick Legal Answer The practical first question is not “Which vendor should we buy?” but **“Is this use case prohibited, high-risk, or merely difficult?”** | Use case | Status in Germany | What matters most | | ----------------------------------------- | ---------------------------------- | ---------------------------------------------------------------------- | | Real-time identification in public spaces | Prohibited | Article 5 AI Act; no normal commercial exception | | Scraping face images to build a database | Prohibited | Article 5 AI Act; Clearview-style models are the obvious example | | Office or site access control | Usually lawful but high-risk | Article 9 GDPR, DPIA, non-biometric alternative, often works agreement | | Customer identity verification / KYC | Usually lawful but high-risk | Article 9 GDPR, vendor diligence, conformity work, retention limits | | Employee attendance or behaviour tracking | High-friction and often challenged | BetrVG co-determination, proportionality, DPA scrutiny | | Age estimation without identification | Legally sensitive | GDPR still applies if personal data is processed | That table is the core answer many searchers want: **Germany does not ban all facial recognition, but it bans the most intrusive uses and makes the rest expensive to justify and operate.** ## What the EU AI Act Prohibits For most businesses, the most important prohibition layer is **Article 5 of the EU AI Act**. The main prohibited facial-recognition uses are: - **Real-time remote biometric identification in publicly accessible spaces**, outside narrow law-enforcement exceptions. - **Building or expanding biometric databases by scraping images** from the internet or CCTV footage. - **Untargeted biometric surveillance** practices that move toward mass tracking rather than a specific, justified use case. For legal and product teams, this is the first gate. If the project falls into a prohibited category, the right response is not a better policy or stronger contract package. It is to stop the deployment model. ## When Facial Recognition Is High-Risk Instead of Prohibited Many commercial deployments are not banned, but they are still difficult. **Access control, identity verification, and similar identification workflows** are usually treated as **high-risk AI** rather than low-risk convenience tools. That means the business should expect work on: - a documented **risk-management process** - **technical documentation** and logging - **human oversight** and escalation paths - testing and review of system performance and bias - a realistic **conformity and implementation timeline** before **2 August 2026** If you are still in procurement, this is why early vendor diligence matters. Our related guides on [AI facial recognition compliance](https://compound.law/en-DE/compliance/ai-facial-recognition/), [AI biometric identification](https://compound.law/en-DE/compliance/ai-biometric-identification/), and the [AI Act August 2026 deadline checklist](https://compound.law/en-DE/compliance/eu-ai-act-august-2026-deadline-checklist/) go deeper on those implementation steps. ## GDPR Article 9: Why Biometric Data Changes the Analysis Facial recognition is not only an AI Act topic. It is also a **special-category data** topic under **Article 9 GDPR**. In practice, a German deployer usually needs: 1. An **Article 6 GDPR** legal basis. 2. A separate **Article 9 GDPR** exception. 3. A documented proportionality analysis. 4. A completed **Data Protection Impact Assessment (DPIA)** before launch. One recurring mistake is relying on **legitimate interest** as if Article 6 alone were enough. It is not. If the processing is biometric identification, the Article 9 layer does not disappear. For procurement and contract work, it is also sensible to review the vendor’s [data processing agreement](https://compound.law/en-DE/compliance/data-processing-agreement/) and your broader [GDPR AI procurement](https://compound.law/en-DE/compliance/gdpr-ai-procurement/) workflow before any pilot becomes a production deployment. ## German Workplace Rules Make Employee Deployments Harder If the system touches employees, Germany adds another major rule set: **works council co-determination**. Under **Section 87(1) no. 6 BetrVG**, systems capable of monitoring employee behaviour or performance usually require a **works agreement**. Facial recognition nearly always creates that risk, even where the stated purpose is only entry control. For workplace deployments, the legal baseline is usually: - a signed **works agreement** - a **DPIA** - a clear purpose limitation - restricted access to logs - a meaningful **non-biometric alternative** - no repurposing for performance scoring or disciplinary analytics This is why facial recognition for simple attendance tracking is much harder to defend than many teams expect. Related pages on [AI employee monitoring](https://compound.law/en-DE/compliance/ai-employee-monitoring/) and [AI recruitment screening](https://compound.law/en-DE/compliance/ai-recruitment-screening/) cover adjacent employment-law risks. ## What Businesses Should Do Before 2 August 2026 If your facial-recognition use case is not prohibited, the next question is whether you can make it operationally defensible before the **2 August 2026** high-risk milestone. Use this short checklist: 1. **Classify the use case** under the AI Act before procurement. 2. **Map both GDPR layers**: Article 6 and Article 9. 3. **Run the DPIA early**, while the design can still change. 4. **Check employee impact** and involve the works council where relevant. 5. **Demand vendor evidence**: technical documentation, risk controls, registration status, and contractual support. 6. **Design an alternative path** for people who do not want biometric enrollment. 7. **Set retention and deletion rules** before launch. The main commercial mistake is treating facial recognition as a standard IT purchase and leaving the legal analysis until after pilot success. In Germany, that sequence often fails. ## Market Context: Why the Topic Keeps Growing Anyway Germany still matters commercially for facial recognition because demand remains strong in: - regulated **identity verification** - **enterprise access control** - airport and transport infrastructure - public-sector and border-related biometric systems under separate legal frameworks That commercial growth does not soften the legal analysis. It only means the companies that can document legality, governance, and procurement discipline have a stronger path to deployment than those relying on product marketing alone. ## FAQ ### Is facial recognition legal in Germany? Yes, but only in narrow scenarios. Public-space live identification and biometric database scraping are prohibited. Access control and identity verification may still be lawful if GDPR, DPIA, and AI Act requirements are met. ### What is prohibited under the AI Act? The clearest examples are real-time biometric identification in publicly accessible spaces and scraping images to build biometric databases. Those uses are treated as prohibited practices, not ordinary compliance problems. ### Do I need explicit consent? Not in every abstract scenario, but for many private-sector deployments it is the most defensible Article 9 route. You still need to test whether consent is truly free, specific, informed, and revocable. ### Why is workplace use harder? Because Germany layers employment law onto GDPR and AI Act compliance. Once employees are affected, co-determination, proportionality, and monitoring risk all become central. ### Is a DPIA mandatory? In most real facial-recognition deployments, yes. The more the system identifies people systematically or at scale, the harder it is to argue that a DPIA is unnecessary. ### What should a vendor due-diligence pack include? At minimum: system classification, technical documentation, AI Act compliance roadmap, GDPR support materials, retention logic, logging design, and contract terms that match the actual data flows. *** Compound Law advises businesses on **facial recognition law in Germany**, including AI Act classification, GDPR Article 9 analysis, DPIAs, works council negotiations, and vendor diligence. This page provides general information only and does not replace legal advice for a specific deployment. ## Related Compliance Guides [![GDPR-compliant AI implementation for businesses in Germany](https://compound.law/assets/images/compliance/compliance_1.webp)](https://compound.law/en-DE/compliance/gdpr-compliant-ai-businesses-germany/) [Guides](https://compound.law/en-DE/compliance/gdpr-compliant-ai-businesses-germany/) ### [GDPR-Compliant AI in Germany: A Practical Guide for 2026](https://compound.law/en-DE/compliance/gdpr-compliant-ai-businesses-germany/) [GDPR-compliant AI means a lawful basis, transparency, a DPA, controlled transfers and a DPIA where risk is high. The 2026 guide for German companies.](https://compound.law/en-DE/compliance/gdpr-compliant-ai-businesses-germany/) [![AI legal counsel in Germany for company AI procurement](https://compound.law/assets/images/compliance/compliance_3.webp)](https://compound.law/en-DE/compliance/ai-legal-counsel-germany/) [Guides](https://compound.law/en-DE/compliance/ai-legal-counsel-germany/) ### [AI Legal Counsel in Germany for Companies](https://compound.law/en-DE/compliance/ai-legal-counsel-germany/) [AI legal counsel in Germany helps companies handle EU AI Act, GDPR, DPA, procurement, and rollout risk before signing or launching AI tools.](https://compound.law/en-DE/compliance/ai-legal-counsel-germany/) [![EU AI Act procurement before 2027 for German buyers](https://compound.law/assets/images/compliance/compliance_3.webp)](https://compound.law/en-DE/compliance/eu-ai-act-procurement-before-2027/) [compliance](https://compound.law/en-DE/compliance/eu-ai-act-procurement-before-2027/) ### [EU AI Act Procurement Before 2027 in Germany](https://compound.law/en-DE/compliance/eu-ai-act-procurement-before-2027/) [EU AI Act procurement before 2027 matters now for German buyers because contracts, evidence flows, and deployer support should be fixed before rollout.](https://compound.law/en-DE/compliance/eu-ai-act-procurement-before-2027/) ## Frequently asked questions Yes, but only in narrow and well-documented scenarios. Real-time biometric identification in publicly accessible spaces and biometric database scraping are prohibited under Article 5 of the EU AI Act. Private-sector uses such as access control or identity verification can be lawful, but they usually require a GDPR Article 9 exception, a DPIA, and high-risk AI Act compliance before 2 August 2026. The clearest prohibited uses are real-time remote biometric identification in publicly accessible spaces, scraping face images from the internet or CCTV to build databases, and broader untargeted biometric surveillance practices. These rules apply under the EU AI Act and are not limited to large platforms or government vendors. Usually yes. Facial recognition processes biometric data used to identify a person, which is special-category data under Article 9 GDPR. That means a company needs both an Article 6 legal basis and a separate Article 9 exception, with explicit consent often being the most defensible route for private-sector deployments. In most German workplace deployments, yes. Section 87(1) no. 6 BetrVG gives works councils co-determination rights where a system can monitor employee behaviour or performance. Even access-control deployments usually need a works agreement before go-live. For most high-risk facial recognition systems, businesses should be prepared for the 2 August 2026 compliance milestone. By that point deployers and providers need the required risk-management, documentation, oversight, and conformity steps in place for covered systems. Almost always. Systematic biometric identification is a classic Article 35 GDPR scenario and is commonly treated by German supervisory authorities as DPIA-mandatory processing. The DPIA should be completed before deployment, not after procurement or pilot launch. ## Structured data ```json [ { "@context": "https://schema.org", "@type": [ "Organization", "LegalService" ], "@id": "https://compound.law/#organization", "name": "Compound Law", "alternateName": "Compound Law — AI Law Firm", "url": "https://compound.law/", "logo": { "@type": "ImageObject", "url": "https://compound.law/press/logos/PNG/Compound_Law_Icon.png", "width": 1024, "height": 1024 }, "image": "https://compound.law/assets/images/og-image.webp", "description": "The AI-native law firm in Berlin for start-ups, mid-sized companies and corporates: commercial and contract law, data protection, the EU AI Act, trademarks, corporate law, and restructuring and insolvency. A lawyer reviews every result, billed at a flat fee.", "foundingDate": "2026", "founder": [ { "@type": "Person", "name": "Marko Bradic", "jobTitle": "CEO", "url": "https://compound.law/en-DE/tech-team/marko-bradic/", "sameAs": [ "https://www.linkedin.com/in/markobradic/" ], "knowsAbout": [ "Product strategy and development", "Scaling technology companies", "FinTech and financial services", "AI-powered product innovation", "Business operations and growth", "Digital transformation" ] }, { "@type": "Person", "name": "Mohit Tilwani", "jobTitle": "CTO", "url": "https://compound.law/en-DE/tech-team/mohit-tilwani/", "sameAs": [ "https://www.linkedin.com/in/mohit-tilwani/" ], "knowsAbout": [ "Engineering leadership and architecture", "Scaling high-traffic systems", "AI and machine learning infrastructure", "FinTech platform development", "Cloud infrastructure and DevOps", "Product engineering" ] }, { "@type": "Person", "name": "Julian Jantze", "jobTitle": "Rechtsanwalt", "url": "https://compound.law/en-DE/lawyers/julian-jantze/", "sameAs": [ "https://www.linkedin.com/in/julian-jantze-957b95158/" ], "knowsAbout": [ "Corporate law and corporate governance for technology companies", "Employment law and HR compliance", "EU AI Act compliance and AI governance", "Employee participation models (VSOP/ESOP)", "Regulatory compliance for tech companies", "Legal operations and Legal Tech implementation" ] } ], "employee": [ { "@type": "Person", "name": "Marko Bradic", "jobTitle": "CEO", "url": "https://compound.law/en-DE/tech-team/marko-bradic/", "sameAs": [ "https://www.linkedin.com/in/markobradic/" ], "knowsAbout": [ "Product strategy and development", "Scaling technology companies", "FinTech and financial services", "AI-powered product innovation", "Business operations and growth", "Digital transformation" ] }, { "@type": "Person", "name": "Mohit Tilwani", "jobTitle": "CTO", "url": "https://compound.law/en-DE/tech-team/mohit-tilwani/", "sameAs": [ "https://www.linkedin.com/in/mohit-tilwani/" ], "knowsAbout": [ "Engineering leadership and architecture", "Scaling high-traffic systems", "AI and machine learning infrastructure", "FinTech platform development", "Cloud infrastructure and DevOps", "Product engineering" ] }, { "@type": "Person", "name": "Julian Jantze", "jobTitle": "Rechtsanwalt", "url": "https://compound.law/en-DE/lawyers/julian-jantze/", "sameAs": [ "https://www.linkedin.com/in/julian-jantze-957b95158/" ], "knowsAbout": [ "Corporate law and corporate governance for technology companies", "Employment law and HR compliance", "EU AI Act compliance and AI governance", "Employee participation models (VSOP/ESOP)", "Regulatory compliance for tech companies", "Legal operations and Legal Tech implementation" ] }, { "@type": "Person", "name": "Marc Schuba", "jobTitle": "Founding Partner, Rechtsanwalt (German attorney)", "url": "https://compound.law/en-DE/lawyers/marc-schuba/", "sameAs": [ "https://www.linkedin.com/in/marcschuba/" ], "knowsAbout": [ "IP and IT law", "SaaS and IT contracts, IT outsourcing", "Software and open-source licensing", "Data protection law (GDPR)", "AI law and the EU AI Act" ] }, { "@type": "Person", "name": "Dr. Markus Dreißigacker", "jobTitle": "Rechtsanwalt", "url": "https://compound.law/en-DE/lawyers/markus-dreissigacker/", "sameAs": [ "https://www.linkedin.com/in/markusdreissigacker" ], "knowsAbout": [ "M&A (Due diligence, post-merger integration, IPO readiness)", "Corporate Law (Governance, board work, restructuring)", "Commercial Law (Customer contracts, supplier agreements, NDAs)", "IP (Trademark management, IP transfer agreements)", "Compliance & ESG (Global compliance programs, human rights, sustainability)", "Data Protection (GDPR strategy, DPO experience, privacy programs)" ] }, { "@type": "Person", "name": "Philipp Brandt", "jobTitle": "Partner, Rechtsanwalt (German attorney), Specialist Lawyer for Intellectual Property Law", "url": "https://compound.law/en-DE/lawyers/philipp-brandt/", "sameAs": [ "https://www.linkedin.com/in/philipp-brandt-81b446a/" ], "knowsAbout": [ "Restructuring and insolvency law (crisis advice for management, protective shield and insolvency plan proceedings, insolvency administration)", "Intellectual property (trademarks, unfair competition, copyright, trade secrets, licence agreements)", "Data protection law (data breaches, regulatory fine proceedings, access and damages claims)", "Distribution and commercial law (distribution agreements, acquisition and sale of industrial plants)" ] } ], "address": { "@type": "PostalAddress", "addressLocality": "Berlin", "addressCountry": "DE" }, "areaServed": [ "Germany", "Austria", "Switzerland", "European Union", "United Kingdom", "United States", "Singapore" ], "availableLanguage": [ "de", "en" ], "serviceType": [ "AI law firm", "AI-native legal services", "legal counsel for start-ups and growth companies", "legal counsel for mid-sized companies and corporates", "Commercial Law", "Corporate Law", "Employment Law", "Regulatory & Compliance", "Intellectual Property", "Insolvency & Restructuring" ], "hasOfferCatalog": { "@type": "OfferCatalog", "name": "Compound Law services", "itemListElement": [ { "@type": "Offer", "itemOffered": { "@type": "Service", "name": "Commercial Contracts", "description": "Battle-tested contracts for your sales process", "serviceType": [ "enterprise contracts", "MSA", "DPA", "sales contracts" ], "areaServed": [ "Germany", "European Union", "United Kingdom", "United States", "Singapore" ] } }, { "@type": "Offer", "itemOffered": { "@type": "Service", "name": "International Employment", "description": "Compliant hiring across borders", "serviceType": [ "international employment", "hiring abroad", "employment contracts" ], "areaServed": [ "Germany", "European Union", "United Kingdom", "United States", "Singapore" ] } }, { "@type": "Offer", "itemOffered": { "@type": "Service", "name": "VSOP/ESOP Setup", "description": "Employee participation that actually works", "serviceType": [ "VSOP", "ESOP", "employee stock options", "equity incentives" ], "areaServed": [ "Germany", "European Union", "United Kingdom", "United States", "Singapore" ] } }, { "@type": "Offer", "itemOffered": { "@type": "Service", "name": "Funding Round Support", "description": "Clean legal for your next raise", "serviceType": [ "funding round", "term sheet", "SHA", "due diligence", "cap table" ], "areaServed": [ "Germany", "European Union", "United Kingdom", "United States", "Singapore" ] } }, { "@type": "Offer", "itemOffered": { "@type": "Service", "name": "Corporate Housekeeping", "description": "Get your legal house in order", "serviceType": [ "corporate governance", "board resolutions", "shareholder register" ], "areaServed": [ "Germany", "European Union", "United Kingdom", "United States", "Singapore" ] } }, { "@type": "Offer", "itemOffered": { "@type": "Service", "name": "Data Protection & Privacy", "description": "GDPR compliance that doesn't slow you down", "serviceType": [ "GDPR", "data protection", "privacy", "DPA", "cookies", "data breach response", "GDPR fines", "Art. 82 GDPR" ], "areaServed": [ "Germany", "European Union", "United Kingdom", "United States", "Singapore" ] } }, { "@type": "Offer", "itemOffered": { "@type": "Service", "name": "AI Act Compliance", "description": "Navigate EU AI regulation", "serviceType": [ "AI Act", "AI compliance", "AI governance", "EU AI regulation" ], "areaServed": [ "Germany", "European Union", "United Kingdom", "United States", "Singapore" ] } }, { "@type": "Offer", "itemOffered": { "@type": "Service", "name": "IP & Competition", "description": "Protect and enforce what you've built", "serviceType": [ "IP protection", "intellectual property", "trademarks", "trademark enforcement", "warning letters", "preliminary injunctions", "unfair competition", "software licensing", "open source compliance" ], "areaServed": [ "Germany", "European Union", "United Kingdom", "United States", "Singapore" ] } }, { "@type": "Offer", "itemOffered": { "@type": "Service", "name": "Fractional General Counsel", "description": "In-house legal without the full-time cost", "serviceType": [ "fractional GC", "fractional general counsel", "outsourced legal", "legal retainer" ], "areaServed": [ "Germany", "European Union", "United Kingdom", "United States", "Singapore" ] } }, { "@type": "Offer", "itemOffered": { "@type": "Service", "name": "FinTech Compliance", "description": "Navigate financial regulation", "serviceType": [ "fintech compliance", "BaFin", "banking regulation", "AML", "KYC" ], "areaServed": [ "Germany", "European Union", "United Kingdom", "United States", "Singapore" ] } }, { "@type": "Offer", "itemOffered": { "@type": "Service", "name": "Legal Retainer", "description": "Predictable legal support when you need it", "serviceType": [ "legal retainer", "legal subscription", "ongoing legal support" ], "areaServed": [ "Germany", "European Union", "United Kingdom", "United States", "Singapore" ] } }, { "@type": "Offer", "itemOffered": { "@type": "Service", "name": "M&A Preparation", "description": "Get ready for acquisition interest", "serviceType": [ "M&A preparation", "acquisition", "due diligence", "exit" ], "areaServed": [ "Germany", "European Union", "United Kingdom", "United States", "Singapore" ] } }, { "@type": "Offer", "itemOffered": { "@type": "Service", "name": "Restructuring & Insolvency", "description": "From the first liquidity check to the restructuring itself", "serviceType": [ "restructuring", "insolvency", "StaRUG", "self-administration", "insolvency plan", "director liability" ], "areaServed": [ "Germany", "European Union", "United Kingdom", "United States", "Singapore" ] } } ] }, "contactPoint": { "@type": "ContactPoint", "contactType": "sales", "email": "contact@compound.law", "availableLanguage": [ "English", "German" ], "areaServed": [ "DE", "AT", "CH", "EU", "GB", "US", "SG" ] }, "email": "contact@compound.law", "sameAs": [ "https://www.linkedin.com/company/compoundlawfirm", "https://x.com/CompoundLawFirm" ], "knowsAbout": [ "Commercial Contracts", "enterprise contracts", "MSA", "DPA", "sales contracts", "International Employment", "international employment", "hiring abroad", "employment contracts", "VSOP/ESOP Setup", "VSOP", "ESOP", "employee stock options", "equity incentives", "Funding Round Support", "funding round", "term sheet", "SHA", "due diligence", "cap table", "Corporate Housekeeping", "corporate governance", "board resolutions", "shareholder register", "Data Protection & Privacy", "GDPR", "data protection", "privacy", "cookies", "data breach response", "GDPR fines", "Art. 82 GDPR", "AI Act Compliance", "AI Act", "AI compliance", "AI governance", "EU AI regulation", "IP & Competition", "IP protection", "intellectual property", "trademarks", "trademark enforcement", "warning letters", "preliminary injunctions", "unfair competition", "software licensing", "open source compliance", "Fractional General Counsel", "fractional GC", "fractional general counsel", "outsourced legal", "legal retainer", "FinTech Compliance", "fintech compliance", "BaFin", "banking regulation", "AML", "KYC", "Legal Retainer", "legal subscription", "ongoing legal support", "M&A Preparation", "M&A preparation", "acquisition", "exit", "Restructuring & Insolvency", "restructuring", "insolvency", "StaRUG", "self-administration", "insolvency plan", "director liability" ] }, { "@context": "https://schema.org", "@type": "Article", "headline": "Is Facial Recognition Legal in Germany? AI Act & GDPR Rules (2026)", "description": "Facial recognition in Germany is legal only in narrow cases. See what the AI Act prohibits, when Article 9 GDPR applies, and what to do before 2 August 2026.", "image": "https://compound.law/assets/images/compliance/compliance_2.webp", "datePublished": "2026-06-29T00:00:00.000Z", "dateModified": "2026-06-29T00:00:00.000Z", "author": { "@type": "Person", "name": "Dr. Markus Dreißigacker", "image": "https://compound.law/assets/images/team/markusdreissigacker.webp" }, "publisher": { "@type": "Organization", "@id": "https://compound.law/#organization", "name": "Compound Law" }, "mainEntityOfPage": { "@type": "WebPage", "@id": "https://compound.law/en-DE/compliance/facial-recognition-germany/" } }, { "@context": "https://schema.org", "@type": "BreadcrumbList", "itemListElement": [ { "@type": "ListItem", "position": 1, "name": "Home", "item": "https://compound.law/en-DE/" }, { "@type": "ListItem", "position": 2, "name": "Compliance Guides", "item": "https://compound.law/en-DE/compliance/" }, { "@type": "ListItem", "position": 3, "name": "Is Facial Recognition Legal in Germany? AI Act & GDPR Rules", "item": "https://compound.law/en-DE/compliance/facial-recognition-germany/" } ] }, { "@context": "https://schema.org", "@type": "FAQPage", "mainEntity": [ { "@type": "Question", "name": "Is facial recognition legal in Germany?", "acceptedAnswer": { "@type": "Answer", "text": "Yes, but only in narrow and well-documented scenarios. Real-time biometric identification in publicly accessible spaces and biometric database scraping are prohibited under Article 5 of the EU AI Act. Private-sector uses such as access control or identity verification can be lawful, but they usually require a GDPR Article 9 exception, a DPIA, and high-risk AI Act compliance before 2 August 2026." } }, { "@type": "Question", "name": "What facial recognition uses are prohibited in Germany?", "acceptedAnswer": { "@type": "Answer", "text": "The clearest prohibited uses are real-time remote biometric identification in publicly accessible spaces, scraping face images from the internet or CCTV to build databases, and broader untargeted biometric surveillance practices. These rules apply under the EU AI Act and are not limited to large platforms or government vendors." } }, { "@type": "Question", "name": "Does GDPR Article 9 apply to facial recognition?", "acceptedAnswer": { "@type": "Answer", "text": "Usually yes. Facial recognition processes biometric data used to identify a person, which is special-category data under Article 9 GDPR. That means a company needs both an Article 6 legal basis and a separate Article 9 exception, with explicit consent often being the most defensible route for private-sector deployments." } }, { "@type": "Question", "name": "Do employers need a works agreement for facial recognition?", "acceptedAnswer": { "@type": "Answer", "text": "In most German workplace deployments, yes. Section 87(1) no. 6 BetrVG gives works councils co-determination rights where a system can monitor employee behaviour or performance. Even access-control deployments usually need a works agreement before go-live." } }, { "@type": "Question", "name": "When is the AI Act deadline for facial recognition?", "acceptedAnswer": { "@type": "Answer", "text": "For most high-risk facial recognition systems, businesses should be prepared for the 2 August 2026 compliance milestone. By that point deployers and providers need the required risk-management, documentation, oversight, and conformity steps in place for covered systems." } }, { "@type": "Question", "name": "Do I need a DPIA for facial recognition in Germany?", "acceptedAnswer": { "@type": "Answer", "text": "Almost always. Systematic biometric identification is a classic Article 35 GDPR scenario and is commonly treated by German supervisory authorities as DPIA-mandatory processing. The DPIA should be completed before deployment, not after procurement or pilot launch." } } ] } ] ```