If you have enrolled in Aadhaar, and 1.4 billion Indians have, your face is already in a government database. And if you have flown through a major airport, passed through a railway station, or attended an IPL match in recent years, your face may have been scanned and logged without notice. There is no law requiring you be told. No process to contest a mismatch. No right to know if you appeared in a law enforcement search.
This is not speculation about where India is heading. It is where India already is.
The short answer: India runs one of the world’s largest facial recognition ecosystems. It links AFRS, the Safe City camera networks, and the Aadhaar biometric database. There is no dedicated facial-recognition law, and the DPDPA’s broad state and law enforcement exemptions leave police use largely unregulated. Your strongest personal defences are locking your Aadhaar biometrics, skipping opt-in schemes like DigiYatra, and supporting the legal challenges (RTIs and PILs) filed by groups like the Internet Freedom Foundation.
What AFRS is and what it connects to
In 2019, the National Crime Records Bureau (NCRB) issued a tender for India’s Automated Facial Recognition System — AFRS. The stated aim was to give law enforcement a centralised tool to identify criminals and missing persons. By 2023, multiple states had deployed their own systems ahead of any national rollout.
The scale is what matters. AFRS is designed to draw from a database of more than 2 billion images. The sources include Aadhaar enrollment records (facial photos, fingerprints, and iris scans for 1.4 billion people), passport records, prison and court databases, and CCTV footage. A single unified search, across all of those sources, against a face captured on a street camera.
Aadhaar’s biometric database is already the largest of its kind in the world. AFRS is the mechanism that puts it to work in real time on public streets.
Where the cameras are
The Ministry of Home Affairs runs the Safe City initiative, which has funded centrally connected CCTV networks across Delhi, Lucknow, and other cities. Delhi’s network has surpassed 300,000 cameras, feeding into systems capable of facial recognition against live or stored footage.
Indian Railways has upgraded cameras at more than 100 stations under IRCTC safety projects. DigiYatra lets passengers check in and board at major airports using facial recognition linked to Aadhaar or passport — currently opt-in, but expanding rapidly. Telangana Police used drones with facial recognition during COVID-19 enforcement in 2020.
Large public events add another layer. IPL matches and similar gatherings have used facial recognition for access control, deployed by Indian vendors including Staqu Technologies (whose JARVIS system serves Punjab, Uttarakhand, and other state police forces) and FaceX. NEC Corporation has provided technology for some government contracts.
The picture is not a single surveillance system but an ecosystem of interconnected ones, built by different agencies and vendors, increasingly linked at the data level.
What’s already happened
Facial recognition against protesters is no longer a theoretical concern. During the 2019 anti-CAA demonstrations in Delhi, police used facial recognition to identify attendees — the first documented mass use of the technology against protesters in India. False positives led to arrests of people who had not done what the system said they had.
The Washington Post documented cases where facial recognition matches in Delhi led to the arrest of innocent people. These weren’t edge cases. They were a predictable outcome of deploying a technology with known accuracy problems at scale against a population it performs worst on.
The accuracy problem
Global research is consistent on this point. MIT Media Lab’s Gender Shades study (2018) found commercial facial recognition significantly less accurate for darker-skinned individuals and women. NIST’s Face Recognition Vendor Testing (FRVT) program has documented the same disparity repeatedly across vendors.
India’s population sits in the demographic range where these systems perform least reliably. The people most likely to be misidentified are darker-skinned individuals, women, and anyone photographed in poor lighting or at low resolution.
A system with a 0.1% error rate sounds precise. Applied to a database of 2 billion images, that’s 2 million false matches. For the person on the wrong end of one, the error rate is 100%.
The legal gap
India’s Digital Personal Data Protection Act (DPDPA) 2023 classifies biometric data as personal data. Its implementing rules were notified in November 2025, but most substantive obligations phase in through 2027. And the Act carries broad exemptions for state and law enforcement processing. So there is still no moratorium on facial recognition deployment, no requirement for judicial oversight before a system goes live, and no regulatory body actively auditing police systems today.
The Right to Privacy judgment (Justice K.S. Puttaswamy v. Union of India, 2017) established privacy as a fundamental right under the Constitution. The Parliamentary Standing Committee on Home Affairs recommended a regulatory framework for facial recognition in 2022. Neither has produced enforceable constraints on how these systems operate today.
If a police facial recognition system flags you incorrectly, there is currently no formal process to contest that identification before it results in detention or questioning.
What you can actually do
The options are limited but real.
DigiYatra is opt-in — don’t enroll. If you’ve already enrolled, delete your account through the DigiYatra app. Biometric data is supposed to be purged within 24 hours of your last journey.
Aadhaar biometric lock is the most substantive protection available. Lock your biometrics at uidai.gov.in under My Aadhaar > Lock/Unlock Biometrics. When locked, your biometric data cannot be used for authentication, which creates real friction for any system trying to match against your Aadhaar record. You can unlock temporarily when you need it.
Practical measures — masks, sunglasses, hats — meaningfully reduce recognition accuracy in most deployed systems. Not a complete solution, but a documented and real one for live camera-based recognition.
The legal route runs through the Internet Freedom Foundation (IFF) and the Centre for Internet and Society (CIS), both of which have filed RTIs and PILs challenging state-level deployments. Supporting these efforts is the path toward systemic change.
RTI filings remain underused. The Right to Information Act 2005 lets you ask specific state police forces what facial recognition systems they operate, which vendors supplied them, and which databases they reference. Enough RTIs create accountability even where law does not.
What comes next
The regulatory gap will eventually close. India will have enforceable rules around biometric data. The question is what the default looks like between now and then. How much infrastructure gets built, how many databases get linked, and how many matches get made before any framework constrains the process.
That default is being set now. Cameras, databases, vendor relationships, and institutional habits are all established before rules arrive. Rules tend to accommodate existing infrastructure. They rarely dismantle it.
This affects every Indian who has enrolled in Aadhaar, traveled by air or rail, attended a public event, or walked past a camera in a Safe City. That is not a narrow group.
What you can do right now
Want to see what data brokers expose about you? See what a scan finds → shows an example report: the kinds of sites that list your name, phone, and address. Once KnytX Shield launches it will find and remove these automatically. Join the waitlist to get in early.