Google's fun 'match your selfie with art' app points to the scary future of facial recognition

Thanks to Google, you can now find your portrait hanging in a museum somewhere — sort of.

Last week, Google added a new feature to their little-known Arts and Culture App. It uses facial recognition to match your selfie with a work of art that somewhat resembles your own features.

The results are fun, landing somewhere between fairly accurate and insultingly wrong, and they have limitations. The app has been criticized for its lack of diversity, matching people of colour with pieces of art that have been called racist stereotypes. It's unclear whether this is an issue with the app's facial recognition algorithm or a lack of representation in art collections.

Aside from those concerns, users are wondering what Google plans to do with all these selfies.

"[Users] don't realize that a face is a very strong identifier," says Vitaly Shmatikov, a professor and privacy researcher at Cornell Tech. "It's a nexus, in some sense, that links multiple pieces of information together about them."

The concern is that all these selfies could be uploaded to Google as a way to train the company's facial recognition algorithms. For their part, the company has explicitly stated this isn't happening. According to them, your photo is only stored for as long as it takes to match you with artwork.

However, according to Google's universal terms of service, any content you upload to the company's servers can be used "for the limited purpose of operating, promoting, and improving our Services, and to develop new ones."

"What is important to understand here is that the restrictions are not technological," Shmatikov says.

"They're based on policy and internal governance of these companies."

Shmatikov warns that our privacy relies on the rules set by internet companies. Companies like Facebook and Google could change how your photos will be used at any time.

There's nothing to suggest that will happen with your selfies in this case, but as we become increasingly willing to share our likeness with internet companies, Vitaly believes companies will leverage our comfort.

"[Your face] will increasingly become the definition of who you are," he says. In the near future, rather than passwords or fingerprints — the current standard for biometric verification — we'll simply scan our faces.

In a statement, the Office of the Privacy Commissioner of Canada says it has not reviewed Google's Arts and Culture app, but notes that the agency does not set specific rules for collection of biometric data for the purposes of facial recognition. According to spokeswoman Tobi Cohen, additional guidance on the use of this data will be available later this year.

Collection of this data today would likely fall under the agency's Personal Information Protection and Electronic Documents Act, more commonly known as PIPEDA.

"Under PIPEDA, an organization must inform individuals of all the uses of their personal information in order for their consent to be considered meaningful," says Cohen.

"As technological capabilities become more diverse and the range of potential secondary uses expands, it may prove challenging for organizations to meaningfully convey to individuals what their image will be used for and by whom."

According to Shmatikov, we're already seeing examples of secondary and questionable ways facial recognition can be used.

FindFace allows users to upload a photo which the service matches with similar faces across Russian social network VK. A photo of anyone can be uploaded — not just your own — and Shmatikov worries a service like this could be used for bad, not good.

Consider a user who has changed their name to hide from someone, but still uses a photo of themselves online. If the person they are hiding from can easily match a photo, their anonymity is limited.

"That's an example of a use of facial recognition technology that's very disturbing from a privacy perspective."

Another concern is the accuracy of facial recognition. While current systems are powerful, they still lead to false matches and are easy to spoof.

"It's not like a password that you can change — you cannot change your face if it becomes compromised," says Shmatikov.

As facial recognition technologies become more powerful, Shmatikov does recognize the benefits. With each face having unique features, using facial recognition to log into accounts will be more secure than current methods. But it's up to companies to ensure they're ready.

"They will have to deliberately impose some technological restraints on what they can do," Shmatikov says. "I hope that the day will come when users can check how their facial information is used and impose constraints on how companies use it."

"But that would require companies to be significantly more transparent about their uses of facial recognition technologies."

To hear our full interview with Vitaly Shmatikov, listen in the CBC Radio player on this page.