Transportation Security Administration

At security checkpoints TSA uses second-generation Credential Authentication Technology (CAT-2) devices that compare a live photograph of the traveller with the photograph on their identity document (one-to-one) and, at a small number of airports, with a gallery supplied by US Customs and Border Protection of travellers expected that day (one-to-many). The Privacy and Civil Liberties Oversight Board staff report says TSA has explored facial recognition since 2017 and has been placing devices with facial recognition at checkpoints since 2023; it names IDEMIA as the maker of the devices and says TSA states they use IDEMIA's MFACE Flex algorithm for one-to-one matching. As of April 2025 TSA had deployed more than 2,100 CAT-2 devices at more than 250 airports; the one-to-many mode was being tested at 10 airports and required enrolment in TSA PreCheck or another trusted traveller programme and an opt-in at check-in. The report says travellers may opt out of one-to-one matching without penalty, but that these policies have "historically not been implemented consistently". The figures of more than 99 per cent accuracy come from TSA and DHS Science and Technology Directorate testing; NIST's separate results for the one-to-one algorithm are also cited. The staff report made 13 recommendations, including a comprehensive Privacy Impact Assessment, and recommended that DHS restore Directive 026-11 on face recognition, whose text DHS removed from its website in February 2025, or reissue an equivalent policy. The DHS 2025 AI Use Case Inventory (entry DHS-327, as consolidated by the Office of Management and Budget) lists CAT-2 and AutoCAT as deployed from September 2023, high-impact, supplied by IDEMIA, with impact assessment, monitoring and an appeal process recorded as in place. The same inventory lists TSA's separate PreCheck Touchless Identity Solution, which uses CBP's Traveler Verification Service and an NEC algorithm, as a deployed high-impact use.