On Saturday, I was in Sainsbury’s. Before I could leave, I had to scan my receipt. Nobody accused me of stealing, there was no confrontation, and it was hardly the most dramatic moment of my weekend, but it is another small step between paying for my shopping and being allowed to leave the shop.
It wasn’t facial recognition. It was a checkout verification measure to prevent theft, but it got me thinking about how accustomed we have become to proving ourselves before being allowed to do something that was once ordinary.
Today, Monday 19 October 2026, the House of Commons Public Accounts Committee is examining digital ID, with senior Government officials scheduled to give evidence about the purpose, necessity and delivery of digital identity services. The hearing follows years of Government attempts to make identity verification work across public services, including the difficulties surrounding the earlier GOV.UK Verify programme. [1]
It is a timely hearing, but is Parliament asking a sufficiently broad question?
We already prove our identities to run companies, establish our immigration status and access certain services. Online platforms are required to check ages in circumstances covered by child-safety legislation. Police use facial recognition to compare people against watchlists. Government is developing reusable digital credentials, while private-sector verification providers are becoming part of the machinery supporting identity checks.
Each development comes with an explanation. Preventing fraud, protecting children, catching offenders, improving security or making public services more convenient. Some of those objectives are reasonable, and some of the measures may be proportionate.
But what happens when we stop examining the pieces individually and put the whole jigsaw together?
From checking a transaction to checking a person
Sainsbury’s has introduced facial recognition in selected stores as part of its response to violence, abuse and repeat offending. The company says its system alerts trained colleagues when someone matches an image on a watchlist, and that images which do not match are deleted promptly. [2]
The distinction between a receipt check and facial recognition is critical. One concerns evidence of a transaction; the other attempts to establish whether a person matches a previously recorded identity. Biometric recognition raises different data-protection questions. The Information Commissioner’s Office explains that biometric information processed for the purpose of uniquely identifying someone falls within the special-category protections of UK GDPR. [3]
Sainsbury’s says the technology is intended to protect its staff, and rightly so: shop workers should not have to tolerate threats, violence or repeated abuse.
But the method deserves scrutiny too.
When facial recognition is deployed at an entrance, people who have done nothing wrong may have their faces processed as part of a search for individuals on a watchlist. The justification for looking for particular offenders does not, by itself, settle whether screening the wider public is necessary or proportionate.
There have also been practical problems. In 2026, a customer at Sainsbury’s in East Dulwich was wrongly challenged after staff acted on a facial-recognition-related alert. The company said the software itself had not misidentified him and attributed the incident to staff approaching the wrong individual. [4]
That matters technically, but it does not eliminate the human consequence. Whether the error originates in a biometric comparison, the information on a watchlist or the subsequent intervention, an innocent customer can still find themselves treated as a suspect.
Half a million faces and one incorrect alert
British Transport Police began trialling live facial recognition at London railway stations in February 2026. The first six-month phase involved more than 500,000 facial scans, producing one incorrect alert and no arrests directly attributable to a facial-recognition match. Reporting on the trial identified expenditure of approximately £320,786. [5]
Those findings concern that initial phase, not the results of all subsequent deployments. Other police forces have reported arrests arising from facial-recognition operations, and the legal assessment of these systems depends on how and where they are used.
In April 2026, the High Court dismissed a challenge to the Metropolitan Police’s live facial-recognition policy, finding the particular policy under examination lawful. That judgment should not be ignored, but neither should it be mistaken for a ruling that every deployment, watchlist or application of the technology is necessarily proportionate. [6]
The technology is also extending beyond conventional criminal policing. Immigration Enforcement’s facial-recognition policy, updated on 8 October 2026, sets out arrangements for overt deployments to identify people of immigration-enforcement interest. [7]
These developments bring us back to the same question. How much identification of the wider population is justified by the objective of finding a smaller group of individuals, and who determines whether less intrusive methods would achieve the same purpose?
We have already lived with conditional access, so this is not the first time Britain has made participation in ordinary social activities conditional on presenting an approved credential.
From 15 December 2021, England required COVID-status certification for entry to nightclubs and specified large events. People could demonstrate eligibility through qualifying vaccination evidence, testing or applicable exemptions. The mandatory requirement ended on 27 January 2022. [8]
The rules were introduced as a public-health measure during the pandemic, and there were routes other than vaccination. Those qualifications matter, but so does the precedent: access to particular social venues depended on demonstrating an officially recognised status.
The requirement was temporary, but the principle was clear enough. Entry could be made conditional on verification, with businesses responsible for checking compliance.
That history becomes relevant when similar questions arise around identity, age, legal status and access to services. The reasons for imposing each requirement differ, but we have already seen how credentials can become part of the conditions of ordinary participation.
The ID card was scrapped. The underlying question survived.
Britain has been here before. The Identity Cards Act 2006 established the legislative framework for a national identity-card scheme and National Identity Register. The incoming coalition Government repealed that legislation through the Identity Documents Act 2010, following years of political and civil-liberties debate. [9]
The arguments surrounding that scheme included identity theft, security, immigration controls, cost, privacy and the relationship between individuals and the state. Its abolition was a legislative decision, not proof that the British public had reached one settled view on identification.
Sixteen years later, identity policy looks different. Instead of one compulsory physical card backed by a named national register, we have multiple schemes, providers, credentials and obligations operating for different purposes.
The Tony Blair Institute has continued to advocate digital identity. Government itself has pursued national digital-ID proposals while developing separate services such as GOV.UK One Login and GOV.UK Wallet. [10]
The political status of a particular national scheme is important, but so is what continues around it. Cancelling, revising or making a national ID programme optional does not automatically remove the verification infrastructure established for other purposes.
That is where the jigsaw comes in. A national identity system does not have to look like the one proposed twenty years ago to raise comparable questions about access, consent, privacy and state authority.
The infrastructure is already taking shape
GOV.UK One Login, which I examined in May in One Login To Rule Us All, is intended to give people a reusable way to sign into Government services and, where necessary, prove their identity. GOV.UK Wallet is being developed to support digital credentials. These are not identical systems, and their functionality, availability and legal conditions need to be distinguished. [11]
Meanwhile, the Data (Use and Access) Act 2025 provides a statutory framework for digital verification services, including arrangements for recognised standards and certified providers. [12]
In November 2025, identity verification began becoming compulsory for specified roles at Companies House, including company directors and people with significant control, subject to staged requirements and deadlines. There are alternative approved routes for completing verification. [13]
Immigration status is increasingly evidenced through eVisas and digital share codes. Identity and eligibility checking also form part of right-to-work and right-to-rent procedures. Certified digital verification services are available for certain checks, although their availability does not mean every applicant must use facial recognition or the same digital method. [14]
These are separate legal processes, with different administrators, purposes and safeguards. I am not suggesting they all feed into one central database, although that would seem to be the direction of travel, but I am suggesting that we examine what they collectively establish.
Identity verification is becoming an increasingly familiar prerequisite for demonstrating an entitlement, fulfilling a legal obligation or accessing a service. Even where alternative routes exist, we should ask how accessible they are, whether people understand the information being processed and whether a meaningful non-digital choice remains.
Now the phone becomes another checkpoint
Under the Online Safety Act framework, relevant online services already face duties to use effective age assurance to protect children from certain content. That is an existing legal obligation, not a future proposal. [15]
Separately, in September 2026, the Government announced plans for device-level protections intended to prevent under-18s from taking, sharing or viewing nude images. The proposed approach would require adults to establish their age to access functionality subject to those restrictions. [16]
Another policy discussion concerns age assurance for social-media use, including possible reliance on existing account records and facial age estimation. [17] Facial age estimation is not the same thing as identifying a named individual through facial recognition, although it still raises questions about privacy, accuracy and proportionality.
Protecting children from exploitation and harmful content is a legitimate objective. The question is whether controls applied across devices and services are appropriately targeted, what information adults and children must provide, and how mistakes or exclusions can be challenged.
The justification for a restriction should not exempt its implementation from scrutiny.
AI changes the scale of the question
Artificial intelligence did not create identity checks, surveillance or Government databases. What it changes is the scale and speed at which information can be analysed.
Live facial recognition demonstrates one application: software can compare images captured by cameras against a watchlist and generate alerts without requiring a human officer to perform each comparison manually.
Other forms of machine learning and automated analysis can identify patterns, flag anomalies, connect records and support decisions across large datasets. Their usefulness depends on the information available, the reliability of that information, the permitted processing and the safeguards governing the results.
AI makes the potential consequences of data access and interoperability more significant.
The questions are no longer confined to what information an organisation collects. We also need to examine what that organisation, its suppliers or future authorised users may be able to infer, combine or act upon.
An incorrect record, an inappropriate watchlist entry or a poorly governed data-sharing arrangement may become more consequential when automated systems can process information at speed and scale.
This is why I see AI as the multiplier in the identity debate. It expands what the infrastructure may be capable of doing, without resolving whether the infrastructure should be used for those purposes.
Who authorised the infrastructure?
In August, I examined a related issue in When Did the UK Public Agree to This?, looking at the NHS Federated Data Platform, Palantir and public-sector dependency on private technology suppliers.
That investigation concerned procurement, accountability and control of public information. The question was whether decisions about infrastructure that may become difficult to replace had received sufficient public examination.
A development on 14 October 2026 illustrates why such governance questions deserve attention.
The ICO announced enforcement action against the Metropolitan Police after officers and staff used an unapproved retail-crime intelligence-sharing platform. According to the regulator, approximately 500 accounts were created, 375 were active, and personal information concerning 179 individuals, including three children, was uploaded during the period examined. [18]
The finding concerned information sharing without the necessary approval, oversight and data-protection safeguards.
That failure is instructive. The existence of organisational boundaries and formal policies does not guarantee those boundaries will be respected in practice.
It also connects with another strand of my earlier work, Who decides which news you are allowed to see?, which examined Government proposals concerning the prominence of designated trustworthy news sources.
The issue there was information visibility rather than personal identification. However both debates raise questions about who establishes the criteria, how decisions are reviewed and whether people can meaningfully challenge the consequences.
Your rights may arrive after the consequences
When these concerns are raised, we are often reminded that individuals have data-protection rights, but exercising those rights can be a lengthy process, particularly when the person affected is already dealing with the consequences of an incorrect decision.
Under UK data-protection law, organisations normally have one calendar month to respond to a subject access request, with the possibility of extending the period by up to two additional months in qualifying circumstances. Other rights, complaints and legal remedies may also be available, depending on what has happened. [19]
A subject access request does not automatically reverse a decision, correct an inaccurate watchlist or compensate someone for the consequences of an intervention. Obtaining information can be the beginning of a challenge rather than its conclusion.
I experienced the difficulty of recovering personal data after being deplatformed in 2021. I eventually had to pursue access formally through a subject access request. It was a reminder that the existence of a legal right and the practical ability to exercise it are not the same thing.
Consider the difference in timescale. A biometric system can generate an alert within seconds. Someone can be challenged or denied access before they have any meaningful opportunity to establish what has happened. Understanding the basis of the decision, obtaining relevant information and pursuing a correction may require repeated correspondence or escalation.
The Government has itself acknowledged difficulties surrounding awareness of data-access rights. [20]
That imbalance deserves more attention. Safeguards are not simply words in a policy document; their effectiveness depends on whether ordinary people can use them when something goes wrong.
The question Parliament should be asking
Today, the Public Accounts Committee is examining digital ID. [1]
But the wider question remains.
We have digital identity services, biometric policing, online age assurance and AI systems increasingly capable of processing information and identifying patterns at a scale that changes the practical possibilities.
These measures do not share one purpose, one legal basis or necessarily one technical architecture. Some are compulsory, some optional, some operational and others proposed.
Yet their cumulative effect deserves examination as a whole.
In 2010, Parliament abolished an identifiable national ID-card scheme. Today, the conditions under which people must establish identity or eligibility are being assembled across multiple parts of daily life.
I would call that digital ID by the back door, not because someone has proved the existence of one secret master system, but because a society can develop widespread identity checkpoints without introducing one physical card or holding one debate about the cumulative consequences.
I keep coming back to that receipt scanner in Sainsbury’s. It was a small interaction, easily explained and quickly forgotten.
Taken alone, it tells us little about national identity policy. Taken as a reminder of how normal verification has become, it raises a question worth carrying into today’s parliamentary hearing.
If we are asked to accept each new checkpoint on its individual merits, who is responsible for examining what happens when they are all in place?
References
[1] House of Commons Public Accounts Committee, Digital ID inquiry, committees.parliament.uk/work/9764/digital-id and oral evidence, 19 October 2026, committees.parliament.uk/event/28422
[2] J Sainsbury plc, Putting safety first, 29 April 2026. corporate.sainsburys.co.uk/purpose-in-action/putting-safety-first
[3] Information Commissioner’s Office, What is special category data? ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/lawful-basis/special-category-data/what-is-special-category-data
[4] LBC, Sainsbury’s suspends facial recognition technology at south London branch after innocent man wrongly flagged as a thief, August 2026. www.lbc.co.uk/news/uk/sainsburys-suspends-facial-recognition-east-dulwich
[5] The Guardian, Trial of live facial recognition in London stations leads to a false positive and no arrests, 29 September 2026. www.theguardian.com/technology/2026/sep/29/trial-live-facial-recognition-cameras-london-stations-false-positive
[6] R (Thompson and Carlo) v Commissioner of Police of the Metropolis [2026] EWHC 915 (Admin), 21 April 2026. www.judiciary.uk/judgments/shaun-thompson-and-another-v-the-met-police-commissioner
[7] Home Office, Immigration Enforcement facial recognition policy, updated 8 October 2026. www.gov.uk/government/publications/immigration-enforcement-facial-recognition-policy
[8] Department of Health and Social Care, England returns to Plan A as regulations on face coverings and COVID Passes change today, 27 January 2022. www.gov.uk/government/news/england-returns-to-plan-a-as-regulations-on-face-coverings-and-covid-passes-change-today
[9] Identity Documents Act 2010. www.legislation.gov.uk/ukpga/2010/40
[10] Tony Blair Institute for Global Change, Time for Digital ID: A New Consensus for a State That Works, September 2025. institute.global/insights/politics-and-governance/time-for-digital-id-a-new-consensus-for-a-state-that-works
[11] Government Digital Service, Using GOV.UK Wallet in government. www.gov.uk/guidance/using-govuk-wallet-in-government
[12] Data (Use and Access) Act 2025, Part 2, Digital verification services. www.legislation.gov.uk/ukpga/2025/18/part/2/enacted
[13] Companies House, When you need to verify your identity for Companies House. www.gov.uk/guidance/when-you-need-to-verify-your-identity-for-companies-house
[14] Home Office, eVisas: access and use your online immigration status. www.gov.uk/view-prove-immigration-status
[15] Ofcom, Age assurance duties under the Online Safety Act. www.ofcom.org.uk/online-safety/protecting-children/age-assurance
[16] HM Government, UK to have world’s strongest online child safety laws as government prepares legislation on nude images, 9 September 2026. www.gov.uk/government/news/uk-to-have-worlds-strongest-online-child-safety-laws-as-government-prepares-legislation-on-nude-images
[17] Department for Digital, Culture, Media and Sport and Department for Science, Innovation and Technology, Fact sheet: New rules to protect children online, updated 18 September 2026. www.gov.uk/government/publications/fact-sheet-new-rules-to-protect-children-online/fact-sheet-new-rules-to-protect-children-online
[18] Information Commissioner’s Office, Reprimand and enforcement notice: Commissioner of Police of the Metropolis, October 2026. ico.org.uk/media2/a5tcelok/metropolitan-police-service-reprimand-and-enforcement-notice.pdf
[19] Information Commissioner’s Office, A guide to subject access. ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/subject-access-requests/a-guide-to-subject-access
[20] Department for Science, Innovation and Technology, Empowering people through data intermediaries, consultation, 8 June 2026. www.gov.uk/government/consultations/empowering-people-through-data-intermediaries