Meta has removed a previously undisclosed facial recognition system from the companion app for its smart glasses, one day after the technology was publicly revealed. The company's sudden retreat came after media reports detailed the existence of the feature, which Meta had internally code-named NameTag and quietly embedded in the Meta AI app installed on over 50 million devices.
The NameTag System and Its Discovery
The NameTag feature was designed to convert faces captured by Meta's Ray-Ban smart glasses into unique biometric signatures, known as faceprints. These faceprints would then be compared against a database stored locally on the user's device. If a match was found, the app would display a "Person recognized" alert. For faces the system could not identify, the images were cropped, indexed, and stored locally for future processing.
Meta had publicly stated that face recognition for its smart glasses was purely exploratory and that no final decision had been made. However, code analysis revealed that substantial portions of the NameTag system had been integrated into the Meta AI app as early as January, months before the company acknowledged its existence. This discrepancy between Meta's public statements and its internal development drew sharp criticism from privacy advocates and technology experts.
Meta's Response and the Code Removal
Following the initial report, Meta's vice president of communications, Andy Stone, dismissed the findings, asserting that the feature "does not exist." Meta's chief technology officer, Andrew Bosworth, characterized the reporting as "incredibly misleading" and "absolutely dishonest." Despite these denials, Meta issued a software update the next day that removed virtually all traces of the facial recognition code. The update eliminated the face-recognition software libraries, the recognition processing code, and the alert system. Also removed was the folder where the app would have stored unrecognized faces' cropped images and biometric signatures.
Meta declined to answer ten specific questions about the system, including whether it had already created the database of face profiles NameTag used, how long the app retained biometric data of unrecognized individuals, and whether that data would ever be transmitted to Meta's servers. When asked if the removal was planned before the media exposure, Meta did not respond.
Privacy Concerns and Legal Weaknesses
The episode reignited concerns over the pervasive and often unregulated use of facial recognition technology. Privacy advocates warn that such systems, when deployed in wearables like smart glasses, could enable stalkers, abusers, and other malicious actors to identify strangers in public without their knowledge or consent. Unlike smartphones, which are typically held in front of the user, smart glasses can capture faces continuously and discreetly, lowering the barrier for mass surveillance.
Kade Crockford, director of the technology for liberty program at the American Civil Liberties Union of Massachusetts, noted that the removal of the code does not excuse Meta's original decision to ship it. "Meta's sneaky tactics in slipping the face-recognition code into its smart glasses show exactly why data privacy bills need the teeth of strong enforcement," Crockford said. "Companies like Meta prioritize their bottom line, so lawmakers need to speak in the only language its C-suite understands."
Crockford pointed to recent legislative progress, such as the Massachusetts House of Representatives unanimously passing a consumer privacy bill that includes strong enforcement provisions and a private right of action, allowing users to sue violators. Such measures, Crockford argued, are essential to protect consumers from companies that are willing to deploy potentially invasive technologies without public debate or consent.
Historical Context: Meta's Troubled History with Facial Recognition
This is not the first time Meta has faced backlash over facial recognition. In 2021, the company, then known as Facebook, announced it would shut down its automatic Face Recognition system and delete the faceprints of more than 1 billion users. That decision came after years of regulatory pressure, including a class action lawsuit in Illinois under the state's Biometric Information Privacy Act (BIPA), which resulted in a $650 million settlement.
Illinois BIPA, enacted in 2008, requires companies to obtain informed written consent before collecting biometric data, including faceprints, and to disclose data storage and destruction policies. The law has been a benchmark for other states, but no comprehensive federal biometric privacy law exists in the United States. This regulatory gap has allowed companies like Meta to experiment with facial recognition in new products with minimal oversight.
Meta's development of NameTag also occurs against the backdrop of a "dynamic political environment," as noted in internal documents cited by The New York Times in February 2024. These documents reportedly mentioned launching the feature at a time when privacy and civil liberties advocates could be distracted by other issues. This calculated timing underscores the need for proactive regulation rather than reactive enforcement.
Technical Details of NameTag's Architecture
According to code analysis, the NameTag system comprised several components: a face detection module to locate faces in the camera feed, a feature extraction algorithm to convert facial images into mathematical vectors (faceprints), a database on the device to store faceprints linked to names or contact information, and a matching engine to compare captured faceprints against the stored database. The system also included a storage mechanism for "unknown" faces—faces that were detected but not recognized. These cropped images and their corresponding faceprints were saved locally with time stamps and location data, potentially creating a surveillance log on the device.
The removal of the code from the Meta AI app included stripping out the face recognition libraries (e.g., FaceNet-like models), the database schema for storing faceprints, and the user interface elements like the "Person recognized" notification. However, a few remnants remained, such as an internal debug menu label and a dormant link intended to open a recognized person's profile. These leftovers indicate that the system was more than a mere experiment and was close to being production-ready.
Broader Implications for Smart Wearables and Privacy
The Meta AI app serves as the control interface for Meta's Ray-Ban smart glasses, which allow users to take photos, record videos, stream live, and receive notifications. With built-in cameras, microphones, and AI capabilities, these glasses are part of a growing market of "augmented reality" wearables. However, the integration of facial recognition turns such devices into passive identification tools, raising concerns about societal surveillance, discrimination, and chilling effects on public assembly.
Privacy experts emphasize that even if the code was removed, the capability to re-enable it via a software update remains. The company has not committed to not releasing NameTag in the future, nor has it provided guarantees about data handling. The incident also highlights how companies can embed controversial features into widely distributed apps without user awareness, relying on remote activation to deploy them later.
In the European Union, the General Data Protection Regulation (GDPR) and the planned AI Act would impose strict requirements on biometric surveillance, requiring explicit consent or a justified legal basis. In the United States, however, only a few states—Illinois, Texas, Washington, and California—have enacted biometric privacy laws, leaving most Americans without meaningful protection. The NameTag episode underscores the urgency for a federal framework that addresses both the collection and use of biometric data in consumer devices.
The Future of Face Recognition in Smart Glasses
Meta's retreat may only be temporary. The company continues to invest heavily in artificial intelligence and augmented reality, viewing smart glasses as a key platform for its future. Competitors such as Google, Apple, and Snap have also explored face recognition for wearables. Meta's internal memos suggest that the company sees NameTag as a potential value-added feature for users who want to remember names or receive contextual information about people they meet. However, the lack of transparency and the potential for abuse have made it a lighting rod for criticism.
Going forward, the debate will likely center on whether such features can be implemented with adequate safeguards—such as on-device processing that does not transmit biometric data, user opt-ins for each recognized person, and clear labeling of the glasses as recording devices. Until robust laws are in place, companies like Meta will continue to test the boundaries of what the public will tolerate.
The ACLU's Crockford emphasized that the removal of the code is not an act of corporate responsibility but a strategic retreat in the face of negative publicity. "State lawmakers need to do their job and step up to protect consumer privacy," they said. "Meta's actions show that self-regulation will never be enough. We need laws that impose real penalties for invasions of privacy."
The episode serves as a stark reminder that the technology to identify strangers in public is already embedded in devices millions of people carry or wear. What remains to be seen is whether democratic societies will enact the guardrails necessary to prevent its misuse before it becomes the norm.
Source:Ars Technica News