Air Canada is rolling out facial recognition technology to major Canadian airports, beginning with Vancouver International Airport, in a bid to streamline the boarding process.
But while the technology may simplify flying for some — enrolled travellers no longer need to show their boarding pass or physical ID to board most domestic flights — the convenience might not outweigh the potential security concerns, some privacy experts say.
“Any type of biometric data is extremely sensitive information,” said Rozita Dara, an associate professor and principle investigator of the University of Guelph’s Data Management and Privacy Governance research program. “Unlike passwords, you cannot change it.”
Air Canada’s program launched Tuesday at Vancouver International Airport. It’s also available for customers entering Air Canada’s Maple Leaf Lounges in Toronto, Calgary and San Francisco, as well as the Air Canada Café in Toronto, after starting as a pilot project in 2023.
“While we don’t have a specific timeline to share for when other airports will have this, we can confirm we are planning to roll our Digital ID as an option at other Canadian airport gates,” a spokesperson for Air Canada told the Star. “It does require some significant investment for equipment, and new processes for our employees.”
They continued that the program is entirely optional, and that Air Canada has no plans of making it mandatory.
How Air Canada’s facial recognition system works
To enrol in the program, travellers over 18 must first create a digital profile on Air Canada’s mobile app by uploading a selfie, a picture of their passport and a scan of their passport chip.
These are then shared with a third-party company which generates the facial biometrics for one’s profile and for use in verifying their identity at the airport. This company “has access to and uses your facial biometrics strictly on Air Canada’s instructions and solely for the purposes of the digital ID,” Air Canada’s website reads.
While Air Canada did not disclose the third-party provider on its website or to the Star, it appears to be Canadian facial recognition company OARO, a company that employs Amazon’s Rekognition image-recognition software to facilitate its work.
This digital profile, containing one’s selfie, passport details and a unique identifier, is then encrypted and stored only on one’s device, the airline says; the facial biometric data used to create the profile are immediately deleted.
Travellers can then check in on the device where their digital profile was created before their flight, after which facial recognition cameras installed at certain airport gates will match their image with that of their digital profile — no ID or boarding pass needed.
“Customers utilizing Digital ID will be among the first to board the aircraft and get settled in sooner,” the airline said in a release.
How Air Canada protects your privacy
Travellers’ digital profiles are stored only on their mobile devices until the day of one’s flight, the airline said. At that time, the information is encrypted and sent to Air Canada’s biometrics provider for use in identification at the airport.
“Our provider does not retain any copy of your biometrics created and used for the authorized purposes,” according to Air Canada. The biometric data generated from the airport facial recognition cameras are “immediately deleted after use,” and those created from one’s selfie on the day of travel are deleted within 36 hours of departure.
In a news release, Mike Maxwell, aviation leader at OARO, said the “biometrics is facilitated through an anonymized process, maintaining an even higher standard of privacy than called for by Canadian or General Data Protection Regulation requirements.”
Why some experts are concerned
While experts say Air Canada’s privacy measures appear robust, some expressed concerns with how the systems are trained, what happens when it fails to recognize travellers — and the airline’s third-party facial recognition provider.
“These collect a lot of biometric, personal information about you, but you don’t necessarily know who they are or how they protect your data,” said Florian Kerschbaum, a professor at the University of Waterloo’s David R. Cheriton School of Computer Science.
He also noted that, because one’s information must be sent from their phone to Air Canada and their third-party provider on their day of travel, it creates an opening where malicious actors can intercept and steal your biometric data.
That’s a big issue, according to Dara, because unlike a stolen password, “you can’t change your face.” Malicious actors can then use this information to gain access to your accounts on other platforms that use biometric verification.
Canadian airports have been slow to embrace the technology, but facial recognition software has already been in use by some U.S. and international airlines, companies and government security agencies for years. You may already be using it to unlock your iPhone.
As more companies adopt the technology and the ecosystem grows, so too does the threat of identity theft and abuse, Kerschbaum and Dara say. “In my opinion, I’d never use (facial recognition),” Dara added.
As for whether you should sign up for Air Canada’s program, “it depends on your personal preference,” Kerschbaum said.
“These biometrics can be very convenient… But (you have to ask), is boarding a plane important enough for me to use it?”
