Ask for an alternative to facial recognition when one can serve the same purpose
China’s facial-recognition rules say that where another method can meet the same purpose or equivalent service requirements, facial recognition cannot be the only option. If you decline it, a reasonable, convenient alternative should be offered, such as a card, password or identity document. A provider must not pressure you by saying that the service is otherwise unavailable. Facial-recognition equipment is prohibited inside private spaces such as hotel guest rooms, public bathing areas, changing rooms and toilets.
What it takes
Free. Ask, “Can I verify my identity another way?” If the answer is no, request an alternative. Speaking up in person is often the main hurdle.
What you may gain
The Measures for the Security Management of Facial Recognition Technology Applications require reasonable, convenient alternatives where non-facial methods can meet the same purpose or business requirements. Organizations and individuals may not mislead, deceive or coerce people into facial verification in the name of providing services or improving quality. Where consent is the legal basis, facial data require separate consent that is voluntary, explicit and fully informed, with a convenient way to withdraw it. Processing facial data of children under 14 requires a parent’s or guardian’s consent. Installation in public places must be necessary for public security and accompanied by prominent notices. Installation inside private spaces in public premises—including hotel guest rooms, public bathing facilities, public changing rooms and public toilets—is prohibited. Facial data must be stored within the recognition device and must not be transmitted externally over the internet, except where laws or administrative regulations provide otherwise or separate consent has been obtained. These measures apply in mainland China from June 1, 2025.
Context & considerations
Common examples are residential entry systems, rental platforms, gyms and hotels. If staff say their system supports only facial recognition, point to the rule on alternative methods and request a card, password or identity-document option. If it is still refused, contact the local cyberspace authority. Specific national rules for facial identity checks in some financial or government services take precedence. Unlike a password, a face cannot be replaced after a breach, so it deserves extra care. Organizations holding facial data for more than 100,000 people must file with a provincial-level or higher cyberspace authority within 30 working days; asking about that filing can help assess their compliance. See your personal-information rights for access, correction and deletion.
Research & references
Cyberspace Administration of China and Ministry of Public Security (2025). Measures for the Security Management of Facial Recognition Technology Applications, Order No. 19, Articles 10, 12 and 13; effective June 1, 2025. https://www.cac.gov.cn/2025-03/21/c_1744174262156096.htm