Biometric authentication

Biometric authentication verifies identity using a face, fingerprint or iris, checked with liveness detection to prevent spoofing during onboarding.

Biometric authentication uses a bodily characteristic - face, fingerprint, iris - as an authentication factor (the "inherence" category of strong authentication). In identity onboarding it appears as face matching: comparing a live capture of the user against the photo from the passport chip, guarded by liveness detection against photos, replays and deepfakes. Because biometric matching is probabilistic (a false accept or false reject rate) rather than an exact fixed-secret comparison, and because a face or fingerprint cannot be reset like a password if compromised, it is typically paired with a possession factor rather than relied on alone.

Two architectures matter for privacy: on-device biometrics (FaceID-style, the template never leaves the phone, it merely unlocks a key - the FIDO2 model, also used to unlock remote signing keys under sole control or to activate an EUDI Wallet) versus server-side comparison during identity verification. Biometric data used for unique identification is special category data under the GDPR, so processing needs explicit consent or another Article 9 ground such as substantial public interest, plus minimisation and strict retention limits.