Privacy Advocates and Devs Raise Concerns About Third-Party App Access to TrueDepth Camera
Apple goes into great detail about the security of the Face ID facial recognition system built into the iPhone X in a security white paper and a support document, but relatively little has been said about the access that developers have to facial data captured by the TrueDepth camera, which has led privacy advocates and developers to express concerns about what apps can glean about you from your face.
A new piece from The Washington Post that includes commentary from both privacy experts and Apple itself explores the data third-party apps can access, echoing concerns previously brought up earlier this month.
Apps have no access to the facial map that Face ID uses to unlock your device, but developers are able to use the TrueDepth camera to scan a user's face for the purpose of creating more realistic augmented reality apps. As described by Apple:
Using the TrueDepth camera, your app can detect the position, topology, and expression of the user's face, all with high accuracy and in real time, making it easy to apply live selfie effects or use facial expressions to drive a 3D character.
Apps are able to see a full 3D face map along with a "live read-out" of 52 micro-movements in the eyelids, mouth, and other features. MeasureKit, a free app developed by Rinat Khanov, has a face mesh tool built in that displays the facial data the TrueDepth camera can capture along with a list of the facial expressions it tracks.
"We take privacy and security very seriously," Apple spokesman Tom Neumayr said. "This commitment is reflected in the strong protections we have built around Face ID data--protecting it with the Secure Enclave in iPhone X--as well as many other technical safeguards we have built into iOS."
As Fowler points out, apps that are using the TrueDepth camera are not currently providing enough information to customers. The popup to access the TrueDepth camera is the same generic popup that is required for the standard front and rear-facing cameras, and it does not mention that additional data is being collected.
Whether Apple will put stricter policies in place remains to be seen, as does how this kind of facial recognition data will be used in the future, but customers should be made aware of what's being provided to app developers. For those concerned, it's worth downloading the MeasureKit app or a similar app to see what's potentially being collected when an app accesses the camera on your iPhone X.