You’re not required to use facial recognition: if other options exist, they must offer you alternatives if you refuse

As long as any other method can achieve the same result, a service provider cannot force you to use facial recognition. If you decline facial recognition, they must offer alternatives such as a card swipe, password entry, or ID verification. They also cannot threaten that “the service won’t be provided” if you refuse. Installing facial recognition devices in hotel rooms, public showers, changing rooms, or restrooms is strictly prohibited.

No cost involved. When asked to use facial recognition, simply ask, “Are there any other verification methods available?” If they claim none exist, demand they provide alternatives. The challenge lies in actually voicing this question on the spot.

The Administrative Measures for the Safe Use of Facial Recognition Technology clearly state: “Where other non-facial recognition technologies can achieve the same purpose or meet equivalent operational requirements, facial recognition must not be used as the sole verification method. If an individual declines facial recognition for identity verification, other reasonable and convenient alternatives must be provided.” The measures further stipulate: “No organization or individual may mislead, deceive, or coerce individuals into accepting facial recognition for identity verification under the pretext of service delivery or improved quality.” Consent to use facial recognition must be “freely, explicitly, and separately given after full disclosure” — meaning you must be asked specifically about this and must agree independently. You retain the right to withdraw consent, and service providers must offer an easy way to do so. For minors under 14, parental or guardian consent is mandatory. In public spaces, facial recognition devices may only be installed if “necessary for public safety” and must display prominent warning signs. Their use inside private areas such as hotel rooms, showers, changing rooms, or restrooms is forbidden. Facial data must be stored locally on devices and must not be transmitted over the internet, except where permitted by law or with explicit consent (effective nationwide as of June 1, 2025).

Common scenarios include residential building access systems, rental platforms, gyms, and hotels requesting facial data. When they claim “the system only supports facial recognition,” quote the exact wording from the regulations: “Where other non-facial recognition technologies can achieve the same purpose or meet equivalent operational requirements, facial recognition must not be used as the sole verification method.” Then demand alternative verification methods such as card swipes, passwords, or ID checks. If they still refuse, report them to local internet regulatory authorities. Certain financial and government services may have separate rules — follow those instead. Unlike passwords, facial data cannot be changed after a breach, so it demands greater caution. Organizations storing facial data on behalf of 100,000+ individuals must register with provincial or higher-level internet regulators within 30 days; this registration status can help you assess their legitimacy. Your rights to access, correct, or delete your personal data are covered in item 8.

国家互联网信息办公室、公安部 (2025). 人脸识别技术应用安全管理办法（第 19 号令，第十条、十二条、十三条、十五条，2025 年 6 月 1 日起施行）. https://www.cac.gov.cn/2025-03/21/c_1744174262156096.htm