Face or voice biometric template computed without prior notice and consent

Check a recorded, purpose-specific biometric notice and consent before any code computes, enrolls, or matches a face or voice template.

A consent gate placed immediately before the call that turns an image, video frame, or voice sample into a template or identity match (face_encodings, DeepFace.represent, rekognition.index_faces, voice embedding). The gate reads a stored consent record for this person and purpose (what is collected, why, and how long it is kept), refuses to compute the template without it, and the template is stored with a reference to that record. The notice copy shown at enrollment lives in the capture UI.

Where it goes: 1 application source code, 2 data models, 6 API calls and integrations, 14 user-facing text.

What reviewers look for: on every path from an uploaded selfie, camera frame, or voice clip to a template or match call, a check of a stored consent or release record (not just a checkbox that is never read); the template row references the consent; templates are not built from scraped or public images without the person's consent.

def enroll(user_id, image):
    encoding = face_recognition.face_encodings(image)[0]
    db.templates.insert(user_id=user_id, encoding=encoding)

def enroll(user_id, image):
    consent = db.biometric_consents.get(user_id=user_id, purpose='face_login')
    if consent is None or consent.withdrawn_at:
        raise ConsentRequired('biometric notice and consent needed before enrollment')
    encoding = face_recognition.face_encodings(image)[0]
    db.templates.insert(user_id=user_id, encoding=encoding, consent_id=consent.id)

Engineering guidance, not legal advice. Each provision below may add its own details (a cadence, a deadline, a required notice element): open it for those.