Queues at sports events can be very long, even at large venues with many entrance gates. To speed things up, Geelong Football Club recently introduced an “express lane” option for club members.
Instead of scanning tickets on their phone, members can opt in to facial authentication to enter the club’s home venue, GMHBA Stadium. They upload a selfie to their account, and the technology can then verify them at the entrance.
Other AFL clubs are reportedly in discussion with the U.S.-based facial authentication technology provider, Wicket. That means more sports fans may soon need to decide whether this technology is for them.
It’s not the first time facial authentication has been offered at Australian sports venues. Fans at this year’s Australian Open could register with Wicket for faster entry.
Having your face recognized to “skip the queue and get to your seat sooner” promises convenience. But when consumers provide consent for these technologies to record their facial data, they must fully know what they’re consenting to.
Facial recognition is becoming common
Facial recognition technologies are becoming increasingly common in Australia. They’ve been used in retail settings to track shoppers, and by police in Western Australia to spot people of interest in crowded places.
Facial authentication is a type of facial recognition that relies on the individual providing a selfie to confirm their identity, rather than having their face scanned in a public place.
But alongside expanded use come growing concerns about privacy and consent. Under Australian privacy law, facial images and other biometric information are classified as “sensitive information,” which means informed consent is generally required for their collection.
In 2024, the Office of the Australian Information Commissioner found Bunnings breached privacy law because it failed to get informed consent from its customers to collect facial data in-store.
If consent is the key safeguard, the next question is: how can it be meaningfully secured?
What makes consent meaningful?
Under Australian law, consent must generally be informed, voluntarily given, and capable of being withdrawn. In other words, you must understand what you’re agreeing to and have a genuine choice in the matter.
For Geelong Cats’ fans, facial authentication is entirely optional. Members are able to opt out as well. This is important as it gives fans the capacity to change their minds.
One complication, however, is incentives. If club members register for facial recognition, they’re awarded 40 loyalty points. Providing incentives doesn’t make consent invalid. But it does raise the question: At what point do incentives put pressure on fans to sign up where they might otherwise not have?
Where sensitive information is involved, AFL clubs should be cautious about offering rewards such as ticket discounts, prizes, or other benefits in exchange for participation. Even if the incentives are modest, they can risk undermining genuine choice.
What are the potential risks of facial authentication?
Informed consent also requires people to be aware of any risks. So what are some potential risks of providing facial data?
Cyber security
Recent data breaches at Optus, Qantas, and Medibank have shown that even large organizations are vulnerable.
The recent Origin Energy data breach affected about 900,000 customers and exposed personal data, including names, addresses, and dates of birth.
Biometric information is particularly sensitive because, unlike a credit card number or password, it can’t be changed.
While it’s important not to overstate cyber-security risks, some people may wish to minimize the amount of personal data they provide to organizations — including their facial data.
Future data sharing
The idea of “consenting forever” is another issue plaguing much of the consent we provide online. You could agree to one thing today, but the terms might change in the future.
This problem isn’t unique to facial authentication. In 2023, X (formerly Twitter) changed its privacy policy to allow the collection and use of biometric and employment data. Users who signed up years before may not have noticed the change, and may not have signed up in the first place if such a policy had been in place.
In a sports club membership context, it’s important to consider: what additional technologies might become available; what new commercial partnerships the club might enter into in the future; what other changes might they make to how your facial data is used? It’s something to keep in mind when clicking “I agree.”
Function creep and normalization
“Function creep” happens when a technology used for one purpose gradually expands in scope. Over time, what starts out as a simple selfie to prove who you are could extend into mass surveillance.
Fans might use facial authentication to enter a sporting or events venue today. Once the technology is established, however, its use could be expanded for personalized marketing, loyalty programs, or partnerships with other companies.
A related concern is normalization. If facial recognition technologies become common in sporting venues, retail stores, or airports, they might gradually start to become part of everyday life, no matter where we go.
The more common a technology is, the less people might question its use — and the harder it can become to opt out.
Should you opt in?
Facial recognition is increasingly common at sporting venues in the United States. The same might soon happen in Australia.
If this does happen, fans should have a choice about whether to use it or not. But choice is not enough. The choice should be informed, voluntary, and free from coercion, as outlined by law.
Clubs and venues must clearly communicate benefits and risks to their patrons, and explain how they will safeguard their personal information now and in the future.
Adam Andreotta, Lecturer, School of Management and Marketing, Curtin University
This article is republished from The Conversation under a Creative Commons license. Read the original article.
Follow us on X, Facebook, or Pinterest
