AEPD sets criteria on facial biometrics: a less intrusive alternative only excludes biometrics if it offers equivalent effectiveness
AEPD answers a strategic query on facial biometrics: when it passes the necessity test and how explicit consent must be articulated.
The Spanish Data Protection Agency (AEPD) published on 3 November an analysis on necessity, freedom of choice and effective risk in the processing of biometric data, in response to a company's query about the use of a one-to-one facial verification system to remotely verify the identity of its clients. The response, which the Agency considers of high strategic level under its 2025-2030 Strategic Plan, anticipates criteria that will be developed in its future guide on biometric processing and is coherent, it notes, with the European evolution, including the Digital Omnibus proposal.
The pronouncement is relevant for any organisation —law firms included— evaluating the incorporation of biometrics into its identity verification processes, because it precisely fixes how the necessity of the processing is judged and when consent can serve as a legal basis.
A less intrusive alternative is not enough on its own
The first criterion attacks a commonplace: the idea that if any less intrusive alternative exists, biometrics is automatically ruled out. The AEPD qualifies: "a less intrusive alternative does not by itself make biometrics unnecessary, its use being potentially possible when it satisfies the same need with an equivalent or superior level of effectiveness".
The necessity test does not consist, the Agency explains, in locating any other technically possible solution, but in comparing the real capacity of the different measures to respond to the concrete need justifying the processing. Two procedures may serve to verify identity and yet present different capacities against risks of impersonation, document manipulation or image alteration. If those differences are relevant to the purpose pursued, it must be analysed whether the less intrusive measure addresses them with equivalent effectiveness.
In the case examined, a remote non-biometric procedure based on documentation, video and visual comparison by specialised personnel already existed, which had detected fraud attempts. The documentation provided identified, however, certain limitations, which made it possible to consider —in ex ante terms— that the previous procedure did not offer equivalent effectiveness against the analysed risks. On that basis, the Agency considers the necessity test passed. The general conclusion it draws: data protection law does not oblige keeping a technology merely because it is less intrusive, but requires justifying that the new solution responds to a real need and that there is no other less intrusive measure with equivalent effectiveness.
The controller's margin of appreciation is not discretionary
The AEPD recognises that the data controller is initially in a better position to know its activity, its risks and its sectoral obligations, and therefore has a technical and organisational margin of appreciation. But that margin "does not constitute a discretionary power exempt from control": the controller must define the need it seeks to satisfy, justify the level of reliability required, identify and compare the reasonably available alternatives and document the reasons for its decision, in accordance with the principle of accountability.
The Agency does not replace the controller in that assessment —it does not fix, for example, what percentage of fraud is acceptable— nor does it certify algorithms. It does verify that the invoked need is real and sufficiently concrete, that the required level of effectiveness is objectively justified and that the impact on rights is proportionate.
There is, moreover, a temporal requirement: the assessment may be made before full deployment when sufficient objective evidence exists —technical tests, trials, metrics, threat analyses—, but the conclusion must then be contrasted with real-world operation. If the expected effectiveness improvement does not materialise or less intrusive alternatives with equivalent effectiveness appear, the controller must review its decision.
Explicit consent requires a real alternative
The second major criterion affects the legal basis. The response shows that the processing of biometric data does not by itself exclude consent: when its requirements are met, it can be the basis of the processing under Article 6.1.a) of the GDPR and, if explicit, allow the processing of biometric data under Article 9.2.a).
The point is that consent must be genuinely free, specific, informed and unambiguous. In particular, the person must be able to reject biometrics "without being deprived of the service or suffering consequences that could materially condition their decision". For that, a real and effective non-biometric alternative must exist.
But —and here is the practical nuance— "a real alternative does not mean an identical alternative". The different procedures may use different technologies or channels and present reasonable differences in speed, convenience or operation. The freedom of consent does not require reproducing all the characteristics of the biometric solution, but guaranteeing that whoever does not want to use it has a practicable route that does not impose costs, loss of rights, exclusions or disproportionate burdens. In the case examined, the AEPD mentions as possible routes in-person attention and electronic verification mechanisms recognised by the legal system, such as the qualified electronic signature or certain mechanisms associated with the electronic national ID card.
Why the criterion arrives now
Facial verification has spread rapidly: remote account opening, access to digital services, client identification in operations with due diligence obligations. Each deployment raises the same sequence of legal questions: is it special category processing? What is the legal basis? Is there a less intrusive alternative? The AEPD's response is framed within its 2025-2030 Strategic Plan, which provides for analysing emerging technologies with high impact on people's rights in order to issue early recommendations and anticipate risks, and is considered of high strategic level: it applies to a concrete case criteria that the Agency will develop in its future guide on biometric processing. The Agency also notes that the response is coherent with the European evolution, including the Digital Omnibus proposal —a legislative proposal not yet approved which in no way conditions either the future guide or this query, both based on the law in force—.
What this means for firms and advisers
The AEPD's analysis has a direct reading for advisory work: clients in the financial, insurance, healthcare or technology sectors incorporating remote facial verification need to document the necessity test by comparing the real —not theoretical— effectiveness of the alternatives, and to articulate consent with a practicable non-biometric route. It is the same documented governance approach required by the procurement of AI providers with specific clauses and that the Agency itself has developed in its joint guide with the Hellenic authority on secure processing environments, where it also insists that contractual guarantees are not enough without technical measures and real audit capacity.
For the firm using identity verification in client onboarding —anti-money laundering, electronic signature, digital onboarding—, the Agency's criterion offers a framework: biometrics is neither prohibited nor presumably unlawful, but its use must be justified, documented and reviewed with evidence, and consent is only valid if the alternative truly exists.
Frequently asked questions
What has the AEPD resolved on facial verification?
It has answered a strategic query about a one-to-one remote facial verification biometric system, setting criteria on necessity, freedom of choice and effective risk.
Does the existence of a less intrusive alternative prohibit biometrics?
Not by itself. It only excludes it if it satisfies the same need with equivalent effectiveness, according to the necessity test that the controller must document.
Can consent legitimise biometric processing?
Yes, if it is free, specific, informed, unambiguous and explicit (Arts. 6.1.a) and 9.2.a) GDPR), which requires a real and effective non-biometric alternative.
Must the non-biometric alternative be identical to the biometric one?
No. It may use other channels or technologies with reasonable differences, provided it does not impose costs, exclusions or disproportionate burdens.
Does the AEPD's response authorise biometric systems in general?
No. The Agency stresses that it is neither a general authorisation nor a technological certification: the controller must maintain the conditions justifying the use and review them if the premises change.
Sources
Fuentes
- Source. Accessed 9 November 2026.
The specific data in this article come from the official sources cited.
