Some proof-of-personhood systems prove a person is unique with a biometric, such as an iris or face scan. Others use government documents, in-person events or social vouching. This page explains how biometric approaches work, their strengths and risks, and how document-based approaches compare.
How biometric proof of personhood works
- Scan. The person's iris, face or fingerprint is captured, often with dedicated hardware to resist fakes.
- Compare. The system checks the biometric against everyone already enrolled, to make sure this person hasn't signed up before.
- Issue. The person gets a credential they can use to prove, later and privately, that they're a unique human.
Because the comparison is against everyone, the system needs some representation of every enrolled person's biometric, even if it's encrypted, transformed or split up. How that's handled is the heart of the privacy question.
Strengths
- One per person, everywhere. You have one set of irises regardless of how many passports you hold, so biometrics catch people who'd otherwise enroll twice with documents from different countries.
- No document needed. People without a government ID can still enroll, which matters in places where many people lack one.
- Hard to fake in person, when dedicated hardware checks for liveness.
Risks and concerns
- Biometrics can't be changed. A leaked password can be reset; an iris or face can't.
- Collection at scale. Comparing against everyone means a large biometric dataset exists in some form, which raises the stakes of any breach or misuse.
- Law and regulation. Biometric data gets special protection in many places, such as the GDPR's special-category rules and US laws like Illinois' BIPA. Some biometric programs have faced regulatory challenges and suspensions.
- Access. Specialized scanners have to be physically reached, which limits who can enroll.
- Trust. People are understandably wary of scanning their eyes or face for a company they've just met.
Document-based approaches, compared
Document-based proof of personhood checks a government ID instead, and uses the document to tell people apart.
| Biometric (dedicated scan) | Document-based | |
|---|---|---|
| What makes a person unique | Their biometric | Their government document |
| What the person needs | Access to scanning hardware, or a phone app | A government ID and a phone |
| Weak spot | Biometric data at scale; access to hardware | People with IDs from two countries; people with no ID |
| Familiar to people and regulators? | Less | Yes: ID checks are common |
| Can biometric data be avoided? | No | Mostly: a face match is common, but it needn't be kept |
On face matches: most online ID checks include a selfie and liveness check to make sure the document belongs to the person holding it. That's a biometric comparison, but it's one-to-one (this face against this document), not one-to-everyone, so nobody needs a database of faces. The images can be deleted as soon as the check finishes. Phone-based digital licences can avoid the selfie altogether, because the phone's own unlock already ties the person to the credential.
How Human Pass does it
Human Pass uses the document-based approach:
- A person verifies a government ID once with an identity-verification provider, including a liveness and face-match check. Human Pass asks the provider to delete the images and face data as soon as the check finishes (30 days at most), and never receives any biometric data itself.
- Uniqueness comes from one-way fingerprints of the document, not from faces.
- Each site gets a yes and an ID for that person on that site, nothing else.
Its limits: it needs a government ID, and someone with qualifying IDs from two countries could in principle enroll twice; a name-and-birth-date check flags likely cases for review.