What's documented

Two separate federal programs scan your face at the airport, run by two different agencies with two different rules.

TSA's version — Credential Authentication Technology, or CAT-2 — is for domestic travel and is optional by policy. You can decline the photo and ask for a manual ID check instead, without losing your place in line. Getting a precise national count of how many airports currently run it turned out to be harder than it should be: recent, 2026-dated figures range from roughly 200 to 350-plus airports depending on the date and source, and TSA does not publish one clean, current, dated total. What's certain is the direction: the agency has stated a goal of 400-plus airports, and it's actively expanding, not holding steady.

CBP's version covers international arrivals and departures and works differently. It's mandatory for non-U.S. citizens. U.S. citizens can still decline it and go through a manual passport check instead — that right exists on paper, though DHS's own rulemaking documents acknowledge there have been real instances of citizens being incorrectly told they couldn't board without submitting to the scan.

The part a federal watchdog already found broken

The Privacy and Civil Liberties Oversight Board — an independent federal body, not an advocacy group — published a staff report on TSA's facial recognition program in May 2025. It concluded the program should stay voluntary, which TSA agreed to years ago. But it also found something more concrete and more damning: TSA has not completed a current, comprehensive privacy impact assessment for a program operating at this scale, and the board found the way TSA communicates travelers' right to opt out is inconsistent at the checkpoint itself. Sen. Jeff Merkley (D-OR), who has pushed TSA for oversight of the program and is cited repeatedly in the report's own footnotes, has said he ran into exactly that problem himself in 2023: a TSA officer told him declining the scan would cause a significant delay. It didn't.

TSA ran its own accuracy testing in 2023 and 2024, using more than 1,600 volunteers. The topline finding was that face-matching worked correctly more than 99 percent of the time overall — Black travelers in the sample had the lowest match rate, at 98 percent, though TSA's own study characterized that gap as not statistically significant. It's a small difference either way — from the agency's own data, not an outside audit — but worth naming precisely rather than either overstating it as bias or burying it.

The retention gap

CBP's rule, finalized in a Federal Register notice and taking effect December 26, 2025, requires biometric data collection from non-U.S. citizens at every port of entry and exit. Under that rule, a non-citizen's face data can be retained in a Department of Homeland Security database for up to 75 years. A U.S. citizen's photo, taken at the same checkpoint under the same camera, is discarded within 12 hours.

What Congress has tried, and hasn't finished

A bipartisan bill called the Traveler Privacy Protection Act — reintroduced in the current Congress as S. 1691 by Senators Jeff Merkley, John Kennedy, Ed Markey, and Roger Marshall — would require TSA to get affirmative consent before scanning a traveler's face, bar penalizing anyone who opts out, and mandate annual outside studies of the program's accuracy and bias. It had a Senate Commerce Committee hearing in July 2025. As of this writing it has not passed either chamber. A separate, earlier version of the same bill died the same way in the prior Congress. Twelve senators from both parties asked the DHS Inspector General to formally investigate TSA's program in November 2024; that audit was announced as underway in January 2025, and no public final report has surfaced since — a gap of roughly a year and a half as of this writing.

What this piece is not saying

This isn't saying TSA or CBP's facial recognition programs are unauthorized or being run in secret — both are publicly disclosed, congressionally briefed programs with a stated legal basis. It isn't saying the 98-versus-99-percent match-rate gap for Black travelers is evidence of intentional bias — it's TSA's own measured result, and the report doesn't attribute it to intent. And it isn't claiming CBP is currently violating U.S. citizens' opt-out rights as standard practice — DHS's own documents acknowledge isolated incidents of travelers being misinformed, not a policy of denying the right.

What can I do

At a TSA checkpoint, say "I opt out" or "I'd like to have my ID checked manually" before you're photographed — you're legally entitled to it, and if an officer pushes back or claims it'll cause a delay, that's not a real rule, even a U.S. senator has run into it; ask for a supervisor if needed.

At a CBP checkpoint on international travel, U.S. citizens can similarly ask to opt out of the face scan and have a passport checked manually instead — say so before the camera, not after.

If you use CLEAR, know it's a separate, private, for-profit company, not a government requirement — even though it operates inside the same security lanes. Its privacy policy allows sharing personal data with partners for advertising, which neither TSA nor CBP does. Read its terms before signing up.

Why this is a BL:UF story

The government's own oversight board already looked at this and found the exact problem regular travelers run into: a real right that isn't communicated clearly enough to use it. And the retention numbers tell you plainly who this system is actually built to hold onto — 75 years for a non-citizen, 12 hours for you, from the same camera.

The Receipts

Full sourcing detail, including the unresolved current airport-count figure and DHS OIG audit status, is in newsroom/research-surveillance-sweep-2026-08-24.md.