Test detail

Based on collected information, here is a comprehensive explanation:

Legal Status of "Consent-Free Facial Recognition" in Japan: Comprehensive Analysis

Conclusion First

Under current law (as of October 2026), it cannot be said to be "directly illegal," but neither is it "clearly legal." This is a "combination" of legislative gap and intentional policy choice, and the situation is changing significantly with the amendment to the Personal Information Protection Act that came into effect in July 2026.

I. Structure of Current Law: What is regulated and what is not

1. Is facial recognition data "personal information"?

Under the current Personal Information Protection Act, facial characteristics are positioned as "data that may be treated as personal identification codes," requiring more careful handling than ordinary personal information.

In other words, the act of capturing a face with a camera and matching it against a database already falls within the scope of the Personal Information Protection Act.

2. Legitimate acquisition obligation: obligations at the "acquisition" stage

When acquiring facial images capable of identifying specific individuals through cameras, the acquisition constitutes obtaining personal information. Therefore, notice of camera operation (such as "surveillance camera in operation" signage) is required to ensure acquisition is not by deception or improper means.

→ That is, if such notices are posted, "acquisition itself" may not constitute "improper acquisition" under current operational standards. This is the core reason why consent-free photography remains in a gray zone.

3. Third-party provision: Consent generally required, but acquisition is separate

Under the Personal Information Protection Act, simple "personal information" that is not database-formatted may be provided to third parties without consent. However, "personal data" constituting searchable "personal information databases" cannot generally be provided to third parties without consent.

→ The law regulates "reuse and external provision" but does not explicitly prohibit "real-time matching on the spot."

4. Tort law safeguards (Civil Code Article 709)

Whether photographing someone's appearance without consent constitutes a tort depends on factors such as the subject's social status, the content of their activities, the location of photography, and the purpose of photography. Additionally, factors considered in evaluating tort liability should also be considered in interpreting prohibitions on misuse (Act Article 19) and proper acquisition (Act Article 20(1)) of the Personal Information Protection Act.

→ Post-facto remedy through tort law remains available, but "legislation prohibiting it in advance" does not exist.

II. The JR East Case: Evidence of absent social consensus

In September 2021, it was reported that JR East had implemented facial recognition cameras to detect released prisoners, parolees, and wanted suspects at stations. However, on the same day, it suspended the system due to criticism that "clear rules and social consensus were insufficient."

This is a symbolic case. Although technically and operationally feasible, despite the absence of legal prohibition, the system was withdrawn due to public backlash. This is counter-evidence of the absence of legal prohibition norms.

III. Japan Federation of Bar Associations: Explicitly identifying the legislative gap

In its 2021 opinion, the Japan Federation of Bar Associations recommended that comprehensive legislation including the following be enacted regarding the use of facial recognition systems for unspecified individuals in both government and private sectors: ① prohibition in principle of creating facial recognition databases and using facial recognition systems without explicit consent; ② strict conditions for exceptional use; ③ effective supervision by the Personal Information Protection Commission; ④ publication of basic information; and ⑤ protection of rights for those whose records are misregistered.

The Federation also stated that regarding facial recognition systems for specific individuals, they should be limited to cases where: ① clear legislation permitting such use exists; ② non-consenting individuals are not subject to facial recognition; and ③ individuals do not face disadvantage for not consenting and are able to choose alternative methods.

→ In other words, the Bar Association assumed as of 2021 that such legislation currently does not exist and called for new legislation.

IV. Is this a "legislative gap" or "intentional choice"?

Answer: A combination of both—but policy choice carries more weight

Japan has carefully examined the scope and purpose of AI development and use regulations, for example by incorporating self-driving vehicle provisions into the Road Traffic Act.

The AI legislation enacted in June 2025 is merely foundational in character and lacks penal provisions.

This reflects a "policy philosophy of prioritizing industrial application over regulatory precedence." While the EU chose ex-ante regulation (risk classification + prohibition), Japan has maintained ex-post measures (guidelines and self-regulation) as its axis.

V. 2026 Amendment to Personal Information Protection Act: Major shift in legal situation

The amendment to the Personal Information Protection Act, approved by the Cabinet on April 7, 2026, enacted on July 10, 2026, and promulgated on July 17, 2026, establishes new handling regulations for "specified biometric personal information" such as facial recognition, fingerprints, DNA, and voice prints.

Three pillars of newly established "specified biometric personal information"

Specified biometric personal information is subject to three special rules: obligation to notify, prohibition of opt-out, and right to request suspension of use. The notification obligation requires: ① name or business name; ② address; ③ name of representative; ④ handling facts; ⑤ intended use; ⑥ content of body characteristics information; and ⑦ procedures for disclosure requests, etc., in "notice" or "readily ascertainable" form. Abstract notices such as "facial recognition in use" alone are insufficient.

Although the amended Act does not generally require consent for handling specified biometric personal information, the availability of the right to request suspension of use is affected by whether consent was obtained. Therefore, in practice, there may be a need to consider obtaining consent. Note that specified biometric personal information, like sensitive personal information, is excluded from third-party provision under the opt-out method.

Implementation schedule

The amended Act was promulgated on July 17, 2026. Implementation is to be determined by ordinance within two years from the date of promulgation, so full implementation is expected by July 17, 2028.

VI. Comparison with the EU: the path Japan did not choose

When the world's first "comprehensive AI legislation" was reached by the EU in December 2023, the use of facial recognition technology in public spaces (technology related to biometrics and emotion recognition) became a major point of contention. The final agreement prohibited such use depending on its purpose, but set exceptions for law enforcement use.

While the EU adopted a design of "prohibition as a principle, with enumerated exceptions," Japan has maintained a design of "no prohibition, accumulation of obligations."

Summary: Overview of Issues

Remaining fundamental issues

Even the amended Act does not establish prohibition of matching without prior explicit consent per se. Notification obligations and the right to request suspension are merely post-hoc and procedural protections, and the structural asymmetry where "facial data is generated merely by pedestrians standing in front of a camera" remains unresolved. This continues to be Japan's fundamental challenge in facial recognition regulation.

Facial recognition technology use in Japan is related to the Personal Information Protection Act. Data obtained through facial recognition constitutes personal information or personal identification codes, and there are specific rules for handling them.

Current legal situation

1. Personal Information Protection Act:

• When acquiring personal information, obtaining consent from the person is generally required.
• Various obligations exist, including purpose limitation, proper acquisition, notification of purpose of use, and restrictions on third-party provision.

2. Necessity of consent:

• Facial recognition generally falls under rules stipulating that "personal data cannot be handled without consent."
• Therefore, unless there is a clear purpose and prior consent has been obtained, it is likely to be illegal.

Legislative gap and intent

• Current law lacks specific legislation for facial recognition itself, meaning the legal system lags behind this technology's rapid development.
• On the other hand, it reflects an emphasis on personal information protection, and rather than being intentionally relaxed, appropriate operation based on existing law is required.

Therefore, the legality of "matching without consent" depends on specific circumstances and operational methods, and cannot necessarily be deemed legal. There is a need for legal system development and the formulation of specific guidelines.

Under current Japanese law (as of October 2026), matching pedestrians' faces without consent is not uniformly illegal and is generally permitted (or difficult to definitively classify as illegal—a gray zone), though depending on purpose and method, it carries risks of portrait rights/privacy infringement (tort under civil law) or APPI violations. It is close to a legislative gap, with an intentionally light regulatory approach (favoring innovation) being the stronger aspect.

1. Treatment under APPI (Personal Information Protection Act)

• Facial images (those capable of identifying specific individuals) constitute "personal information." Facial characteristic data (matching templates) are treated as particularly high-risk biometric data.
• Consent is not a mandatory requirement for acquisition: If one specifies the purpose of use as narrowly as practicable and notifies/publishes it, this is often sufficient (there are exceptions where notification is unnecessary when the purpose is clear from the acquisition situation). In large-scale spaces with unspecified entry (stations, stores, event venues), prior consent is operationally difficult, so notification/publication is the assumed approach.
• For crime prevention and safety assurance purposes, the Personal Information Protection Commission (PPC) guidelines (published/updated around 2023) outline considerations such as specifying usage purpose, notification/publication, and proper acquisition and use. Pure "convenience" purposes (e.g., personalized services, convenience enhancement) fall outside or are judged more strictly by these guidelines.
• 2026 amendment to APPI (2026 amendment, enacted July 2026, promulgated, implementation expected around 2028—within two years of promulgation) newly establishes "specified biometric personal information" (a category emphasizing facial characteristic data):
• Strengthened notification obligations for purpose of use, etc.
• Prohibition of third-party provision via opt-out.
• Special provisions making it easier to request suspension of use even without illegal conduct. This strengthens transparency and individual participation, but does not prohibit acquisition itself or mandate consent. It is not yet in effect.

Commercial, convenience-purpose large-scale, indiscriminate acquisition by private operators is noted in PPC guidelines and industry practice as requiring careful handling, with high criticism risk.

2. Constitutional and civil law portrait rights and privacy

• Supreme Court precedent (Kyoto Prefectural Student Alliance case, 1969) recognizes from the perspective of Article 13 of the Constitution the right not to have one's appearance or demeanor photographed without consent.
• However, on public roads or spaces with unspecified entry (such as store interiors), where there is adequate purpose (such as criminal investigation), necessity, and urgency, and the method is appropriate, legality may be upheld.
• Indiscriminate, large-scale matching for "convenience" purposes is indicated by multiple discussions as having weak necessity/appropriateness and high risk of portrait rights/privacy infringement (tort). Automatic facial recognition in public spaces, while facing strong social resistance even in Japan without strict EU-style regulation, has views such as from the Bar Association that it "should be prohibited in principle."

Even law enforcement photography is subject to questions of purpose and method appropriateness; private convenience purposes face higher hurdles.

3. Background when legality is possible: legislative gap or intentional choice?

• Primarily a legislative gap (or intentionally unresolved). Comprehensive prohibition laws or strict consent requirements specific to facial recognition do not exist; the approach relies on general APPI provisions plus PPC guidelines. There is no explicit nationwide regulation against automatic facial recognition in public spaces (particularly for private/convenience purposes), with substantial reliance on individual business self-regulation and local ordinances/guidelines.
• Intentional aspects: Japan chooses data utilization promotion (the amended APPI also shows expanded exceptions for statistical processing and AI-related matters) and avoids strict regulation like GDPR-type or some US state approaches, balancing through transparency assurance and post-hoc individual participation. The approach makes crime prevention operationally easier and permits convenience purposes if "notification/publication" is provided, setting some hurdles rather than outright prohibition. However, the 2026 amendment's strengthening of biometric data-specific risk measures also represents filling gaps.
• The Bar Association and others propose "prohibition in principle without explicit consent plus strict exception conditions" and call for legislative clarification.

Summary and practical considerations

• Matching without consent cannot be classified as "illegal" under current law, but especially for "convenience" purposes, portrait rights infringement risk is high, and is not recommended from PPC perspectives or social consensus. Thorough notification/publication, clear/appropriate purpose, and restricted third-party provision are necessary.
• After 2026 amendment implementation (around 2028), operational hurdles increase with notification obligations as specified biometric personal information.
• When considering introduction, PPC guideline compliance, clear purpose specification, third-party provision restrictions, and complaint response mechanisms are important. Large-scale tracking enabling name-matching is particularly sensitive.

Information is based on publicly available information as of October 2026. For individual cases, consultation with attorneys or the PPC is recommended. For details, confirm relevant PPC materials, recent precedents, and guidelines.