PHOTO: APPLE

iPhone X Face ID May Risk User's Facial Data

The iPhone X releases today, and with it come more concerns about the privacy and security of its new Face ID feature.

• By Jessica Davis
• Nov 03, 2017

The iPhone X releases today, and with it come more concerns about the privacy and security of its new Face ID feature.  While Apple has stated since it announced Face ID that the user’s facial data is encrypted and stored securely on the iPhone X, application developers may be allowed to take certain facial data from user’s phones.

Apple’s Face ID allows users to unlock their phone by simply making direct eye contact with it. Face ID works by taking the user’s image and a dot pattern created by projecting more than 30,000 invisible dots onto their face to make a mathematical model.

Apple says this biometric data never leaves the device itself and is stored in an encrypted form on the phone’s secure enclave. The data then cannot be accessed by the operation system or any applications on the phone.

However, parts of Apple’s contract allow app developers to take a rough map of a user’s face and a stream of more than 50 kinds of facial expressions off the phone. As long as these developers agree to seek “clear and conspicuous consent” from users, they can remove facial data and store it on their own servers. The data must be used for legitimate app purposes and not marketing or advertisement and cannot sold to third parties that may use it for those purposes.

Questions remain as to how Apple will enforce these terms and their ability to control what app developers do with facial data once it’s taken from the device itself. These reports come shortly after security researchers at Trend Micro’s Pwn2Own contest in Tokyo found exploits in Apple’s newly released iOS 11.1.