Most shopkeepers would be delighted if they could tell, just by looking at them, which shoppers had previously been detained on suspicion of shoplifting. Retailers also could prevent significant fraud losses if prior check-bouncers and identity thieves had their mugshots pinned to their jacket as they walked to the checkout line. While we don't walk around with this information visible to the world, our faces are almost always visible for all to see. Increasingly, that's just as useful.

Federal and state agencies have long maintained massive databases of face-linked profiles. Private companies—from social media sites to data brokers to industry consortiums—now provide consumer-facing businesses with similar information as well as the technology not only to identify and authenticate customers, but also to personalize how businesses interact with them. When cameras match faces with profiles, businesses know their customers better.

But in adopting this new technology, businesses must consider the potential application of longstanding consumer protections. For example, the federal Fair Credit Reporting Act (FCRA) has, for decades, regulated the use of consumer reports by businesses. Many businesses equate “consumer reports” with only bottom-line creditworthiness scores from traditional consumer reporting agencies (CRAs). However, the reach of the FCRA is far greater, and it encompasses information wholly unrelated to credit.