Surveillance worldwide: proposed, misused, and pushed back

In June 2026 Metropolitan Police Commissioner Sir Mark Rowley announced the most significant expansion of live facial recognition in London to date: static LFR cameras mounted on street furniture across the West End and Soho by the end of 2026, meant to grow into a citywide infrastructure programme rather than time-limited van operations. It followed a six-month Croydon pilot (October 2025 to March 2026, 24 operations, 173 arrests, more than 470,000 faces scanned) and an April 2026 High Court ruling that the Met's LFR policy was lawful, now under appeal. Big Brother Watch urged the force to stop until Parliament legislates, noting the UK still has no specific statutory framework for LFR.

In June 2026 the UK Home Office switched on number-plate checks through the EU's Prum data-sharing framework, letting officers query overseas-registered vehicles across EU member states and get vehicle-keeper details back in about ten seconds instead of days or months. It bolts cross-border reach onto Britain's already vast plate-reader system -- commonly cited at around 11,000 ANPR cameras reading roughly 50 million plates a day into the National ANPR Data Centre, where records are retained for a year. The government framed the link-up around border security, illegal migration and organised crime.

London's Metropolitan Police scanned the faces of about 80,000 people at a single protest and have run live facial recognition against millions of faces. Youth worker Shaun Thompson was wrongly flagged, detained, and threatened with arrest before being compensated. Campaigners call it stop and search on steroids.

In the Greek Watergate scandal, Intellexa's Predator spyware was used against politicians and journalists, and in 2026 a Greek court sentenced Intellexa founder Tal Dilian and others to eight years for illegal operations.

New Zealand police query Auror, an Auckland retail-crime ANPR platform, hundreds of times a day -- around half a million times a year -- with thousands of officers able to access it without stating a reason. Defence lawyers challenging it in the Court of Appeal call it 'surveillance capitalism.'

German state police have adopted Palantir's Gotham data-mining platform -- Hesse's HessenData since 2017, North Rhine-Westphalia's DAR, Bavaria's VeRA (live from late 2024) and Baden-Wurttemberg from 2025 -- to fuse names, addresses, phone and social-media records into instant profiles, including of people never suspected of a crime. In a 2023 landmark ruling the Federal Constitutional Court struck down the Hesse and Hamburg data-mining laws as too broad; civil-liberties groups GFF and the Chaos Computer Club have since filed constitutional complaints against Bavaria and North Rhine-Westphalia, calling it a 'Palantir dragnet.'

In July 2025 a presidential decree made the biometric CURP -- face, fingerprints, and iris captured in a QR code -- the mandatory national ID for nearly all public and private services. A new Unified Identity Platform links it to other state databases for real-time cross-checks, and from 2026 every mobile line must be tied to it. The decree lets prosecutors, the National Intelligence Center, the National Guard, and the security ministry consult the database -- including bank and telecom data -- without notifying the person. Framed as a response to Mexico's missing-persons crisis, it drew warnings of a mass-surveillance ecosystem from digital-rights groups R3D and Article 19, and courts in several states issued injunctions pausing the rollout.

Italy's intelligence services used Paragon's Graphite spyware against journalists and migrant-rescue activists, confirmed by Citizen Lab in 2025, including Fanpage journalist Ciro Pellegrino and Mediterranea Saving Humans founders.

In March 2025 Hungary's Parliament rushed through three amendments in 24 hours -- to the Assembly Act, the Infraction Act and the Facial Recognition Technology Act -- banning Pride events and authorising police to use live facial recognition to identify participants and anyone committing even minor infractions such as jaywalking. Effective April 15, 2025, it dramatically widened biometric surveillance of peaceful assembly. Rights groups (HCLU, EDRi, ECNL, Liberties for Europe) argue it violates the EU AI Act, which already bars real-time remote biometric identification in public, and the EU Charter; the European Commission has been slow to act. Budapest Pride went ahead in June 2025 as the country's largest anti-government demonstration in years.

An Amnesty International report found that Serbian police and the BIA intelligence agency used Cellebrite forensic tools to secretly unlock the phones of journalists and activists during detention, then installed a homegrown Android spyware called NoviSpy that can copy data and switch on the camera and microphone. Investigative journalist Slavisa Milanov and environmental campaigners were among those hacked after being held for routine-seeming interviews.

A November 2024 Amnesty International investigation, 'Coded Injustice,' found Denmark's welfare agency Udbetaling Danmark and its administrator ATP run some 60 fraud-detection algorithms -- including a 'Really Single' model that guesses a person's relationship status and the 'Gladsaxe Model' -- that mine vast personal data and flag 'unusual' or 'atypical' living and family patterns, disproportionately targeting people with disabilities, low incomes, migrants and foreigners. Denmark's Parliamentary Ombudsman opened an inquiry; the agency denies it amounts to social scoring.

In October 2024 a coalition of 15 organisations, including La Quadrature du Net and Amnesty International, filed a complaint before France's top administrative court against the risk-scoring algorithm used by the national family-benefits fund CNAF. The system assigns welfare recipients a fraud-suspicion score from data on their circumstances; analysis showed it effectively rated the poorest, single parents, disabled people and those born outside the EU as higher risk, singling them out for intrusive checks.

Iranian authorities installed facial recognition at Amirkabir University of Technology in Tehran to identify and penalize women students who removed their headscarves, part of a wider rollout of cameras and drones to enforce hijab laws.

At Greece's EU-funded Closed Controlled Access Centres for asylum seekers, two systems -- Centaur (CCTV, drones and AI behavioural analytics that flag 'threats' and log incidents, monitored from Athens) and Hyperion (biometric fingerprint entry and exit) -- put residents under constant surveillance behind curfews, with cameras even in sleeping containers. Most residents interviewed said they were never told they were being filmed. In April 2024 the Greek Data Protection Authority fined the Migration Ministry 175,000 euros for GDPR breaches over the rollout.

The American firm Clearview AI is expanding across Latin America, giving law enforcement in countries including Argentina, Brazil, Colombia, and Ecuador access to its database of billions of scraped faces, even as it faces fines and bans elsewhere. Rights advocates warn it puts much of the region in a perpetual police lineup, risking wrongful arrests and profiling.

Nigeria's biometric National Identification Number system, tied to SIM and bank registration, has suffered data breaches exposing citizens' personal records, alongside exclusion of those unable to enroll.

In Rio de Janeiro, a woman was wrongly detained after a facial-recognition database flagged her as a fugitive, even though she was already serving her sentence under an open regime.

The Dutch data-protection authority fined Clearview AI for building an illegal facial-recognition database from scraped photos of people in the Netherlands, one of several EU regulators to penalize the company.

A Predator spyware customer assessed as highly likely linked to the Philippines was identified by Recorded Future, the first time the tool's use was tied to the country.

Serbia is expanding Huawei's Safe City facial-recognition camera network in Belgrade, with leaked 2024 contracts showing capacity for up to 3,500 additional cameras despite public protests.

In late 2023 investigative outlet Disclose revealed that France's national police and gendarmerie had for years quietly used Briefcam, an Israeli video-analytics system capable of facial recognition, to search and filter surveillance footage without public debate or, critics argued, a clear legal basis. A 2024 CNIL investigation concluded the Interior Ministry had not used the software for real-time facial recognition in public space, but the episode exposed how FR-capable tools were deployed in secrecy.

Sao Paulo's Smart Sampa program wires up to 20,000 cameras with facial recognition across a city of 12 million, watching streets, schools, and public spaces. Rights groups warn it could drive mass incarceration of Black residents, citing a 2019 study that found about 90 percent of those arrested through facial recognition in Brazil were Black. The Public Defender's Office sued to suspend it.

In July 2023 the European Court of Human Rights ruled that Russia violated Nikolay Glukhin's rights by using Moscow metro facial recognition to identify and arrest him over a peaceful solo protest. Glukhin had ridden the underground in August 2019 holding a life-sized cutout of jailed activist Konstantin Kotov; days later the system flagged him and police detained him. The court found the deployment incompatible with the values of a democratic society governed by the rule of law -- one of the first international rulings against live facial recognition.

In the occupied West Bank city of Hebron, an Israeli military facial-recognition system called Red Wolf scans Palestinians at checkpoints and enrolls their faces into surveillance databases without consent, deciding who may pass. Amnesty International's 2023 Automated Apartheid report documented how it automates movement restrictions and tracks residents, and how soldiers were rewarded for registering as many Palestinians as possible.

Israeli surveillance cameras in occupied East Jerusalem capture license plates on fixed and moving vehicles, feeding a database of Palestinians that records plates, permits, and addresses, restricting Palestinians' movement within their own neighborhoods. Researchers identified Hikvision and TKH cameras in the network.

Israeli soldiers in Hebron use face-scanning cameras, known as Red Wolf, to identify Palestinians at checkpoints without checking IDs, feeding a database used to control their movement. Amnesty calls it automated apartheid.

Iran's police run a phone app, Nazer, that lets officers and vetted civilians flag a vehicle's license plate when a woman inside is unveiled. The system sends the owner an automatic warning and then impounds the car. Amnesty documents hundreds of thousands of vehicles confiscated since 2023, and the app was later extended to taxis, ambulances, and buses.

Dutch football clubs used retrospective facial recognition to scan crowds for banned supporters, and in one case wrongly issued a fine to a fan who had not even attended the match in question, a failure that drew warnings about expanding after-the-fact face surveillance in Europe.

British retailers including Southern Co-op, Home Bargains and Mike Ashley's Frasers Group deployed Facewatch live facial recognition to scan shoppers entering stores and match them against private watchlists of suspected offenders. After a 2022 Big Brother Watch complaint, the ICO concluded in March 2023 that Facewatch's processing had breached data-protection law on multiple principles, forcing an overhaul; campaigners say people were blacklisted over trivial accusations and, in cases like a teenager wrongly flagged at Home Bargains in 2024, misidentified and publicly accused.

From 2017 to 2021 Rotterdam used an Accenture-built machine-learning model to score its roughly 30,000 welfare recipients for fraud risk, using about 315 inputs including age, gender, language skills, neighbourhood, marital status and subjective caseworker notes. A 2023 Lighthouse Reports and WIRED investigation ('Suspicion Machines') that reverse-engineered the model found it systematically ranked single mothers, non-Dutch speakers and people of certain ethnicities as higher risk, subjecting them to intrusive fraud investigations even when they had done nothing wrong.

In South Africa, the Home Affairs department's practice of blocking national IDs left many people unable to access banking, grants, and services, prompting legal challenges over the harms of digital identity systems.

Pegasus was used against at least 16 Jordanian journalists and activists, including two Human Rights Watch staff and a Palestinian-American reporter hacked three times, many of whom had covered a teachers' strike the government crushed.

Vietnam deployed Predator spyware against targets including members of the European Parliament and used commercial spyware against bloggers, part of a broad surveillance campaign accompanying its jailing of online critics.

Angola was identified in the Predator Files as a likely customer of Intellexa's Predator spyware, with Amnesty International finding technical infrastructure tied to the tool active in the country.

Mongolia appeared among the governments linked to Intellexa's Predator spyware in the Predator Files, with Amnesty International documenting infrastructure associated with the tool.

Import records tied Botswana's Directorate of Intelligence and Security to shipments of Intellexa Predator spyware in 2023, the first identification of the tool's use in the country.

Sudan was among the countries where Amnesty International found technical infrastructure linked to Intellexa's Predator spyware in the Predator Files investigation.

Mexico is the most heavily targeted country in the Pegasus files. First exposed in 2017, the NSO spyware was used against journalists like Carmen Aristegui, whose teenage son was also hit, along with activists and lawyers for victims of disappearances. The Ejercito Espia investigation later showed the army kept using Pegasus against reporters and a human rights defender into 2021, even after the president pledged the practice had stopped.

After Russia's September 2022 mobilisation for its war on Ukraine, Moscow authorities turned the city's facial-recognition camera network on men avoiding the draft. Human Rights Watch documented at least seven men flagged as 'draft dodgers' and detained via surveillance cameras, taken to police stations and enlistment offices, with some ordered to the front. Enlistment offices even flag conscripts who legally challenge their call-up so they can be auto-detected on camera, and rights lawyers advise appellants to avoid the metro entirely.

Iran uses facial recognition, road cameras, drones, and a citizen-reporting app to enforce mandatory hijab rules on women. A 2025 UN fact-finding mission documented facial recognition installed at a Tehran university gate to catch uncovered students, and metro screens in Mashhad displaying passengers' faces, age, and gender to frighten women out of defiance.

Spanish football clubs have rolled out facial recognition on supporters: Valencia CF deployed a FacePhi system to control stadium access and Atletico Madrid announced face-scanning and cashless entry from the 2022-23 season, while other clubs use fingerprint scanning at turnstiles. Fans and privacy advocates warned that mandatory biometric entry normalises tracking of ordinary spectators.

In the scandal known as Predatorgate, the Predator spyware sold by the Israeli-founded firm Intellexa was used to target more than ninety journalists, the opposition leader Nikos Androulakis, ministers, and senior military officers between 2020 and 2022, alongside wiretaps by the national intelligence service. The case forced top resignations, and in 2026 an Athens court handed eight-year sentences to four people linked to Intellexa, a rare criminal reckoning for the spyware trade.

In Xinjiang, authorities use facial recognition to monitor the mostly Muslim Uyghur population, with face scans required to enter shops, hotels, and stations and tens of thousands of cameras in Urumqi alone. Leaked police files showed Hikvision systems used to screen all 23 million residents and flag people with overseas ties for arrest.

Buenos Aires's facial-recognition system was used to run unauthorized searches on more than 15,000 people not on any fugitive list, including journalists, politicians, and activists, and wrongly jailed a factory worker for nearly a week after a database error.

Citizen Lab's CatalanGate report found at least sixty-five people tied to the Catalan independence movement, including every Catalan president since 2010, members of the European Parliament, lawyers, and activists, targeted or infected with Pegasus or Candiru spyware between 2017 and 2020. The lab pointed to strong circumstantial evidence of a Spanish state nexus; the government later acknowledged court-authorized surveillance of about two dozen people and denied a wider operation.

Moscow's metro facial recognition, part of a Safe City camera network, has been used to detain and question thousands of people on their way to and from anti-war protests, sometimes preventively. The European Court of Human Rights later ruled the practice violated human rights.

In March 2022 Ukraine's defence and digital-transformation ministries began using Clearview AI facial recognition -- provided free, drawing on billions of scraped images including from the Russian network VKontakte -- to identify the bodies of dead Russian soldiers and message their relatives, and to identify operatives. Critics warned of the wartime normalisation of a controversial scraping tool and the risk of deadly misidentification at checkpoints.

Italy's data-protection authority fined Clearview AI 20 million euros for processing biometric and location data of people in Italy without a legal basis, banned further collection, and ordered deletion of existing records.

Researchers confirmed Pegasus infections on 35 journalists and civil society members in El Salvador, with reporters at the outlet El Faro among the most heavily targeted as they investigated government corruption.

France's data-protection regulator fined Clearview AI roughly 20 million euros and ordered it to stop collecting and to delete residents' data, after finding the company unlawfully scraped billions of faces into a recognition database sold to police.

Greece's data-protection authority fined Clearview AI about 20 million euros for unlawfully scraping and processing residents' facial images, part of roughly 100 million euros in EU fines the company has largely ignored.

The UK Information Commissioner's Office fined Clearview AI 7.5 million pounds in 2022 and ordered it to delete UK residents' data; after a tribunal initially overturned the action on jurisdiction, an appeals tribunal restored the regulator's authority in 2025.

Under the Law and Justice government, Polish services used NSO's Pegasus against the opposition. Senator Krzysztof Brejza was hacked dozens of times in 2019 while running the opposition's election campaign, and his stolen messages were doctored by state television for a smear campaign; a lawyer and a prosecutor critical of the government were also targeted. A Senate commission and the European Parliament found the spyware was deployed to entrench those in power, and prosecutors later seized the systems.

Kenya collected the fingerprints and facial images of tens of millions of people for its Huduma Namba (NIIMS) biometric ID before passing a data-protection law. The High Court declared the rollout illegal for skipping a privacy-risk assessment, and the successor Maisha Namba system faces similar criticism.

In October 2021 nine schools in North Ayrshire, Scotland switched on facial recognition to take payment in their canteens, scanning pupils' faces instead of fingerprints or cards. After public and regulatory backlash the ICO intervened, urging the schools to use a less intrusive method, and the rollout was paused -- an early flashpoint over normalising biometric identification of children for everyday transactions.

The 2021 Pegasus Project named Morocco as one of the heaviest users of NSO's spyware, with around ten thousand numbers selected. They included Moroccan journalists such as Omar Radi, who was later jailed, as well as foreign figures, among them French President Emmanuel Macron and several of his ministers. Morocco denied buying or using Pegasus and sued the journalists and Amnesty International for defamation.

Just a month after the Privacy Commissioner warned police to do better on plate cameras, a detective pretended a car was stolen so they could track it, and officers filed a false report to use ANPR to track women linked to a Northland lockdown breach.

Moscow's facial-recognition camera network, one of the world's largest, has been turned from catching criminals to hunting dissidents. Police have used it to identify and detain peaceful protesters, journalists covering them, and mourners at Alexei Navalny's 2024 funeral, tracing people right up to their door. In 2023 the European Court of Human Rights ruled its use against a protester unlawful.

Myanmar's military junta expanded Chinese-supplied safe-city camera networks with facial recognition across cities, raising fears of tracking dissidents after the 2021 coup.

Chinese authorities, working with surveillance firms including Hikvision, Dahua, and Uniview, drew up facial-recognition standards that sort people by traits such as ethnicity and skin color, which researchers warned opened wide scope to target minorities like the Uyghurs at scale.

Allot's deep-packet-inspection technology was used in Kazakhstan to throttle Telegram and other platforms ahead of a January 2021 nationwide internet blackout.

Uganda's mandatory Ndaga Muntu biometric national ID has been challenged by civil-society groups for excluding elderly people from welfare benefits and blocking women's access to healthcare, amid wider use of biometrics to monitor dissent.

South Korean police tracked suspects with Videmo 360 facial recognition software, analyzing images pulled from CCTV and the internet, in a case that raised concerns over the legality of the surveillance.

In a decision made public in January 2021, the Lower Saxony data-protection authority fined online electronics retailer notebooksbilliger.de about 10.4 million euros for unlawfully video-monitoring its employees for at least two years. The regulator found blanket CCTV over workspaces and public areas, justified only by a general suspicion of theft, had no legal basis under the GDPR -- one of Germany's largest fines for workplace surveillance.

Azerbaijan was identified as a Pegasus operator with around 48 journalists selected for targeting, including OCCRP investigative reporter Khadija Ismayilova, whose phone was infected for nearly three years, and Meydan TV freelancer Sevinc Vaqifqizi.

Hungary's Interior Ministry bought Pegasus for about 6 million euros and used it against investigative journalists such as Szabolcs Panyi of Direkt36, along with opposition figures, lawyers, and a media-owning businessman, an EU member state turning spyware on its own critics.

Rwanda was named among Pegasus operators, with targets including the daughter and nephew of Hotel Rwanda figure Paul Rusesabagina; the leaked list also flagged South Africa's president as a possible Rwandan target.

Phone numbers of senior Lebanese figures appeared on the Pegasus list, including the president, a former prime minister, ministers, security chiefs, and numerous journalists and ambassadors, according to the Pegasus Project.

Bahraini human-rights activists were hacked with Pegasus in zero-click attacks that defeated new Apple protections, part of the Gulf state's documented use of commercial spyware against dissidents.

Forensic analysis confirmed Pegasus on the phones of at least 30 Thai pro-democracy protesters, academics, and rights defenders during the 2020 to 2021 mass demonstrations, the first confirmed use of the spyware in the country.

Four Kazakh civil society activists were confirmed targets of Pegasus, part of the leaked list of tens of thousands of phone numbers selected by NSO Group government clients.

Togo appeared among NSO Group's Pegasus clients in the Pegasus Project, which documented the spyware being used against journalists, opposition figures, and members of the clergy critical of the government.

Egypt is a documented user of Predator spyware; in one case the phone of an exiled Egyptian politician was found simultaneously infected with both Predator and Pegasus, run by two different government clients.

Armenia was identified by Citizen Lab as a Predator spyware customer, part of a cluster of governments deploying the Cytrox tool against phones alongside the better-known Pegasus.

Indonesia was documented as a Predator spyware customer, one of several governments Citizen Lab linked to the Cytrox surveillance tool used against people of interest.

Madagascar was named among the government customers of Predator spyware identified by Citizen Lab, part of a growing roster of states buying commercial surveillance tools.

Oman was documented as a Predator spyware customer by Citizen Lab, adding a Gulf state to the list of governments using the Cytrox tool against targets of interest.

Australia's information commissioner found in 2021 that Clearview AI breached the Privacy Act by scraping residents' faces without consent and ordered it to stop and delete the data; a tribunal upheld the ruling in 2023.

Canada's privacy commissioners ruled in 2021 that Clearview AI's mass scraping of facial images amounted to illegal surveillance and called on the company to stop and to delete Canadians' data.

In November 2020 the Swedish data-protection authority fined Gnosjo Municipality 200,000 SEK for unlawful video surveillance in an LSS home for people with functional impairments, after a resident was filmed in their own bedroom. The regulator found no legal basis and no impact assessment, calling it a severe and unjustifiable intrusion into the most private sphere of the home.

Every Australian state runs plate readers. New South Wales' mobile MANPR fleet scans every passing vehicle statewide, storing hundreds of thousands of records a day, and was pushed to profile drivers at closed state borders during COVID lockdowns. The Australian Privacy Foundation calls ANPR a mass-surveillance technique that breaches freedom of movement.

A UK Court of Appeal ruling in Bridges v South Wales Police found the force's live facial recognition unlawful. Its AFR Locate system scanned up to 50 faces per second against watchlists that could include anyone, with images drawn even from social media, breaching privacy, data-protection, and equality law.

In Bahia, a Black man was wrongly detained for 26 days over a robbery committed by someone else a decade earlier, after a facial-recognition system misidentified him. It is one of several mistaken-identity cases tied to face recognition in Brazil since 2020.

In 2019 the northern Italian city of Como quietly bought, installed and tested a live facial-recognition system in public squares near its train station, among the first Italian municipalities to do so. After a journalistic investigation, the Italian data-protection authority (Garante) found the deployment had no legal basis under GDPR and ordered it stopped in 2020 -- a case that helped drive Italy's later national moratorium on public-space facial recognition.

In March 2020 Poland made its 'Home Quarantine' app mandatory for people ordered to isolate, requiring a geolocated facial-recognition selfie within 20 minutes of a random prompt. Failing to verify by face on demand triggered a police visit and possible fine, turning biometric identity checks into a routine tool of movement control and setting an early template other governments studied.

Delhi police used facial recognition to identify and arrest people from the 2020 anti-CAA protests and the communal riots that followed, later saying scores of the riot arrests were traced by the technology, and turned it on Sikh farmers during the 2021 farmers' protests. Rights groups documented its disproportionate use against Muslims and other minorities and a chilling effect on the right to protest.

Delhi police rolled out facial recognition that researchers found would inevitably fall hardest on the city's Muslim community, and used it to identify protesters, with much of the deployment kept under wraps.

In 2019 the Hellenic Police signed a roughly 4 million euro contract with Intracom Telecom for 'smart policing' devices -- handheld tools that let officers run live facial recognition and automated fingerprint identification on people during street stops. Part-funded by the EU, the deal was signed with no data-protection impact assessment and without consulting the Greek DPA, prompting complaints from digital-rights group Homo Digitalis.

Around 2019-2020 Prague police sought approval to switch on automatic facial-recognition cameras at six locations in the Czech capital and bought recognition software from the firm Cogniware, extending biometric identification into public space with little public debate or oversight.

By 2020 the Dutch national police maintained a facial-recognition database holding images of around 1.4 million people, and municipalities were rolling out face recognition in public space under 'pilot' and 'smart city living lab' labels that sidestepped regulatory scrutiny and frustrated public debate.

SPIRIT was an EU-funded project to scrape social-media images and build a facial-recognition database for police use, with partners including the Hellenic Police, two UK forces (West Midlands and Thames Valley), the Serbian Interior Ministry and Poland's police academy. Critics likened its face-extraction and matching tools to Clearview AI; trials were planned for 2020-2021 with little transparency.

Belarus deployed facial recognition to identify and arrest participants in the 2020 post-election protests.

During the disputed 2020 election, Belarus used Sandvine deep-packet-inspection technology to block social media, messaging apps, and news sites amid a violent crackdown; Sandvine later found custom code had been inserted and canceled the contract.

Belgrade has been fitted with thousands of Huawei 'Safe City' cameras carrying facial-recognition and plate-reading software, rolled out from 2019 with little transparency. The digital-rights group SHARE Foundation's 'Thousands of Cameras' campaign and Amnesty warned the system was unlawful and used to identify protesters, and biometric provisions were later dropped from a draft police law after public outcry.

Austria's federal police began using facial-recognition software to search surveillance footage at the end of 2019, comparing camera images against stored photos of suspects for after-the-fact identification. Rolled out with little public debate and limited to retrospective (not live) use, it made Austria one of a growing group of EU states quietly normalising biometric identification in criminal investigations.

In 2019 France moved to become the first European country to build a nationwide facial-recognition digital identity, Alicem, letting citizens verify themselves to government services by matching a selfie against their biometric passport. Digital-rights group La Quadrature du Net challenged it in court over the lack of any non-biometric alternative, arguing that effectively mandatory face-matching for state services breached the GDPR.

Uganda built a Huawei Safe City network of facial-recognition cameras across Kampala. A 2019 Wall Street Journal investigation found Huawei technicians helped state agents crack the encrypted communications of opposition leader Bobi Wine, leading to his arrest, and police later confirmed using the cameras to track people detained during anti-government protests. Opposition figures call it a tool to hunt and persecute critics.

During the 2019 pro-democracy protests, Hong Kongers wore masks and carried umbrellas and tore down 'smart lampposts' in Kowloon, fearing they held facial recognition that could identify demonstrators and expose them to arrest. Police had access to AI able to match faces from video to databases, and the fear of being identified kept some people away from the streets.

Uganda installed a 126 million dollar Huawei facial-recognition camera system across the capital, Kampala, which the president framed as a tool to fight street crime. Opposition figures said the real aim was to deter and identify protesters against an increasingly unpopular government.

In August 2019 the Swedish Data Protection Authority issued the EU's first GDPR facial-recognition fine -- 200,000 SEK (about 20,000 euros) against the Skelleftea municipal school board after Anderstorp High School piloted FR cameras to log the attendance of 22 students over three weeks. The regulator found consent could not be a valid legal basis given the power imbalance between school and pupils, that attendance could be tracked less intrusively, and that the school processed sensitive biometric data without an adequate impact assessment.

iBorderCtrl was an EU-funded research project that piloted an automated 'lie detector' at the Hungarian, Greek and Latvian borders, using biometric and facial analysis to score whether travellers -- including asylum seekers -- were being deceptive. Widely criticised as pseudoscientific and discriminatory, the project ran until August 2019 and became a symbol of biometric experimentation on migrants at Europe's frontier.

In July 2019 the football club Brondby IF switched on Panasonic facial recognition at Brondby Stadium -- the first FR deployment in Denmark, approved by the Danish Data Protection Agency -- scanning roughly 14,000 fans per match against a ban list of about 50 people. Digital-rights group IT-Pol argued the system was disproportionate and set a dangerously low bar, and a University of Copenhagen law professor who sat on the deciding council agreed it should arguably never have been allowed. In 2025 the agency granted FC Copenhagen a more extensive stadium face-recognition system, deepening the normalisation of biometric surveillance in Danish sport.

Jamaica's Supreme Court struck down the National Identification and Registration Act in 2019, ruling that mandatory biometric registration for a national ID violated the constitutional right to privacy.

Saudi dissident Omar Abdulaziz, a Canadian resident and confidant of Jamal Khashoggi, had his phone infected with Pegasus, and Citizen Lab detected suspected infections inside Canada.

Exiled Russian journalists based in Latvia, including Meduza founder Galina Timchenko and Novaya Gazeta Europe's Maria Epifanova, were infected with Pegasus between 2020 and 2023.

Investigative journalist Nuria Piera was repeatedly targeted with Pegasus between 2020 and 2023, confirmed by Amnesty International and Citizen Lab.

Pegasus was used to surveil journalists, activists, and lawyers in Panama, with early deployments linked to the government under former president Ricardo Martinelli.

The phone number of then prime minister Imran Khan appeared on the leaked Pegasus target list, and Citizen Lab detected suspected Pegasus infections in Pakistan.

Citizen Lab detected suspected Pegasus infections in Turkey, where associates of murdered journalist Jamal Khashoggi were among those targeted.

Citizen Lab detected suspected Pegasus infections in Bangladesh, where authorities have acquired a range of phone interception and surveillance systems.

Citizen Lab detected suspected Pegasus infections linked to an operator in Kenya.

Citizen Lab detected suspected Pegasus infections in South Africa.

Citizen Lab detected suspected Pegasus infections in Singapore.

Citizen Lab detected suspected Pegasus infections linked to an operator in Tunisia.

Citizen Lab detected suspected Pegasus infections linked to an operator in Qatar.

After the Pegasus Project, Algeria's public prosecutor ordered an investigation into reports the country was targeted, and Citizen Lab detected suspected infections there.

Citizen Lab detected suspected Pegasus infections linked to an operator in Iraq.

Citizen Lab detected suspected Pegasus infections linked to an operator in Uzbekistan.

Citizen Lab detected suspected Pegasus infections linked to an operator in Kuwait.

Citizen Lab detected suspected Pegasus infections in Yemen.

Citizen Lab detected suspected Pegasus infections in Switzerland.

Citizen Lab detected suspected Pegasus infections linked to an operator in Ivory Coast (Cote d'Ivoire).

Citizen Lab detected suspected Pegasus infections linked to an operator in Zambia.

Citizen Lab detected suspected Pegasus infections in Kyrgyzstan.

Citizen Lab detected suspected Pegasus infections linked to an operator in Tajikistan.

Citizen Lab detected suspected Pegasus infections linked to an operator in Libya.

Citizen Lab detected suspected Pegasus infections in Palestine, where Palestinian human rights defenders were later confirmed to have been hacked.

India's Aadhaar program enrolled the biometrics of more than 1.3 billion people into the central CIDR database. Civil-society groups warn it drives surveillance and exclusion; India's Supreme Court recognized privacy as a fundamental right in 2017 and curbed mandatory Aadhaar use in 2018.

Hikvision, the world's largest maker of plate readers and surveillance cameras, refined vehicle and face tracking in Xinjiang, where checkpoints and cameras monitor Uyghurs' movements. Those battle-tested systems are now exported worldwide.

Germany's federal police ran live facial-recognition trials at Berlin's Sudkreuz station in 2017 and 2018, scanning volunteers against a watchlist to test automated identification in a busy transit hub. Interior Minister Horst Seehofer hailed the results and pushed to expand automatic facial recognition to more stations and airports, drawing fierce criticism from civil-liberties groups and data-protection officials over false positives and the normalisation of biometric mass surveillance in public space.

Saudi Arabia used Pegasus against people close to murdered journalist Jamal Khashoggi, including an exiled dissident friend and his fiancee, whose phone was infected days after his 2018 killing.

From 2018 Zimbabwe acquired facial-recognition technology from CloudWalk and Hikvision for border control and mass surveillance, with citizens' biometric data sent back to the Chinese vendors.

Citizen Lab's 2018 Bad Traffic report found Sandvine PacketLogic devices on Turkey's network redirecting hundreds of users to malicious sites that delivered government spyware, alongside blocking of political and news content.

In 2017 Italy's Interior Ministry commissioned the SARI (Automatic Image Recognition System) facial-recognition platform for the scientific police from vendor Parsec 3.26. Rolled out with extreme secrecy and little oversight, SARI was shown to be biased and to draw heavily on a database skewed toward foreign nationals; its real-time mode was later blocked by the Garante pending a proper legal framework.

China has built a pervasive biometric surveillance system across Xinjiang to control Uyghurs and other Turkic Muslims, combining facial-recognition checkpoints, mandatory collection of iris scans and DNA, and a predictive-policing platform that flags ordinary behavior as suspicious. It has funneled people into a network of detention camps that a 2022 UN report said may amount to crimes against humanity, with up to a million held.

Denmark built 180 highway gantries and roughly 250 fixed plate-reading cameras for a lorry eco-tax. The cameras log every passing vehicle even though the tax is not being levied, and the scheme has drawn opposition.

The UAE was an early and heavy Pegasus user, targeting activist Ahmed Mansoor with a zero-day exploit in 2016 and later the ex-wife and associates of Dubai's ruler, part of one of the most extensive deployments of the spyware.

Ethiopian diaspora journalists at the ESAT broadcaster were targeted with Hacking Team's Remote Control System and Gamma's FinSpy spyware, documented by Citizen Lab.

Colombian security agencies were clients of Hacking Team's Remote Control System spyware, revealed by the 2015 breach of the Italian vendor.

Ecuador's intelligence agency SENAIN purchased Hacking Team's Remote Control System spyware, revealed by the 2015 breach of the Italian vendor.

Chile's investigative police were clients of Hacking Team's Remote Control System spyware, revealed by the 2015 breach of the Italian vendor.

Honduras was among the government clients of Hacking Team's Remote Control System spyware revealed by the 2015 breach of the Italian vendor.

Nigerian government bodies were among the clients of Hacking Team's Remote Control System spyware revealed by the 2015 breach of the Italian vendor.

Malaysian agencies were among the clients of Hacking Team's Remote Control System spyware revealed by the 2015 breach of the Italian vendor.

South Korea's National Intelligence Service was a client of Hacking Team's Remote Control System spyware, revealed by the 2015 breach and sparking domestic controversy.

Hungary built a unified national plate-reading network of 365 fixed gantries and 160 mobile units, feeding a central system used for traffic enforcement, registration and insurance checks, and stopping wanted or flagged vehicles nationwide.

Hertfordshire police ringed the small town of Royston with ANPR cameras, logging every vehicle entering or leaving. After complaints by Big Brother Watch, Privacy International, and No CCTV, the UK data regulator ruled the scheme unlawful and excessive and ordered it halted.

The UK runs one of the world's largest ANPR networks, feeding a central database, yet it was constructed by police without any parliamentary debate or public consultation, and privacy regulators warned the blanket approach may be unlawful.

Italy's Tutor system covers more than 2,500 km of motorway, run jointly by the toll operator and the state police. It reads plates to calculate average speed over long stretches and can even track cars as they change lanes, logging the movements of every vehicle that passes.

The Belgian city of Mechelen scans every car crossing its boundary, inbound and outbound, against blacklists, automatically checking about a million vehicles a week and dispatching patrols to intercept flagged cars.

France equipped around 1,000 gendarmerie, police, and customs vehicles with plate-reading lightbars from the Paris firm Survision that continuously scan passing cars without any officer input and check them against databases.

After a columnist criticized Edmonton police for using traffic cameras to raise revenue, officers added him to a plate-reader watch list of high-risk drivers to monitor his movements and look for a reason to arrest him. The police chief and several officers were dismissed, and Canada's privacy commissioner raised concerns.

Japan's National Police Agency has run the secretive N-System since the late 1980s, reading and recording license plates at hundreds of sites on highways and major roads, including a ring around Tokyo's Kabukicho district. Police disclose little about how long the data is kept or how it is used, and privacy advocates call it part of an emerging surveillance society.

Cyprus hosted operations of the Intellexa alliance behind the Predator spyware and was a client of Hacking Team, tying the island to Europe's mercenary surveillance trade.

Venezuela built the ZTE-backed fatherland card (carnet de la patria) system linking citizens' personal data to access to subsidized food and services, alongside Chinese-supplied surveillance cameras.

Sri Lanka received Chinese-made AI surveillance and facial-recognition technology as part of Huawei and partner safe-city deployments.

Telecom Egypt used Sandvine PacketLogic deep-packet-inspection middleboxes to inject Intellexa's Predator spyware into the connection of opposition presidential candidate Ahmed Eltantawy, alongside mass web-monitoring and news censorship; the US added Sandvine to its Entity List in 2024.

Syria's telecom authority deployed deep-packet-inspection equipment, including Blue Coat and Sandvine gear, to filter and censor the internet and redirect users to malicious sites during the civil war.

Under Muammar Gaddafi, Libya deployed the French company Amesys's Eagle system for nationwide internet interception and mass surveillance of dissidents; French magistrates later charged Amesys executives over complicity in torture.

Eritrea, one of the world's most closed states, was among the authoritarian governments supplied with Sandvine deep-packet-inspection equipment for internet control.

Sandvine and Allot deep-packet-inspection equipment was deployed in Azerbaijan to impose social-media blackouts during periods of unrest.

Sandvine equipment was among the technology linked to internet censorship in Russia, which also runs the domestic TSPU deep-packet-inspection system to throttle and block VPNs, social media, and independent news.

In Jordan, Sandvine equipment was used to censor an LGBTQ news website.