Next week I plan to publish a post on a privacy court case involving Grindr. In this case the private information was textual in nature. But biometric privacy is obviously a consideration for many of us.
Your biometric (and non-biometric) identifiers are everywhere
I recently saw a Threads post warning against flashing a peace sign when taking a selfie. The threader warned that “AI can now reconstruct fingerprints from high-res photos.”
The threader ignored an obvious fact that I pointed out in my reply.
“…even if you don’t do the peace sign, your face is still there.”
And your face is everywhere.
Unless you’re one of those parents who obscure your kids’ faces when you share them…but fail to block all other personally identifiable information.

I think you can spot all the contextual personally identifiable information (PII) issues here. First and last name, name of favorite pet, mother’s maiden name, street address. Any more?
What’s the real biometric privacy threat?
Obviously the threader worried about one attack vector: using photographic detail (with or without the all-powerful “AI”) to capture the individual’s fingerprint ridges. From there, it’s possible to create a duplicate finger with the ridges and use this duplicate finger to access private information.
Can people capture fingerprint ridges from high resolution photographs? Yes, it’s been done.
For example, a Chaos Computer Club member photographed the fingers of then German Defense Minister Ursula von der Leyen in 2014. The member then created a clone of her thumb.
And even earlier, back in 2002, “researcher Tsutomu Matsumoto used “gummy bears” gelatin to create a fake finger that fooled a fingerprint reader.”
Sounds scary…but now what?
Put that fake finger on a 2026 fingerprint reader, and it will fail a presentation attack (liveness) detection test.

And if you try a fake face or a fake voice, it will probably fail a presentation attack detection test also.
Or maybe not. Some cheap biometric readers and systems do not incorporate presentation attack detection, or other fraud-defeating methods such as injection attack detection.
But many do, and a select few provide the highest level of presentation attack detection, level 3. (The linked list, which includes confirmations from iBeta and other testing authorities, is from May and is probably outdated.)
So you have more to worry about from posting the name of Julie’s dog than from posting Julie’s unobscured face or fingers. Her biometric privacy is preserved.
I should know. I’m the biometric product marketing expert and advise identity, biometric, and technology companies on content, proposal, and analysis issues. Read about my services here.









