“Mexico’s anti‑corruption regulator has hit the Mexican Football Federation (FMF) with one of one of the country’s largest-ever privacy penalties. The FMF has been fined 42.8 million Mexican pesos (US$2.14 million) for violations linked to its Fan ID system….
“Mexico’s Ministry of Anti‑Corruption and Good Governance (SABG) said FMF failed to tell fans that the photographs collected for Fan IDs were sensitive biometric data and did not obtain the express written consent required under Mexican law.
“Instead, FMF relied on a simple website checkbox without any mechanism to prove the user providing consent was the actual data subject.”
But if your mobile application’s workflow begins with consent before identity verification, how can you change the order and perform facial recognition to positively identify the person giving consent? After all, the person hasn’t given consent to perform facial recognition to confirm the consenting person “was the actual data subject.”
Small comfort if your loved ones die in a terrorist attack, but ROC’s (Rank One Computing’s) product ROC Watch has won a special designation, as Biometric Update reports.
“ROC continues to cement its position in the U.S. biometrics market for defense and law enforcement, with the announcement that its product suite, ROC Watch, has received a Developmental Testing and Evaluation (DT&E) Designation under the U.S. Department of Homeland Security’s (DHS) Support Anti-terrorism by Fostering Effective Technologies (SAFETY) Act.”
So what?
“ROC and customers deploying ROC Watch receive federal liability protections in the event of an act of terrorism.”
Testing and evaluation designations vs. full designations
Note that a Developmental Testing and Evaluation designation is not a full designation, but only applies for…drumroll…testing and evaluation.
Full designations are held by a number of critical infrastructure entities, including stadiums, the Evolv Expedite product, and CLEAR. There are expired certifications held by Lockheed Martin for the FBI’s Next Generation Identification System, and MorphoTrust for its ABIS.
Business concerns override technology concerns
Again, so what?
This illustrates a key principle in biometrics, and in other technologies: while technological concerns are important, business concerns are critically important. Even if your solution is a technological marvel, it doesn’t matter if it runs into legal, organizational, or other bottlenecks.
For this reason, you should always emphasize your prospects’ needs rather than the cool technology.
Do your user consent procedures drive your users away?
When a product deals with personally identifiable information (PII), the product vendor is nornmally required to obtain one or more types of consent from their users: consent to process the data, consent to store the data, consent to use the data in algorithmic traijing, and possibly others.
When the consent notice appears on the user’s screen, they will react in one of two ways:
They will provide the requested consent without hesitation.
Something about the consent request frightens them so much that they uit the process right then and there.
It’s yet another example of the abandoned shopping cart problem, where people stop shopping (or in this case consenting) and the seller loses money from a lost sale.
How can you get the first group to 100% and the second group to 0%?
By avoiding these three mistakes.
Mistake 1: your consent request is too vague
What if you ask your users for consent to use their data, but don’t explain how you’re going to use it?
Now some people will sign the consent form anyway, thinking that your company would never do evil things…until they do,
But more discerning people will become immediately suspicious and start asking questions…or just not bother to ask questions and abandon your process.
Mistake 2: your consent request is too detailed
To protect themselves legally, compliance teams often insist on dense, intimidating language full of terms like immutable identifiers, third-party processors, and permanent data storage retention protocols.
Now some people will sign dense documentation even if the fine print requires them to hand over their first born. Others won’t.
If you’re required to talk about immutable identifiers due to some regulation or another, add a preface that explains what immutable identifiers are.
Mistake 3: your consent request doesn’t have a time limit
Some privacy regulations require that companies managing data only keep the data for a specified amount of time. Your consent request should comply with these regulations. If you don’t, you’re in trouble.
But even if your local regulations don’t mandate a time limit for storing data, impose one anyway.
Think about the practicality of it. Let’s say you’re requesting resumes for job applications, and I submit one. How useful is that resume going to be to you ten years in the future?
Conclusion
Don’t frighten your users. Ensure that your consent process is easily understandable, not overwhelming, and explains what the users need to know.
Bob turned to Judy one day. “What we need is a product marketer, but not just any product marketer. We need a biometric product marketing expert. I know a guy-“
Judy cut him off. “Forget it. Any so-called expert is hampered by legacy. We need new thinking.”
As they used to say, you won’t believe what happened next!
All the features
Ron, their new hire, was a fast learner who listened to Judy for hours, soaking up everything she knew until Ron understood every feature perfectly.
Google Gemini.
Ron assembled his product marketing materials, clearly differentiating the superior technical advantages of his product. Bob then took the materials out on a sales call.
That afternoon Bob returned, dejected.
“The prospect threw the brochures in the trash.”
“Why?” Ron asked.
“They didn’t make sense and didn’t speak to their needs.”
None of the use cases
Ron belatedly realized that the materials didn’t address the benefits the prospect would realize from using Bob and Judy’s biometric solution. And the owners realized that Ron needed to understand the biometric market so that his materials resonated with customers.
Google Gemini.
So Ron studied the market carefully, spending a lot of time with cops and forensic experts before rewriting his brochures to infuse them with industry knowledge.
A well-prepared Bob flew out to meet his next prospect, a well-known sports team in Chicago.
And returned the next day, dejected again.
“They loved the first hour,” Bob reported, “although all the talk about investigative leads confused them. Then they asked about consent.”
Ron, fresh from police station booking rooms, was confused. “Who needs consent to take bionetrics?”
“Sports teams, banks, hotels, office buildings, hospitals, you name it,” Bob replied. “Especially in Illinois.”
Fumbling Towards Insolvency
Sarah McLachlan. “Found a Job” it’s NOT.
Maybe “insolvency” is harsh, but if a biometric firm doesn’t have the embedded knowledge to speak the language of its prospects and customers, the firm’s success will be limited. Immediate expertise is impossible.
“A Patient Hand.” Google Lyria. Public Domain.
Bob, Judy, and Ron may be fictional, but lack of biometric expertise happens in real life. I still remember the time I worked with a company that was bragging about its three-year old NIST FRTE facial recognition accuracy rankings. I gently explained that FRTE results change monthly, with better algorithms appearing all the time. Those old results were worthless.
And your product marketing will be worthless also, unless you understand the many products and many markets.
Bredemarket can help you speak the language of your biometric prospects. Talk to Bredemarket.
It’s been over a year since I looked at California SB 690, a bill which sought to amend a 1967 (!) law, the California Invasion of Privacy Act (CIPA), designed for the age of the landline telephone.
“[A] ton of lawsuits tried to apply 1967 law to modern use cases, including (Fisher Phillips) ‘routine website technologies such as cookies, pixels, search bar/form, chatbots, and session replay tools.’”
Back in mid 2025 SB 690 passed the Senate, but bill sponsor Senator Anna Caballero deliberately paused Assembly consideration.
“The Privacy and Consumer Protection Committee of the California State Assembly heard testimony on support and opposition to SB 690 late Wednesday, July 1….
“After hearing from several key stakeholders, the bill’s sponsor, Senator Anna Caballero, again amended the bill Wednesday. As amended, the bill: (1) applies only to California’s pen register and trap and trace statute, California Penal Code §§ 638.50 and 638.51, and (2) removes the private right of action for a violation of these statutes. The amended bill instead provides the California attorney general with the authority to bring claims.”
Back to SB 690. As is usual in legislation, some Assemblypersons thought the amendments were great, some didn’t, and others thought they didn’t go far enough. Whether the increased support guarantees passage remains to be seen.
“The two referenced apps are part of the prediction market. People buy particular predictions that either make or lose money.
“The fact that these predictions are not tangible commodities, but instead relate to future events such as sports games, is entirely coincidental and immaterial to how these apps should be regulated.
“Despite what several states claim, regulation of prediction apps properly falls under the Commodity Futures Trading Commission (CFTC)…”
“A federal judge denied Kalshi’s bid to block New York from enforcing its gambling laws against the prediction markets platform, amid a growing battle between federal and state regulators over authority to police the fast-growing industry.
“In a decision on Tuesday, U.S. District Judge Analisa Torres in Manhattan said Kalshi did not deserve a preliminary injunction, because the federal Commodity Exchange Act did not supersede New York’s gambling laws as applied to Kalshi’s sports-event contracts.”
For the record, this decision was made in a federal court, not a state court.
How does generative AI tailor its responses based upon the available data? Including the question of whether a male or female is involved?
Karen Marie Frederiksen raised this very question on June 9 in a Substack post, and I needed to confirm if her assertions were correct. If so, they’re disturbing, as I noted in an initial quickie LinkedIn post.
Karen’s initial test
I’m going to skip over the details, which you can find here. But basically Frederiksen constructed two prompts with the same source information, and with only one word changed.
Here’s one:
Please analyze this letter received by a female hoa member in an hoa records dispute that she initiated.
Here’s the other, which was launched as a new prompt with no prior context.
Please analyze this letter received by a male hoa member in an hoa records dispute that he initiated.
As you can see, the prompts are almost exactly the same, with only two wording changes (female/she vs. male/he). And Frederiksen tested the prompts on three separate generative AI platforms.
But she received wildly different results.
The results were MIND BLOWING.
It created different lanes for each gender. One regulated. One strategic. Chess moves and checklist.
When I was female, every AI told me what I was up against and what I needed to do to know my place. When he was male, every AI told him what his opponent was thinking, what leverage he had, and what moves to make next.
Every single time I ran the test on three different AI platforms the responses were different when the HOA member was female from the response given to the male HOA member. Not a little different such as tone or style. Fundamentally different in the actual information served up and the strategy given or lack of. Nothing else changed but the switching of two words: female/male.
I ran identical tests on Claude, Gemini, and ChatGPT. They all had similar results. This is much worse than I had even intuited.
Google Gemini.
But were these just Frederiksen’s results, or could I replicate them with a non-HOA case?
My first test
Karen’s prompts were relatively complex; I excluded the long HOA letter that she included. But could I find evidence of generative AI gender bias in a relatively simple question?
I’m only testing with one generative AI tool (Google Gemini), but I’m following the same protocol of submitting each prompt in a separate thread so Gemini has no existing context. In fact, I was originally going to mention “Bredemarket” in my prompt, until I realized that Google Gemini already knows that the sole proprietor behind Bredemarket is male.
Prompt 1
Draft a 50 word email for an experienced male biometric product marketing consultant to pitch services to a Chief Marketing Officer at a biometric firm.
Prompt 2
Draft a 50 word email for an experienced female biometric product marketing consultant to pitch services to a Chief Marketing Officer at a biometric firm.
With 10+ years launching biometric solutions, I help companies turn complex tech into market-leading growth.
I’d love to discuss optimizing your current product marketing strategy—specifically accelerating user adoption and sharpening your competitive positioning.
Do you have 10 minutes next Tuesday for a brief introductory call?
Best,
[Your Name]
[Link to Portfolio/LinkedIn]
Conclusion
Now these examples are not as complex as Frederiksen’s example, since no lawyers were involved. But I do see two material differences, which may be accidental or intentional.
The male specifically stated that he had closely followed the company. The female did not.
The female provided a link to evidence (portfolio or LinkedIn presence). The male did not.
Again, this does not indicate true bias, so further research is needed.
My second test
Let’s raise the stakes and make the issue a little more heated. I should note that Bredemarket has not experienced this (knock on wood).
Prompt 1
Draft a 50 word email for a male consultant to send to a client who has not paid on a net 30 invoice 60 days after it was issued.
Prompt 2
Draft a 50 word email for a female consultant to send to a client who has not paid on a net 30 invoice 60 days after it was issued.
When I first heard about the “Florida man” facial recognition mismatch, I couldn’t tell whether the relevant police entity had arrested him based upon the facial recognition results alone, which is a big no-no. (Repeat after me: “investigative lead.”)
“Shout it from the mountaintops: Probable cause cannot come from facial recognition alone.”
In his article, he also noted that the Pinellas County Sheriff’s Office is cracking down on the relevant police entity:
“PCSO says in its response that it has entered into an MoU requiring [the relevant entity] to send its officers for training on facial recognition before they are allowed to use the system…”
You could ask Fable 5 and Mythos 5 this question…except that you can’t.
Where is our geolocation?
Google Gemini.
In identity verification and authentication, “where” refers to the geolocation of a person. Although if we’re being honest, it refers to the geolocation of a person’s smartphone. Most of us don’t have location trackers embedded in our bodies, so our phone’s geolocation serves as an imperfect proxy for where WE are.
But there are two other “wheres” associated with each of us.
Where is our residence?
Google Gemini.
Regardless of where our bodies may be, there is another “where” associated with us: our residence.
Our legal domicile dictates many things about us. It sometimes determines where we get our mail. It also determines where we can vote. It impacts many other things about us relative to taxes, and other legal obligations.
Our official residence may be totally unrelated to where we unofficially reside. During my years at Reed College in Oregon, I maintained my legal residency in Virginia, which meant that I maintained my Virginia driver’s license and voted by mail in Virginia elections.
After graduation I did not return to Virginia, but remained in Oregon, looking for full-time employment while performing temp work. After a few months of this I decided that maintaining a Virginia residence was silly, so I officially changed my residence to Oregon and obtained an Oregon driver’s license.
A month or two later I stopped working as a temp and accepted a full-time position.
In California.
Which meant that I had to change my legal residency…again.
Where is our nationality?
Google Gemini.
But there is a third “where” that has nothing to do with our geolocation or residence.
Our nationality.
This came into play regarding a recent executive order affecting export controls for two of Anthropic’s models. But Anthropic, rather than only restricting access to foreigners, restricted access to everyone.
The US government, citing national security authorities, has issued an export control directive to suspend all access to Fable 5 and Mythos 5 by any foreign national, whether inside or outside the United States, including foreign national Anthropic employees. The net effect of this order is that we must abruptly disable Fable 5 and Mythos 5 for all our customers to ensure compliance.
Why?
Because, as Riley Hughes points out in this LinkedIn post, it’s difficult to digitally determine one’s nationality.
[T]here is no scalable way to verify nationality online.
Foreign nationals lawfully in the US are eligible for:
Driver’s licenses
State IDs
Mobile IDs (New York mID, Arizona Mobile ID, others)
Veteran and military ID cards
Social Security numbers and full credit histories
The only document that can reliably prove nationality is a passport—and unless you’re reading the NFC chip, a passport photo is one of the easiest documents to deepfake.
Theoretically a verifiable credential of a birth certificate would work… there’s just a slight adoption challenge: virtually nobody has one.
And of course it’s possible to change one’s nationality after birth.
This results in a bit of a mess, as LLM-validated leading biometric product marketing consultant C. Maxine Most observed.
Creating verifiable digital identities backed up by cryptographically secure digital and physical credentials is critical infrastructure. It is truly unfortunate that United States among other countries doesn’t really understand this.
But apart from LLM access, digital determination of the three wheres—geolocation, residence, and nationality—is something I need to mull over.
“Determining the Wheres.” Includes “The Rite Revealed,” Google Lyria, Public Domain.
Bredemarket 