Skip to navigation – Site map

HomeIssues8:1Faces at Stakes: Comparative Insi...

Faces at Stakes: Comparative Insights on Facial Recognition Technologies Policy Implementation Arrangements across the EU, the US, and the PRC

Michele Barbieri and Laura Georgiana Macarie

Abstract

Facial recognition technologies (FRTs) crystallize tensions between security, innovation, and fundamental rights, as their implementation follows markedly different policy arrangements across states and geopolitical blocs. This article explores how policy implementation arrangements for FRTs shape models of digital sovereignty in the European Union (EU), the United States (US), and the People’s Republic of China (PRC). Through a comparative, most-different systems design, and structured content analysis of secondary sources (laws; guidance; enforcement; grey literature), this investigation operationalizes four dimensions: regulatory frameworks; actor networks; implementation and enforcement mechanisms; and sovereignty implications. Three distinctive pathways emerge, namely, the EU’s rule-and-regulator, the US’s liability-and-localism, and the PRC’s command-and-integration, which shape digital sovereignty attributes by reflecting broader security-related strategies. The article advances a mechanism-based account linking policy implementation to sovereignty claims and offers policy recommendations for aligning policy instruments with regulatory oversight capacity.

Top of page

Author's notes

This article is the result of a collaborative effort. However, the following paragraphs can be directly attributed to Michele Barbieri: ‘Introduction’, ‘Materials and Method’, ‘Discussion’, and ‘Conclusion’, and the paragraphs ‘Literature Review’ and ‘Findings’ to Laura Georgiana Macarie.

Disclosure Statement :

No potential conflict of interest was reported by the authors.

Full text

Introduction

1Facial recognition technologies (FRTs) have become part of everyday infrastructures and have been adopted in several sectors, such as security, mobility, commerce, and public administration. Their use can influence the critical equilibrium between public security, innovation, and the protection of individual rights. Moreover, FRTs are governed in varying ways across polities, resulting in variations in their implementation logics and enforcement mechanisms. Hence, they could affect models of digital sovereignty by allocating authority, shaping instruments, and mobilizing compliance capacity. Starting from this assumption, this paper examines how specific policy arrangements for FRTs in the European Union (EU), the United States (US), and the People’s Republic of China (PRC) transform sovereignty claims into control over data, infrastructures, and people in the digital ecosystem. By doing so, the paper intends to pursue three main objectives. Firstly, it reframes current debates by foregrounding implementation arrangements as the nexus between political intent and practice. Thus, it brings policy implementation theory and governance perspectives to the study of FRTs, conceptualizing arrangements as the confluence of actors, instruments, rules, and oversight mechanisms that collectively allocate decision rights in practice. Secondly, it advances an empirically grounded, comparative account of how these arrangements configure digital sovereignty in the three cases selected. Thirdly, it contributes to theory by linking implementation pathways to the attributes of digital sovereignty as a contested discursive resource.

2This investigation engages three streams of literature. It engages work on FRT capabilities, risks, and regulatory classification (Buolamwini & Gebru, 2018; Grother et al., 2019; Veale & Zuiderveen Borgesius, 2021; Gültekin Várkonyi, 2024) with the implementation and governance scholarship to operationalize who decides and how compliance is induced in policy actors’ arrangements (Scharpf, 1997; Hill & Hupe, 2021; Howlett, 2009). Moreover, it situates findings within the digital sovereignty debate that contrasts the EU’s landscape with those of the PRC and the US (Bradford, 2020; Zeng et al., 2017; Pohle & Santaniello, 2024; Santaniello, 2026). Methodologically, the study employs a qualitative, most-different systems design to compare the selected cases. It relies on secondary empirical materials, namely, official policy documents, legal instruments, regulatory guidance, and enforcement decisions, whose contents are analyzed along four analytical dimensions: regulatory frameworks for FRT; actors and roles; implementation arrangements and enforcement mechanisms; and implications for digital sovereignty. The choice to privilege implementation arrangements rather than only formal law reflects the expectation that actors network, instrument choices, and oversight capacity jointly determine whether sovereignty claims are realized in practice.

3The article is organized as follows. The next section develops the theoretical framework in three parts: FRT technologies; implementation arrangements and governance theories; and the concept of digital sovereignty, with specific reference to its discursive claims and attributes. The methodological section explains the research question derived from the literature gap detected, the case selection, the data sources, and the coding scheme used to operationalize the four analytical dimensions. The findings section identifies patterns and contrasts across regulatory designs, actors’ arrangements, and enforcement mechanisms. It also traces how these results map onto sovereignty attributes. The results are then discussed, assessing the extent to which implementation arrangements perform digital sovereignty and elaborating a comparative typology of pathways. The final section concludes by directly answering the research question, drawing out policy implications for aligning instruments and capacity, and acknowledging the limitations of the analysis while suggesting opportunities for future research.

Literature Review

Facial Recognition Technologies: Capabilities, Risks, and Regulatory Classifications

4FRTs represent one of the most advanced AI-based systems, capable of authenticating, identifying, and profiling an individual’s identity through the automated analysis of facial details (Hashemi-Pour et al., 2025). In policy enforcement, FRTs are deployed for specific security tasks, but their costs and benefits in democratic terms are highly debated. According to Gültekin-Várkonyi (2024), FRTs can assist enforcers in executing public security tasks while simultaneously posing significant threats to data protection rights. FRT functions can be categorized into three types (Gültekin-Várkonyi, 2024): (i) one-to-one, used for authentication; (ii) one-to-many, used for identification; and (iii) many-to-many, used for crowd tracking. The ‘many-to-many’ mode in public spaces is especially high-risk as it may enable continuous tracking or trait analysis (such as, age, race, and emotions). Several studies show that the growing use of FRTs raises public concern about mass surveillance, pervasive profiling, and privacy violations (Kostka et al., 2023), with consequential socio-political and ethical implications (Wang et al., 2024). Although FRTs are highly capable across multiple domains, they are also ethically fraught as their design and use must balance technological promises against empirical evidence of bias and rights-related harms.

5Indeed, the related literature highlights how the collection of biometric data without any kind of regulation may violate individuals’ rights by enabling pervasive data processing, thus creating a ‘chilling effect’ on people’s behavior in public spaces (Rouvroy, 2015). Moreover, the extensive adoption of FRTs in surveillance contexts risks undermining civil rights and freedoms by potentially discouraging citizens from exercising their right to protest and associate, thus weakening the expression of core democratic principles (Hartzog, 2018; Lynch, 2020). Furthermore, FRTs have produced higher bias rates for certain ethnic groups as inequalities and potential discriminations emerge during the training data process (Buolamwini & Gebru, 2018; Grother et al., 2019). These biases could translate into non-equal treatment and harm vulnerable social groups (Garvie et al., 2016). Concurrently, scholars have proposed solutions based on the adoption of essential principles for executing these pervasive technologies. These principles include transparency of algorithms, democratic accountability, equity, informed consent (Floridi, 2018; Selbst & Barocas, 2018), and privacy-preserving systems to balance public security and rights protection (Tene & Polonetsky, 2013).

6Accordingly, FRTs highlight a structural tension between public security and the protection of fundamental rights at the policy level. While public institutions and enforcers underline potential benefits in terms of efficiency and crime prevention, these systems can become policy instruments of mass surveillance and social control, often in contrast with democratic principles (Wang et al., 2024). Within this debate, policy responses diverge significantly across regulatory landscapes, reflecting heterogeneous normative orientations and institutional architectures, partly due to differences in how regulators classify FRTs within their policy domains.

Facial Recognition Technologies and Digital Sovereignty: Competing Claims, Discourses, and Geopolitical Scopes

7As a matter of fact, the global debate on FRTs revolves around the key challenges of contemporary digital governance and range from the safeguarding of rights in contemporary societies to the arrangement of new governance relations between state and non-state actors. In this complex techno-social system, states claim authority over high-stakes technological choices within their polities, thereby foregrounding digital sovereignty as a key issue for understanding national and supranational strategies toward emerging and disruptive technologies. The concept of digital sovereignty broadly denotes a state’s capacity to define norms, policies, and infrastructures for information technologies and data management that align with its legal order and orientation while protecting rights and interests in cyberspace. Alongside this institutionalist approach, which grounded in the concept of state-sovereignty (Smuha, 2024), the constructivist perspective focuses on the policy-discursive dimension. According to Pohle and Santaniello (2024), digital sovereignty claims often arise from geopolitical and economic concerns, as perceived inequalities in the global digital economy motivate states to assert more control over data and platforms. In China, official discourse links the concept of ‘Internet sovereignty’ with the assumption that each country should have the right to govern its own cyberspace, thus underpinning national security (Zeng et al., 2017). By contrast, in Western democratic regimes, digital sovereignty is framed as a defensive measure to uphold liberal values.

8For example, the EU’s narrative of digital sovereignty has been framed as protecting democracy and fundamental rights by addressing foreign technological dominance (Pohle & Santaniello, 2024). These regulatory efforts are part of what Bradford (2020) defines as the ‘Brussels Effect,’ whereby the EU exports its standards globally through market leverage (Freuler, 2025). Accordingly, digital sovereignty is not a fixed attribute but rather a discursive tool through which states (or blocs of them) claim authority in the interconnected digital realm (Pohle & Santaniello, 2024). Through this lens, Santaniello (2026) conceptualizes digital sovereignty as a contested discursive resource in global policy arenas, highlighting five characterizing ‘attributes’ of digital sovereignty claims: adversariality; multiversity; latency; instrumentality; and hypocrisy.

9Adversariality represents a sovereignty claim against a perceived threat, while multiversity emphasizes the plurality of meanings and claimants by several state and non-state actors. Latency reflects a sovereignty claim in response to critical junctures, such as crisis or trigger events. Instrumentality focuses on the strategic uses of the digital sovereignty to legitimize policies and regulations. Finally, hypocrisy occurs when there is a gap between declared principles and actual practices within sovereignty claims. This conceptual framework is a useful tool for interpreting how different polities (both states and geopolitical blocs) adopt digital sovereignty in relation to the regulation of FRTs and justify the related policy implementation arrangements.

Governance of Facial Recognition Technologies and Implementation Arrangements: Actors, Instruments, and Compliance Pathways

10In policy science, the implementation phase is crucial for understanding how policymakers act in practice to achieve policy outcomes. Related literature draws on consequential and complementary perspectives to explore this crucial policy phase. The first wave of research emphasizes a top-down approach that focuses on central decision-making and hierarchical governance arrangements. This approach assumes the ‘complexity of joint action’ (Pressman & Wildavsky, 1973), meaning policy implementation requires strong coordination among actors and decisions, and any unexpected event may create friction, delays, or distortions. According to this approach, the top-down process should ensure that street-level bureaucrats faithfully implement policymakers’ will (Mazmanian and Sabatier, 1983), but the reality is different. Hence, the second wave of research focuses on a bottom-up approach that highlights the role of implementers’ discretion (street-level bureaucrats) in executing norms and procedures, thus co-producing policy outcomes under local constraints and contextual demands (Lipsky, 1980). According to this perspective, successful implementation depends on a consistent degree of negotiation, adaptation, and feedback from the local level.

11A contemporary wave of research goes beyond this dichotomy by focusing on the governance dimension (Hill & Hupe, 2021; Hooghe & Marks, 2001; Imperial, 2021). The implementation phase is rooted in complex networks and multi-level arrangements that combine hierarchy and cooperation simultaneously. According to this multi-level perspective, Sager and Gofen (2022) conceptualize the ‘polity of implementation’, understood as the set of organizational and institutional arrangements that allocate decision power and condition actors’ behavior during the policy execution. So, the implementation phase develops within specific constitutional and administrative features related to the degree of centralization, the presence of independent oversight bodies, and the judicial review, shaping policy compliance and effectiveness (Steinebach, 2022). Moreover, different arrangements of multi-level and multi-actor configuration may lead to different implementation outputs (Casula, 2024; Ottone & Barbieri, 2025). On the one hand, a highly centralized implementation fosters a focus on clear policy objectives, at the expense of local flexibility. On the other hand, decentralized implementation better fits local peculiarities but fragments the overall policy outcome. This trade-off in the implementation phase is relevant to digital sovereignty as it helps explain how those who implement digital policies may also hold sovereign power in the cyberspace.

12The governance of FRTs (and related digital innovations) is characteristically multi-actor and multi-level. Rather than a simple top-down process, implementation typically involves state agencies, independent regulators, private tech companies, and civil society organizations in complex networks. Following the conceptualization of Hill and Hupe (2021), governance involves the creation of conditions for norms, procedures, and joint actions involving state and non-state actors. In other words, formal laws are only part of how policy is realized because contracts, standards, and negotiated agreements among actors also play key roles. This actor-centered institutionalism (Scharpf, 1997) implies that FRT policies are shaped through bargaining among law enforcement, data protection authorities, tech firms, and even supranational bodies. Moreover, Veale and Zuiderveen Borgesius (2021) warn that maximum-harmonization of AI regulation across the EU could inadvertently preclude legitimate national AI policy. This illustrates how multi-level governance tensions may arise when supranational regulations leave less room for local discretion. Governments also deploy targeted implementation strategies by building or reshaping digital infrastructure. Evidence documents how some states combine hardware, software, and regulation to assert control in strategic sectors, asserting that implementation can range from state-built infrastructures to legal mandates on private actors (Freuler, 2025).

13Applying this lens to FRTs could clarify how the EU, the US, and Chinese policies diverge not only in normative design, but also in implementation arrangements, thereby illuminating the relationship between digital sovereignty narratives and governance structures. This theoretical combination attempts to provide the conceptual foundation for the comparative analysis of the EU, the US, and the PRC by operating across different analytical levels. Policy implementation frameworks inform the examination of regulatory instruments, actor arrangements, and enforcement mechanisms, while digital sovereignty literature provides the conceptual language to interpret the political meaning of these arrangements. The next section outlines the research question derived from the literature review and proposes a methodological framework for the investigation.

Materials and Method

14As policy implementation unfolds within a given institutional context and requires an ad hoc organizational structure (Sager & Gofen, 2022), this paper intends to contribute to the investigation of implementation arrangements by analyzing FRT policies and the related governance in three selected case studies: the EU, which represents a multi-state supranational union; the US, which corresponds to a federal liberal-democratic state; and the PRC, which exemplifies a centralized authoritarian state. The case selection follows the ‘most different system’ technique (Seawright & Gerring, 2008), to analyze three models with evident differences in political and institutional arrangements, technology regulation, and approaches to digital sovereignty.

15Against the background proposed in the prior section, our research question is: How do policy implementation arrangements for FRTs shape models of digital sovereignty in the EU, the US, and the PRC? This inquiry intends to partially fill a gap detected in the related literature, as the concept of digital sovereignty is often examined by focusing on formal strategies and their rhetoric. A missing link emerges, represented by the need to observe the implementation phase as the nexus between the expressed political will and the actual intervention in practice. In line with this gap, existing scholarship on FRT governance maps regulatory design and risks (Veale, et al., 2021; Gültekin Várkonyi, 2024) and documents accuracy and bias concerns, thereby raising rights-related implications (Buolamwini & Gebru, 2018; Grother et al., 2019). However, sovereignty debates tend to emphasize high-level narratives and external projection (Bradford, 2020; Zeng et al., 2017; Pohle & Santaniello, 2024; Santaniello, 2026). We contribute to the research by shifting from formal norms to the arrangements that execute them (Scharpf, 1997; Hill & Hupe, 2021; Howlett, 2009). We examine how actor arrangements, instrument choices, and oversight capacities translate sovereignty claims into practice. Drawing on the policy implementation (Imperial, 2021; Sager & Gofen, 2022; Steinebach, 2022) and governance theoretical approach (Hooghe & Marks, 2001; Casula, 2024; Ottone & Barbieri, 2025), this paper conceptualizes implementation arrangements as the confluence of legal mechanisms, policy actors, policy instruments, political will, and compliance mechanisms. From this perspective, implementation represents the phase in which sovereignty is exercised through instrument design (for example, ex-ante legality, and ex-post liability), enforcement capacity, and by extending beyond the polity’s borders to include standard-setting and market-leverage actions (Bradford, 2020; Zeng et al., 2017). The analysis of these components could offer new insights into how digital sovereignty is endorsed, negotiated, or challenged in the FRT policy arena.

16To do so, this study adopts a public policy analysis built on the policy implementation literature reviewed, which conceptualizes implementation arrangements as a locus of power and control allocation in governance, i.e., the polity of implementation (Sager & Gofen, 2022). According to these authors, the configuration of implementation can significantly influence who makes decisions in the FRT policy process by connecting these arrangements to the exercise of authority over these technologies, thus linking implementation to attributes of digital sovereignty (Santaniello, 2026). The adoption of a comparative case-oriented design is consistent with best practices in qualitative policy research, enabling contextualized analysis while still permitting cross-case inference (George & Bennett, 2005). This approach aligns with prior comparative implementation studies that combine document analysis with structured case comparison to build theoretical insights. Through this approach, we articulate a comparative, mechanism-based typology that links implementation arrangements to sovereignty claims and their attributes (Santaniello, 2026) in the EU, the US, and the PRC.

17The study relies on secondary data (Bowen, 2009) primarily in the form of official policy documents and legislation referring to FRTs (as well as biometric data) for each case. This data is triangulated with grey literature review and previous scholarly research. Table 1 below systematizes the data collected.

Table 1. Policy documents analysed for the EU case, the US case and the Chinese case

Case

Year

Acts & Policy documents

Type

Main Scope (FRT-related)

EU

2016

Regulation (EU) 2016/679 – GDPR

Regulation

Biometric data as a 'special category'; legal bases and safeguards for FRT processing

2016

Directive (EU) 2016/680 – Law Enforcement Directive (LED)

Directive

Processing of FRT by competent authorities for law-enforcement/justice purposes

2022

French DPA SAN-2022-019 – Clearview AI

Enforcement decision

Unlawful scraping/biometric processing; deletion orders and administrative fine

2022

Italian DPA Decision No. 50/2022 – Clearview AI

Enforcement decision

Ban on use and fine for unlawful biometric processing

2023

EDPB Guidelines 05/2022 (final 2023) – FRT in law enforcement

Guidelines

Necessity/proportionality, logging, accountability requirements for Law Enforcement Authority use of FRT

2024

Regulation (EU) 2024/1689 – AI Act

Regulation

Risk-based approach; ban on real-time remote biometric identification for LEAs with narrow, pre-authorized exceptions

US

2008-2024

Biometric Information Privacy Act (BIPA) – 740 ILCS 14

State Statute (Illinois)

Notice & written consent, retention policy; private right of action governing FRT

2017

Biometric Privacy Protection Act – House Bill 1493

State Act (Washington)

Notice & written consent, retention policy; not allowed the private right of action governing FRT (only the public one)

2018

California Consumer Privacy Act

State Act (California)

Included definition of FRT but not specific restrictions on its use

2019

Rosenbach v. Six Flags

Court ruling - Enforcement decision (Illinois Supreme Court)

Confirms that a BIPA violation is sufficient to sue (no additional 'actual harm' required)

2019

San Francisco – Stop Secret Surveillance Ordinance

Municipal Ordinance (San Francisco)

Ban on FRT use by city agencies; transparency for surveillance tools

2021

GAO-21-518 – Facial Recognition Technology (Federal LEAs)

GAO Report

Maps federal FRT uses; recommends tracking, risk assessment, and training

2022

OSTP – Blueprint for an AI Bill of Rights

Guidelines (White House)

Principles on fairness, data privacy, notice/consent relevant to FRT governance

2025

Texas Responsible Artificial Intelligence Governance Act

Governor Act (Texas)

Notice & written consent, retention policy; not allowed the private right of action governing FRT (only the public one)

PRC

2016

Cybersecurity Law (CSL)

Law

'Cyber sovereignty' baseline; network/data security, localization, context for FRT

2017

National Intelligence Law

Law

Cooperation duties with intelligence; relevant to state access to FRT data/tech

2021

Personal Information Protection Law (PIPL)

Law

Biometrics as 'sensitive'; obligations for the private sector; broad exemptions for state organs

2021

Supreme People Court's Judicial Interpretation on Civil Cases Involving FRT

Judicial interpretation

Limits on compelled FRT by businesses/venues; right to alternatives

2025

Measures for the Security Administration of Facial Recognition Technology Applications (CAC)

Administrative measures

Prohibit forcing FRT for routine ID; require alternatives, consent, signage (private sector)

Sources : EU, US, Chinese official sources

18The collected data were analyzed through a qualitative content analysis using a structured coding scheme in which each document was examined to detect findings related to the set of analytical dimensions derived from the theoretical framework (Schreier, 2012) and to answer the research question. Specifically, we coded and identified data related to four dimensions:

  1. Regulatory frameworks for FRTs: The norms, procedures, and orientations governing the use of FRTs and representing the policy landscape of what is allowed or prohibited;

  2. Actors and roles: The stakeholders involved in policy implementation and enforcement, including both state and non-state actors, as well as their roles or powers;

  3. Implementation arrangements and enforcement mechanisms: The procedures and instruments through which FRT policies are implemented;

  4. Implications for digital sovereignty: how the implementation of FRT policies reflects or impacts the possible attributes of a digital sovereignty claim.

19Examples of our thematic coding approach to these dimensions are: ‘centralized vs. decentralized implementation’; ‘state vs. non-state actors’; ‘role of actors’; ‘presence vs. absence of enforcement mechanism’, ‘rights safeguards vs. security exceptions’. This allowed a systematic comparison across cases, ensuring that each aspect (norms, actors, mechanisms, sovereignty implications) was evaluated simultaneously for the EU, the US, and the PRC. We documented factual observations for each dimension within each case and then compared across the three cases to identify patterns of convergence or divergence. Regarding Chinese policy documents specifically, the analysis relies on the well-established legal translation project ‘China Law Translate’, as the authors do not claim native-level proficiency in Chinese. This approach reflects common practice in comparative policy research by ensuring consistency and transparency when analyzing non-English legal sources.

20Finally, this investigation presents some limitations. Firstly, the study exclusively relies on secondary data and their content analysis without primary data such as interviews or direct observation, thus omitting some grounding nuances not detected in official policy documents. We tried to mitigate this limitation by triangulating our findings with published findings and viewpoints. Secondly, our qualitative comparison focuses on three cases, hence its findings are not generalizable. However, they represent a specific context, providing in-depth insights about the EU, the US, and the Chinese landscapes of FRT policies, as our goal is interpretative and theory-building. Thirdly, we acknowledge that working with translated legal materials may entail residual interpretative limitations that future research could address through native-language analysis. Last but not least, we acknowledge that this analysis is temporally limited and that policy mutations beyond the period covered may require future reassessment.

Findings

21This section dives into the three in-depth case studies by identifying and examining four analytical dimensions across EU, US, and Chinese policies related to FRTs. The comparison reveals divergent approaches: the EU’s rights-based regulatory approach; the US’s market-driven approach; and the PRC’s state-centric surveillance approach.

The European Union: A Rights-Based Regulatory Approach

22The EU’s framework for FRTs rests on a robust legal foundation. The General Data Protection Regulation (GDPR) categorizes biometric data as a special class requiring explicit consent or a demonstrated public interest (European Parliament and Council, 2016a). Law enforcement use is further regulated by the 2016 Law Enforcement Directive, requiring necessity and proportionality (European Parliament and Council, 2016b). In 2024, the EU enacted the Artificial Intelligence Act (AI Act), which employs a risk-based classification. Real-time biometric surveillance in public by law enforcement is banned, except under specific emergencies with judicial oversight (European Parliament and Council, 2024). Retrospective and private-sector uses fall under ‘high-risk’ AI categories and are subject to stringent safeguards, such as transparency, accuracy, and human oversight. Practices like indiscriminately scraping images for facial databases without consent are prohibited. Although civil society groups pushed for a blanket ban, limited exceptions were retained. The European Data Protection Board (EDPB) and The European Data Protection Supervisor (EDPS) advocated for a full ban on live FRTs in public spaces (EDPB, 2022). Implementation across the 27 member states introduces fragmentation risks. Under the GDPR and the AI Act, national Data Protection Authorities (DPAs) and market surveillance authorities ensure enforcement, which is coordinated at the EU level. However, varied interpretations and resources across DPAs pose compliance challenges. The EDPB issued guidelines urging strict adherence to necessity and proportionality standards (EDPB, 2022). As the AI Act enters full force in 2026, a regulatory grey zone persists. Civil society plays a significant role in shaping enforcement. Public backlash against Clearview AI’s scraping practices led to fines by several DPAs (e.g., French DPA, 2022; Italian DPA, 2022), demonstrating how citizen activism supports implementation. According to Santaniello (2026), this regulatory activism reflects latency, where enforcement is triggered by public events. The EU’s legal strictness signals an instrumentality claim to digital sovereignty, where governance aligns with rights and legal authority rather than corporate or state-driven surveillance. Yet, uneven enforcement across states reveals a multiversity in sovereignty claims involving EU institutions, member states, and civil actors. Gaps between rulemaking and enforcement also risk hypocrisy, undermining sovereignty assertions. Externally, the EU’s regulatory approach to biometric data and high-risk AI applications, including FRTs, has the potential to influence the compliance strategies of multinational technology companies operating across jurisdictions. Rather than constituting a fully generalized global diffusion of rules, this influence reflects sector-specific dynamics often associated with the so-called ‘Brussels Effect’ (Bradford, 2020), whereby tech companies align internal practices with EU requirements to preserve market access, suggesting adversariality in shaping global standards.

The United States: An (Almost) Deregulated Market-Driven Framework

23The US lacks a federal legal framework for FRTs. No comprehensive privacy or AI laws exist, leaving regulation to the Fourth Amendment and limited agency policies. This results in the widespread use of FRTs by federal entities with minimal oversight. A 2021 Government Accountability Office (GAO) report found that agencies had adopted inadequate risk assessments (GAO, 2021). The White House’s 2022 AI Bill of Rights offers non-binding principles such as privacy and anti-discrimination (White House OSTP, 2022). States and municipalities have filled this vacuum with diverse regulations. The Illinois’s Biometric Information Privacy Act (BIPA), adopted in 2008 and revised in 2024, is the strongest statute at the national level, as it requires consent and enables lawsuits for violations (Illinois General Assembly, 2024). Landmark cases, such as Meta’s $650M settlement, confirm its deterrent power (Illinois Supreme Court, 2019). Texas and Washington have passed weaker biometric laws that rely on state attorneys (Texas Governor, 2025; Washington General Assembly, 2017), while California grants data rights but does not impose specific FRTs restrictions (California General Assembly, 2018). Local ordinances, such as San Francisco’s 2019 FRTs ban for city agencies, demonstrate bottom-up regulation, though they are limited in scope (City and County of San Francisco, 2019). This patchwork leads to implementation disparities: strong protection in some states versus regulatory voids in others. Enforcement arrangements vary widely. In BIPA-compliant polity, class-action suits create private enforcement mechanisms. Elsewhere, regulation depends on public institutions. NGOs, the media, and civil society raise awareness and drive legal action, often filling institutional gaps. This fragmented model highlights multiversity in digital sovereignty (Santaniello, 2026), where authority is distributed among public and private actors. The US emphasizes innovation and decentralized governance, asserting sovereignty through global tech dominance, a form of adversariality that contrasts with rights-based models. States and agencies claim instrumentality, using FRTs for specific goals. However, rhetoric around rights often coexists with minimal oversight, raising the risk of hypocrisy. Occasionally, latency emerges as civil society mobilization prompts regulatory action in response to scandals.

The People’s Republic of China: A Security-First, State-Centric Model

24China integrates FRTs into its national surveillance infrastructure. Although the 2016 Cybersecurity Law does not explicitly name FRTs, it sets broad data governance norms. The National Intelligence Law requires individuals and firms to assist state security, institutionalizing a public-private partnership for surveillance (Standing Committee of the NPC of the PRC, 2016; 2017). The 2021 Personal Information Protection Law (PIPL) classifies biometric data as sensitive and requires consent and limiting private-sector use, although it grants broad exemptions to state agencies (Standing Committee of the NPC of the PRC, 2021). The Supreme People’s Court (2021) limited FRTs in private settings, offering non-FRT alternatives, while the 2025 Cyberspace Administration of China (CAC) regulation, following approval by the Ministry of Public Security (MPS), mandates signage and consent for commercial use, but not for public security applications (CAC, 2025). Implementation is highly centralized. Tech firms operate under government directives without independent oversight. China boasts the world’s most extensive camera network, which feeds into centralized databases. FRTs are integral to the Social Credit System, reinforcing automated surveillance (Qiang, 2019). Enforcement is selective: authorities act on public scandals involving companies but tolerate expansive state use aligned with national interests. Communication strategies promote public acceptance by framing FRTs as beneficial for safety. Although signage provides minimal transparency, opting out is not feasible. China’s approach anchors digital sovereignty in state authority. While bolstering control, it compromises privacy by Western standards. Public concern is growing, as 75% of respondents report concern about the use of FRTs, and 87% oppose its use in public and business settings (Reuters, 2025). The state has responded by limiting private use while preserving its own prerogatives. Through the Santaniello lens (2026), this model blends instrumentality and hypocrisy: citizens’ privacy is protected from companies, but not from state actors. The narrative of protecting against foreign threats further reinforces adversariality (Standing Committee of the NPC of the PRC, 2021). Claims to sovereignty reflect multiversity, combining privacy, security, and control, though latency is less evident due to proactive state planning.

Discussion

25This discussion section integrates the results of this comparative analysis with three strands of literature. It assesses how the findings confirm, challenge, or extend existing evidence on the regulation of FRTs and biometric data, policy implementation arrangements related to FRTs, and digital sovereignty claims enabled by FRT policy. The discussion shifts across these analytical levels, drawing on complementary perspectives to interpret specific governance dynamics where relevant. The five attributes of digital sovereignty identified by Santaniello (2026) are adopted as an overarching interpretative framework to explain how regulatory designs, actor configurations, and implementation and enforcement mechanisms translate into distinct ways of performing digital sovereignty across cases. Table 2 displays the findings of this comparative investigation for the EU, the US, and the PRC by mapping policy framework and instruments for FRT, governance arrangements, compliance landscapes, and the corresponding digital sovereignty attributes. Rather than treating ‘right-based’, ‘market-driven’, and ‘state-centric’ as abstract ideal-types, the discussion shows how these models materialize in the governance of FRTs through specific configurations of authority, coordination mechanisms, and enforcement practices.

Table 2. Comparative findings of FRT policies implementation arrangement and digital sovereignty attributes across the EU, the US, and the PRC

Dimensions

EU

US

PRC

Regulatory Framework for FRT

Rights-based:
- GDPR: biometrics is a special category;
- LED necessity/proportionality for enforcers;
- AI Act: default ban on real-time remote biometric identification in public by enforcers (narrow, pre-authorized exceptions). High risk of the most other FRT uses. Needs of ex-ante conformity, transparency, and human oversight;
- Strong guidance by the European regulators' network

Patchwork & market-driven:
- No comprehensive federal law;
- state statutes, weaker biometric/privacy rules elsewhere; municipal bans on government FRT;
- non-binding federal principles;
- technical benchmarking;
- Oversight gaps at federal agencies (GAO).

Security-first & surveillance:
- Cybersecurity/National Security Laws;
- PIPL: biometrics is a sensitive data, constrains commercial use but carves out broad exemptions for state institutions and agencies;
- CAC 2025 Measures: consent/alternatives/signage for private deployments;
- SPC 2021 limits forced FRT by businesses/venues;
- Public-security FRT remains largely unconstrained by privacy law.

Actors & Roles

Multi-level governance:
- EU co-legislators;
- DPAs (investigate/sanction) coordinated by EDPB;
- national market-surveillance authorities for AI Act;
- courts (CJEU/national);
- LEAs as implementers;
- vendors as obligated entities;
- civil society & media as watchdogs triggering cases/enforcement.

Polycentric arrangement:
- State courts as de facto regulators;
- state AGs (consumer protection);
- cities & police departments (local bans/policies);
- federal agencies with internal rules;
- GAO for benchmarks;
- NGOs/media/academia as bottom-up enforcers;
- BigTech as central policy targets.

Centralized hierarchy:
- Party-dependent institutions lead deployment;
- CAC regulates private data uses;
- National tech firms integrated into a party-state ecosystem (cooperation duties, standards alignment);
- Courts mainly for consumer disputes;
- No independent DPA equivalent.

Implementation & Enforcement

Rule-and-regulator pathway:
- Ex-ante (conformity assessment, documentation, post-market surveillance);
- Ex-post (DPA fines/orders);
- Cross-border coordination;
- Capacity asymmetries across DPAs, with risk of fragmentation;
- Enforcers practices hardest to harmonize pending AI Act full effect.

Liability-and-localism pathway:
- Compliance driven by class actions and settlements, municipal bright-line bans, and uneven agency policies;
- GAO documents tracking/training/risk-assessment gaps;
- Protections vary by state/city.

Command-and-integration pathway:
- ubiquitous CCTV+FRT, national technical standards, integration with watchlists/smart-city platforms;
- Selective administrative enforcement of commercial rules (to decrease public anxiety) while state security uses proceed with minimal external checks;
- Rapid, coherent roll-out via hierarchical coordination and public-private policy fusion.

Manifestation of Digital Sovereignty Attributes

- Adversariality: asserts control vis-à-vis foreign platforms & domestic overreach (extraterritorial GDPR/AI Act limits);
- Multiversity: EU institutions, Member States, DPAs, courts, CSOs, and tech companies co-produce authority;
- Latency: scandals catalyze stricter guidance/enforcement;
- Instrumentality: regulation used to project EU values and standards internally & externally;
- Hypocrisy (risk): high rule density but heterogeneous enforcement due to an implementation sovereignty gap if capacity lags.

- Adversariality: positions liberal model against authoritarian surveillance abroad. Domestically fragmented targets (firms/agencies);
- Multiversity: states, cities, courts, tech companies, NGOs, agencies assert overlapping authority;
- Latency: federal action lags. Harms (bias, wrongful IDs) trigger state/local/judicial responses;
- Instrumentality: litigation and market incentives act as sovereignty tools;
- Hypocrisy (risk): civil-rights rhetoric vs. coverage gaps and unregulated uses where no regulation exists.

- Adversariality: sovereignty framed against foreign interference & internal instability threats. FRT justified for order and security;
- Multiversity: agencies, tech companies, and courts participate but are subordinated to party leadership;
- Latency: selective concessions when public anxiety rises, without curbing state surveillance;
- Instrumentality: FRT is an instrument of rule to execute social management and automated enforcement;
- Hypocrisy: privacy rhetoric for commerce coexists with unconstrained state use.

Source: Authors’ elaboration of findings detected by secondary collected data

26From a regulatory and instrument-choice perspective, these findings clarify how different policy designs condition the articulation of digital sovereignty across cases. The EU’s rights-based policy framework for FRTs widely corroborates the literature related to the European context as a norm entrepreneur that governs high-risk AI, including biometric identification, through ex-ante constraints, the proportionality principle, and independent oversights mechanisms (Veale, et al. 2021; Simmler & Canova, 2025). Specifically, the combination of the GDPR’s ‘special category’ treatment of biometric data and the AI Act’s prohibitions confirms the vision of normative digital sovereignty, which elevates fundamental rights and legality as core FRT policy goals (Smuha, 2024). Our evidence supports this perspective. While rule density is high and coherent at the EU level, enforcement asymmetries across member states actually create variation in national contexts related to FRT regulation (Gültekin-Várkonyi, 2024), especially during the transition period of the AI Act. Regarding instrument choice (Scharpf, 1997; Steinebach, 2022), the EU favors ex-ante design controls (conformity assessments, documentation, and bans) over ex-post liability, consistent with its broader regulatory style (Bradford, 2020; European Parliament and Council 2016; 2024; EDPB, 2022). However, this right-based configuration is not without internal tensions. As a matter of fact, in the arena of migration control and border management, the EU framework allows broader uses of biometric identification and surveillance technologies, often justified by security and efficiency grounds. Hence, this setting tends to privilege executive agencies over DPAs, revealing how this rights-based approach is selectively suspended in migration and other securitized policy areas (Bigo et al., 2019). Turning to the US case, we see confirmation of the literature on patchwork governance. Without a federal model, regulation emerges through polycentric regulative instruments (Garvie et al., 2016) such as state laws, municipal bans, and court decisions. The BIPA’s private right of action functions as an ex-post and bottom-up enforcement instrument that rebalances powers between individuals and tech companies (Illinois Supreme Court, 2019; Illinois General Assembly, 2024). This aligns with policy research that shows how accountability and contestation can compensate for deficient ex-ante public oversight (Howlett, 2009). Our findings build on this point by situating bottom-up enforcement mechanisms within implementation literature: judicial trials could shift the ‘polity of implementation’ (Sager & Gofen, 2022) toward courts, making them co-regulators in landscapes where agencies are weak or absent. Moreover, GAO’s report on the use of FRTs by federal agencies raises questions about self-regulation (GAO, 2021), supporting critics who claim that without federal oversight, sovereignty over FRTs is shifting towards tech companies and agencies (Freuler, 2025). Nevertheless, characterizing the US framework as market-driven should not hide the growing entanglement between state actors and big tech companies. As highlighted in the literature on the surveillance-industrial complex (Ball and Snider, 2013), federal agencies increasingly rely on private technology firms for data analytics and surveillance capabilities. This creates a hybrid framework in which non-state actors exercise quasi-sovereign power while state actors govern indirectly through procurement and public-private partnerships rather than formal regulation. In the Chinese case, the security-first approach to FRTs corroborates a framework of policy measures that constrict the commercial use of FRTs while leaving state surveillance largely intact. This aligns with research on the Chinese ‘internet sovereignty’ doctrine and surveillance state-building (Qiang, 2019; Ong, 2023) and adaptive regulation calibrated to repress public anxiety without constraining security prerogatives (Xu et al., 2025). Our evidence modestly extends this literature. The 2025 measures (CAC, 2025; Reuters, 2025) crystallize a dual-track model, revealing how instrument choice can signal responsiveness while reinscribing state primacy (Santaniello & Palladino, 2022). Nevertheless, this state-centric framework is also shaped by tensions between state security priorities and the market interests of domestic technology firms. Big techs developing and deploying FRTs have incentives to expand commercial applications and international markets, occasionally pushing back against restrictive state interventions. Recent regulatory adjustments could thus be read not only as instruments of control but also as attempts to recalibrate state authority in response to market-driven dynamics within the domestic surveillance economy (Creemers, 2018).

27Shifting to actor configurations, these results show how authority over FRTs is distributed across state and non-state actors, thereby shaping different constellations of sovereignty in practice. With reference to the EU, related findings confirm that DPAs, courts, and EU-level networks build a multi-level governance arrangement (Hooghe & Marks, 2001) with the participation of non-EU tech companies (Bradford, 2020). However, variation in DPAs’ resources and national security framings produces unequal monitoring, which represents an implementation gap anticipated by Hill and Hupe (2021) and consistent with the ‘polity of implementation’ defined by Sager and Gofen (2022). In this complex arrangement, civil society actors and investigative media act as ‘shadow regulators’, exposing unlawful scraping and catalyzing enforcement action by DPAs (French DPA, 2022; Italian DPA, 2022). This highlights again how non-state actors shape the allocation of power, even in a rights-first regime. Regarding US polycentric governance, we observe varying levels of participation among state courts, state attorneys, municipal councils, federal agencies, and advocacy groups. Empirically, this matches Lipsky’s (1980) insight on street-level discretion and bottom-up adaptation, as well as Imperial’s (2021) findings on hybrid implementation structures. We extend this concept by identifying appellants as an implementation actor. By transforming abstract rights into compliance costs, class actions reshape platform practices and establish actual standards that are absent at the federal level. Moreover, evidence from the GAO on agency policies underscores the limitations of agency-centric control without legislative standards (GAO, 2021). In the Chinese context, findings reveal a concentration of roles within security organs and the CAC for private data governance. Party-aligned tech companies provide FRT infrastructures under mandatory cooperation duties (Standing Committee of the NPC of the PRC, 2017). Courts occasionally protect consumers (Supreme Popular Court, 2021), but with no consequences for public security. These findings confirm a top-down model without autonomous watchdogs, which is consistent with Qiang (2019) and with policy-discursive accounts of state-centric sovereignty (Zeng et al., 2017). We contribute to the literature by framing the PRC’s public-private fusion as an instrument that internalizes private capacity within the sovereign apparatus. This is functionally the inverse of the US case, where private actors externalize regulatory pressure through courts and markets.

28Regarding implementation arrangements and enforcement mechanisms, this dimension illustrates how sovereignty claims are translated into effective control or remain only partially realized in practice. In the EU, we observed both ex-ante conformity processes (European Parliament and Council, 2024), ex-post DPA sanctions (European Parliament and Council, 2016a; 2016b), and coordinated guidance (EDPB, 2022). However, we also observed capacity asymmetries that risk undermining the effectiveness of EU regulatory influence on transnational compliance. These asymmetries are often associated with the ‘Brussels effect’ (Bradford, 2020) when enforcement practices remain uneven across member states. This partly qualifies claims that the strong right-based EU regulation suffices, as implementation capacity and joint action still matter (Pressman & Wildavsky, 1973). Our evidence suggests a compliance pathway in which bottom-up-down enforcement mechanisms, together with cross-border cooperation, drive conformity among global tech companies. Top-down enforcement adoption, however, remains the hardest to harmonize. In the US, implementation hinges on litigation risk, municipal bans, and agency practices with unequal internal rules (GAO, 2021). This confirms a liability-driven compliance model in which firms alter features and data practices to reduce exposure while police departments adapt to local ordinances or court interpretations. In any case, protection depends on where a person lives and who sues. From a policy implementation perspective, the system excels at addressing visible abuses but struggles to prevent diffuse harms in the absence of federal baselines. In the PRC, Implementation is exclusively top-down and integrated, involving national standards, vast CCTV-FRT networks, centralized databases, and selective administrative enforcement of commercial abuses (CAC, 2025). Our findings corroborate research on the PRC’s adaptive authoritarianism (Zeng et al., 2017; Qiang, 2019): a calibrated concession to consumer privacy stabilizes policy legitimacy while preserving core surveillance intentions. In terms of policy implementation, the Chinese approach exemplifies goal congruence across the central government, local governments, and industry, due to party control, which minimizes traditional coordination failures and enables rapid scale-up, although at the expense of independent oversight.

29The patterns emerging from the analysis of regulatory frameworks, actor configurations, and implementation arrangements can be interpreted through Santaniello’s (2026) five attributes of digital sovereignty. In the EU, sovereignty is enacted primarily as the sovereignty of law and rights. The EU’s regulatory posture constructs both an external adversary (dependence on Big Tech or third-country surveillance models) and an internal one (unbounded domestic surveillance), consistent with the discursive ‘Self-Other’ dynamics identified by Pohle and Santaniello (2024). This adversariality is operationalized through extraterritorial GDPR enforcement and AI Act constraints on live remote biometric identification. Multiversity is marked by the presence of state and non-state actors, including EU co-legislators, member states, DPAs, courts, civil society organizations, and tech companies, which co-produce authority in a multi-level governance arrangement (Hooghe & Marks, 2001). Latency becomes visible when scandals trigger enforcement mechanisms, and instrumentality emerges when the EU leverages the GDPR and the AI Act to project normative authority internally and externally. Notably, this occurs by shaping transnational compliance expectations among global technology companies, a mechanism commonly described as the ‘Brussels effect’ (Bradford, 2020). However, a residual hypocrisy risk persists when DPAs’ lack capacity and coordination, and sovereignty may be claimed but not realized due to an implementation gap. In the US, digital sovereignty appears market-driven and polycentric. Adversariality often surfaces in geopolitical contrasts while targets are fragmented domestically. Multiversity is also strong in this context, where states, cities, courts, tech companies, NGOs, and federal bodies assert overlapping authority. This resonates with Santaniello’s (2026) plural claims and Freuler’s (2025) account of U.S. ‘network power’ mediated by private actors. Latency characterizes federal action as concrete reforms typically follow harms brought to light and reported by academic and governmental work. Instrumentality, however, takes a distinctive form. In the absence of a federal regime, tech companies and agencies set de facto practices. Meanwhile, judicial conflict functions as a bottom-up sovereignty tool, enabling individuals to enforce constraints where allowed. The flip side is the hypocrisy risk because civil rights rhetoric coexists with unequal coverage and unregulated uses in jurisdictions lacking binding rules. This gap has been repeatedly noted in federal oversight reports (for example, see: GAO, 2021). In the PRC, sovereignty is security-centric and state-led. Adversariality is an explicit attribute because sovereignty is framed against foreign interference and internal subversion, with FRTs justified as instruments of stability and order (Qiang, 2019). Multiversity is present yet limited, as ministries, the CAC, courts, and aligned tech companies participate, although they are all subordinate to the Party leadership. Latency is managed through selective consumer-privacy adjustments (CAC, 2025) when public anxiety rises (Reuters, 2025), which modulate legitimacy without diminishing state security prerogatives. The instrumentality is explicit because the FRT is a means of governance, embedded in social management and public-security platforms (Qiang, 2019). We also assume that the attribute of hypocrisy is institutionalized as a dual track, whereby privacy rhetoric and regulatory requirements for the commercial sector coexist alongside unconstrained state surveillance. Taken together, the analysis of the three cases shows that different policy implementation arrangements do not merely reflect pre-existing sovereignty claims but actively shape and stabilize distinct models of digital sovereignty through specific configurations of rules, actors, and enforcement mechanisms.

30Across the three cases, the well-established distinction between ‘rights-based’, ‘market-driven’, and ‘state-centric’ models gains analytical traction when examined through the governance of FRTs: In the EU, a right-based model is reflected in dense ex-ante regulatory controls, multi-level oversight, and the central role of independent authorities and courts. In the US, a market-driven model emerges through fragmented authority, litigation-centered enforcement, and governance by liability and procurement rather than comprehensive regulation. In the PRC, a state-centric model is embedded in centralized decision-making, hierarchical coordination, and the integration of FRTs into public-security infrastructures with selective regulatory adjustments responding to societal and market pressures. This governance-centered perspective moves beyond stylized typologies by showing how different models of digital sovereignty are enacted through concrete institutional arrangements.

31In light of these results, the regulatory instruments across the cases analyzed map onto distinct sovereignty claims, confirming that instrument choice is not neutral but constitutive of who decides and on what grounds. Comparatively, the actors who enact the FRT policy differ starkly, validating implementation theory’s claims that actor configuration allocates power and conditions outcomes (Hill & Hupe, 2021; Sager & Gofen, 2022). It also extends these claims by specifying the distinct ‘implementation polities’ that correspond to divergent sovereignty projects in the FRT domain. Transversely, three archetypal compliance pathways emerge that are consistent with, yet extend beyond, implementation theory. The EU shows a rule-and-regulator pathway with ex-ante controls and independent oversight that is sensitive to capacity gaps. The US approach underlines a liability-and-localism pathway, with ex-post correction, municipal or state standards, and sensitivity to venue effects. The PRC approach presents a command-and-integration pathway with top-down standards, fused public-private scopes, and sensitivity to legitimacy shocks. Drawing on these findings, we propose the concept of ‘implementation sovereignty gap’: claims to sovereignty are realized to the extent that arrangements mobilize sufficient capacity, coverage, and consistency to change behaviors. This concept links policy instruments to the discourse on digital sovereignty, operationalizing sovereignty as enforceable control rather than mere rhetoric.

32The analysis of the three selected cases also leads to three theoretical extensions. Firstly, moving from discourse to implementation, we propose a sixth, implicit attribute of digital sovereignty: ‘enforcement capacity’, which is the link between sovereignty claims and sovereignty outcomes. Currently, compelling claims in the EU lack sufficient resources and coordination. Furthermore, weak claims in the US could be counterbalanced by polycentric enforcement via courts and subnational actors. Secondly, we observe that implementation polities can be considered ‘sovereignty types’, by differentiating rules and regulators in the EU context, accountability and localism in the US context, and command and integration in the PRC context. These types implement sovereignty through characteristic compliance pathways and actors’ coalitions. Thirdly, drawing on Bradford (2020), Freuler (2025), and Cong (2021), we observe that sovereignty is constructed not only within polities but also through transnational implementation effects with ‘sovereign externalities’. These include EU norms traveling via global compliance, the ‘Brussels effect’; US tech companies projecting influence as private sovereigns; and the PRC exporting surveillance technologies and standards through Chinese tech companies.

33Finally, the discussion confirms that FRT policy implementation arrangements represent a stress test for digital sovereignty. The EU case demonstrates how legality-first regimes must continually invest in coordinated and resourced enforcement to convert normative authority into effective control. The US case shows that polycentric enforcement can limit abuses in specific venues but cannot ensure universal guarantees without federal regulations. The PRC case shows that, while hierarchic integration maximizes state capacity, it comes at the cost of civil liberties. The cross-case insight is that implementation arrangements could become sovereignty arrangements. In a nutshell, they determine who can say no, how compliance is prompted, and whose values are operationalized when faces are turned into data.

Conclusions

34This investigation sought to understand how policy implementation arrangements for FRTs shape models of digital sovereignty in the EU, the US, and the PRC. Our comparative analysis shows that implementation is not merely technical execution but also a constitutive mechanism through which sovereignty claims are translated into power over data, infrastructures, and people in everyday life. Who is empowered to decide (actors’ network), with what instruments (policy design), and under which oversight (governance) jointly determine whether sovereignty is performed. Three cross-cutting implementation logics underpin these models. Firstly, the EU’s rule-and-regulator logic rests on ex-ante constraints, independent oversight, and rights-based proportionality tests. The practical consequence is a sovereignty model that projects normative authority at home and abroad through the ‘Brussels effect’, precisely because compliance is mediated through law and regulatory capacity, rather than through ownership of infrastructure alone. Secondly, the US exhibits a liability-and-localism logic. In the absence of a comprehensive federal policy framework, litigation, municipal ordinances, state-level rules, benchmarking, and agency guidance distribute implementation power across multiple settings. This polycentricity sustains an open, innovation-oriented ecosystem but produces uneven coverage and delayed correction of harms, thereby enacting a sovereignty model that privileges market dynamism and decentralized checks over centralized ex-ante legality. Thirdly, the PRC follows a command-and-integration logic where public security deployments are embedded in state-controlled infrastructures. Recent rules have tightened commercial use while leaving broad prerogatives for state surveillance. In this sense, implementation frames digital sovereignty as a hierarchical control over data and platforms.

35According to the literature on policy implementation arrangements, each logic brings together distinct instruments and signals of digital sovereignty: the EU’s instrument choice prioritizes ex-ante legality and independent enforcement; the US’s instrument choice prioritizes ex-post accountability and venue competition; the PRC’s instrument choice prioritizes central-administrative capacity and infrastructural consolidation. The consequential negotiation of arrangements among different actors within these institutional settings triggers implementation paths that concretize different types of sovereignty, thus helping to explain how these claims evolve over time. In the EU, enforcement salience rises after focusing events, catalyzing stricter interpretations and harmonized guidance. This stabilizes a rights-first model of digital sovereignty. In the US, actual harms trigger city and state responses, judicial litigation, and revised agency practices, but the claim of digital sovereignty remains plural due to the absence of a federal baseline. In the PRC, selective adjustments to the commercial use of FRT mitigate public anxiety while preserving expansive state prerogatives and reaffirming the doctrine of internet sovereignty as a core state function. As a matter of fact, the implementation capacity (resources; degrees of coordination, oversight mechanisms, and compliance capacity) operates as a flexible link between sovereignty claims and sovereignty types across the cases analyzed. Where capacity and coherence are high (EU’s regulators on high-risk systems, and PRC’s party-state infrastructures), sovereignty is performed consistently; where they are fragmented (US’s federal-state gap), sovereignty is performed as a negotiated equilibrium among multiple centers of authority.

36Additionally, there are some consequential international implications. The EU’s implementation arrangements export a rights-based model for biometric governance, leveraging market access and constructing a form of sovereignty through standard-setting. The US’s arrangements export a networked model in which private actors, benchmarks, and trials shape global practice through diffusion and procurement, albeit without a single statutory model. The PRC’s arrangements export a state-centric model that integrates technical capability with governance doctrines by emphasizing territorial control and security-led data governance. Cross-border data rules in the contemporary techno-social system are, therefore, increasingly shaped by conflicts and adjustments among these models. In this sense, FRT policy implementation is constitutive of and expressive of sovereignty both domestically and externally.

37Policy implications follow from this comparative analysis. Our analysis suggests a shared agenda focused on aligning instruments with capacity. In polity landscapes that rely on ex-ante legality, the credibility of a rights-based sovereignty depends on adequately funding independent authorities, coordinating guidance across levels, and ensuring that prohibitions are not eroded by broad public order exceptions. Moreover, in polity landscapes that rely on polycentric enforcement, a thin federal baseline for government FRT could reduce market-driven inequities while preserving innovation. In polity landscapes that privilege centralized infrastructural control, however, recent moves to discipline commercial deployments could be extended to articulate transparent safeguards and remedies for public security uses. This could be achieved with the help of verifiable traceability and independent appeals, even if anchored at the administrative level, thereby strengthening the legitimacy of sovereignty claims. Finally, because sovereignty is exercised between polities as well, interoperable guardrails for FRT (such as, mutual expectations regarding accuracy, human oversight, and trackers in cross-border uses) would reduce the transaction costs of cooperation, while respecting divergent constitutional orders.

38As already noted in the methodology section, this investigation has three limitations that could represent future research opportunities outlined as follows. First of all, the collection and analysis of primary data could provide new findings not detectable in official policy documents, refining our understanding. Moreover, extending this analysis to additional polities would test the portability of our insights. Finally, future reassessment and longitudinal process-tracing of specific deployments, as well as measurement of policy outcomes, may be required to foster or extend our findings.

Top of page

Bibliography

Ball, K., & Snider, L. (Eds.) (2013). The Surveillance-Industrial Complex. A Political Economy of Surveillance. Routledge.

Bigo, D., Isin, E., & Ruppert, E. (Eds.) (2019). Data Politics. World, Subjects, Rights. Routledge.

Bradford, A. (2020). The Brussels effect: How the European Union rules the world. Oxford University Press.

Bowen, G. A. (2009). Document analysis as a qualitative research method. Qualitative research journal, 9(2), 27–40.

Buolamwini, J., & Gebru, T. (2018). Gender Shades: Intersectional Accuracy Disparities in Commercial Gender Classification. In S. A. Friedler & C. Wilson (Eds.), Proceedings of the 1st Conference on Fairness, Accountability and Transparency, (pp. 77–91). Proceedings of Machine Learning Research.

CAC (Cyberspace Administration of China) (2025). Measures for the Security Administration of Facial Recognition Technology Application. https://www.cac.gov.cn/2025-03/21/c_1744174262156096.htm Translation by China Law Translate. https://www.chinalawtranslate.com/en/facial-rec-2025/

California General Assembly (2018). California Consumer Privacy Act. Accessed https://leginfo.legislature.ca.gov/faces/codes_displayText.xhtml?division=3.&part=4.&lawCode=CIV&title=1.81.5

Casula, M. (2024). How different multilevel and multiactor arrangements impact policy implementation: evidence from EU regional policy. Territory, Politics, Governance, 12(7), 1048–-1072.

City and County of San Francisco (2019). Stop Secret Surveillance Ordinance. https://sfgov.legistar.com/View.ashx?M=F&ID=7206781&GUID=38D37061-4D87-4A94-9AB3-CB113656159A

Cong, W. (2021). The Spatial Expansion of China’s Digital Sovereignty: Extraterritoriality and Geopolitics. SSRN 4019797. https://papers.ssrn.com/sol3/papers.cfm?abstract_id=4019797

Creemers, R. (2018). China’s Social Credit System: An Evolving Practice of Control. SSRN 3175792. https://papers.ssrn.com/sol3/papers.cfm?abstract_id=3175792

EDPB (European Data Protection Board) (2022). Guidelines 05/2022 on the use of facial recognition technology in the area of law enforcement. https://www.edpb.europa.eu/our-work-tools/documents/public-consultations/2022/guidelines-052022-use-facial-recognition_en

Engler, A. (2023). The EU and US diverge on AI regulation: A transatlantic comparison and steps to alignment. Brookings. https://www.brookings.edu/articles/the-eu-and-us-diverge-on-ai-regulation-a-transatlantic-comparison-and-steps-to-alignment/

European Commission (2020). Shaping Europe’s Digital Future. https://commission.europa.eu/system/files/2020-02/communication-shaping-europes-digital-future-feb2020_en_4.pdf

European Parliament and Council (2016a). Regulation (EU) 2016/679 (General Data Protection Regulation). Official Journal of the European Union. https://eur-lex.europa.eu/eli/reg/2016/679/oj/eng

European Parliament and Council (2016b). Directive (EU) 2016/680 (Law Enforcement Directive). Official Journal of the European Union. https://eur-lex.europa.eu/eli/dir/2016/680/oj/eng

European Parliament and Council (2024). Regulation (EU) 2024/1689 on Artificial Intelligence (AI Act). Official Journal of the European Union. https://eur-lex.europa.eu/eli/reg/2024/1689/oj/eng

Floridi, L. (2018). Soft ethics, the governance of the digital and the General Data Protection Regulation. Philosophical Transactions of the Royal Society A: Mathematical, Physical and Engineering Sciences, 376(2133), 1-11.

French DPA (Data Protection Authority) (2022). Restricted Committee Deliberation No. SAN-2022-019. https://www.cnil.fr/sites/default/files/atoms/files/deliberation_of_the_restricted_committee_no_san-2022-019_of_17_october_2022_concerning_clearview_ai.pdf

Freuler, J. O. (2025). Infrastructural power: State strategies for internet control. Internet Policy Review, 14(2), 1–27.

Garvie, C., Bedoya, A. M., & Frankle, J. (2016). The Perpetual Line-Up: Unregulated Police Face Recognition in America. Georgetown Law, Center on Privacy & Technology.

George, A. L., & Bennett, A. (2005). Case studies and theory development in the social sciences. MIT Press.

GAO (Government Accountability Office) (2021). Facial Recognition Technology: Federal Law Enforcement Agencies Should Better Assess Privacy and Other Risks (GAO-21-518). https://www.gao.gov/products/gao-21-518

Grother, P. J., Ngan, M. L., & Hanaoka, K. K. (2019). Face Recognition Vendor Test (FRVT). Part 3: Demographic Effects. National Institute of Standards and Technology Interagency or Internal Report 8280.

Gültekin Várkonyi, G. (2024). Navigating data governance risks: Facial recognition in law enforcement under EU legislation. Internet Policy Review: Journal On Internet Regulation, 13(3), 1–36.

Hartzog, W. (2018). Privacy’s Blueprint: The Battle to Control the Design of New Technologies. Harvard University Press.

Hashemi-Pour, C., Gillis, A. & Loshin, P. (2025). What is Biometrics. Techtarget. https://www.techtarget.com/searchsecurity/definition/biometrics.

Hill, M. & Hupe, P. (2021). Implementing public policy: An introduction to the study of operational governance. Sage Open.

Hooghe, L., & Marks, G. W. (2001). Multi-Level Governance and European Integration. Rowman & Littlefield.

Howlett, M. (2009). Governance modes, policy regimes and operational plans: A multi-level nested model of policy instrument choice and policy design. Policy Sciences, 42(1), 73–89.

Illinois General Assembly (2024). Biometric Information Privacy Act (740 ILCS 14). https://www.ilga.gov/legislation/ilcs/ilcs3.asp?ActID=3004&ChapterID=57.

Illinois Supreme Court (2019). Rosenbach v. Six Flags Entertainment Corp., 2019 IL 123186. https://www.illinoiscourts.gov/Resources/f71510f1-fb2a-43d8-ba14-292c8009dfd9/123186.pdf

Imperial, M. T. (2021). Implementation structures: The use of top-down and bottom-up approaches to policy implementation. Oxford research encyclopedia of politics.

Italian DPA (Data Protection Authority (2022). Provvedimento n. 50/2022—Clearview AI. https://www.garanteprivacy.it/home/docweb/-/docweb-display/docweb/9751362

Kostka, G., Steinacker, L. & Meckel, M. (2023). Under big brother’s watchful eye: Cross-country attitudes toward facial recognition technology. Government Information Quarterly, 40(1), 1–20.

Lipsky, M. (1980). Street-Level Bureaucracy: Dilemmas of the Individual in Public Services. Russell Sage Foundation.

Lynch, J. (2020). Face off: law enforcement use of face recognition technology. SSRN 3909038. https://papers.ssrn.com/sol3/papers.cfm?abstract_id=3909038&download=yes

Mazmanian, D. & Sabatier, P. (1983). Implementation and Public Policy. Scott, Foresman.

Ong, R. (2023). Privacy and personal information protection in China’s all-seeing state. International Journal of Law and Information Technology, 31(4), 349–375.

Ottone, V., & Barbieri, M. (2025). Implementation arrangements for research and innovation policies in the Italian, Spanish, French, and German national recovery plan: A comparative analysis of emerging challenges for multi‐level governance. Review of Policy Research, 42(2), 234–251.

Pohle, J. & Santaniello, M. (2024). From multistakeholderism to digital sovereignty: Toward a new discursive order in internet governance?. Policy & Internet, 16(4), 672–691.

Pressman, J. L., & Wildavsky, A. B. (1973). Implementation: How Great Expectations in Washington Are Dashed in Oakland. University of California Press.

Qiang, X. (2019). The road to digital unfreedom: President Xi’s surveillance state. Journal of Democracy, 30(1), 53–67.

Reuters (2025). China says facial recognition should not be forced on individuals. Technology Section. https://www.reuters.com/technology/china-says-facial-recognition-should-not-be-forced-individuals-2025-03-21/

Rouvroy, A. (2015). Algorithmic governmentality: a passion for the real and the exhaustion of the virtual. Paper presented at Transmediale, Panel All Watched Over by Algorithms, Berlin, Germany, January 29. https://www.academia.edu/10481275/Algorithmic_governmentality_a_passion_for_the_real_and_the_exhaustion_of_the_virtual

Sager, F. & Gofen, A. (2022). The polity of implementation: Organizational and institutional arrangements in policy implementation. Governance, 35(2), 347–364.

Santaniello, M. (2026). Attributes of Digital Sovereignty: A Conceptual Framework. Geopolitics, 31(2), 788–809.

Santaniello, M., & Palladino, N. (2022). Discourse Coalitions in Internet Governance. Shaping Global Policy by Narratives and Definitions. In A. Calderaro and M. Marzouki (eds.), Internet diplomacy: Shaping the global politics of cyberspace (pp. 61–84). Bloomsbury Publishing PLC.

Scharpf, F. W. (1997). Games real actors play: Actor-centered institutionalism in Policy research. Routledge.

Schreier, M. (2012). Qualitative content analysis in practice. Sage Open.

Seawright, J., & Gerring, J. (2008). Case selection techniques in case study research: A menu of qualitative and quantitative options. Political Research Quarterly, 61(2), 294-308.

Selbst, A. D., & Barocas, S. (2018). The intuitive appeal of explainable machines. Fordham Law Review, 87(3), 1085-1139. https://papers.ssrn.com/sol3/papers.cfm?abstract_id=3126971.

Simmler, M., & Canova, G. (2025). Facial recognition technology in law enforcement: Regulating data analysis of another kind. Computer Law & Security Review, 56, 1–10.

Smuha, N. A. (2024). Digital Sovereignty in the European Union: Five Challenges from a Normative Perspective. In G. Barrett, P. C. Müller-Graff, J. P. Rageade & V. Vadász (Eds.), European Sovereignty: The Legal Dimension–A Union in Control of its own Destiny (pp. 127–149). Springer.

Standing Committee of the NPC (National People’s Congress) of the PRC (People’s Republic of China) (2016). Cybersecurity Law. http://www.npc.gov.cn/npc/xinwen/2016-11/07/content_2001605.htm Translation by China Law Translate. https://www.chinalawtranslate.com/en/2016-cybersecurity-law/

Standing Committee of the NPC (National People’s Congress) of the PRC (People’s Republic of China) (2017). National Intelligence Law. http://www.npc.gov.cn/COBRS_LFYJNEW/user/Law.jsp Translation by China Law Translate. https://www.chinalawtranslate.com/en/national-intelligence-law-of-the-p-r-c-2017/

Standing Committee of the NPC (National People’s Congress) of the PRC (People’s Republic of China) (2021). Personal Information Protection Law of the People’s Republic of The China. http://www.npc.gov.cn/npc/c2/c30834/202108/t20210820_313088.html Translation by China Law Translate. https://www.chinalawtranslate.com/en/%e4%b8%aa%e4%ba%ba%e4%bf%a1%e6%81%af%e4%bf%9d%e6%8a%a4%e6%b3%95/

Steinebach, Y. (2022). Instrument choice, implementation structures, and the effectiveness of environmental policies: A cross-national analysis. Regulation & Governance, 16(1), 225–242.

Supreme People’s Court (2021). Provisions on Several Issues concerning the Application of Law in the Trial of Civil Cases Involving the Use of Facial Recognition Technology. http://www.court.gov.cn/fabu-xiangqing-315851.html Translation by China Law Translate. https://www.chinalawtranslate.com/en/civil-cases-facial-recogntion/

Tene, O., & Polonetsky, J. (2013). A theory of creepy: technology, privacy and shifting social norms. Yale JL & Tech., 16, 59–102.

Texas Governor (2025). Texas Responsible Artifical Intelligence Governance Act. https://capitol.texas.gov/tlodocs/89R/analysis/html/HB00149S.htm

Veale, M., & Zuiderveen Borgesius, F. (2021). Demystifying the Draft EU Artificial Intelligence Act—Analysing the good, the bad, and the unclear elements of the proposed approach. Computer Law Review International, 22(4), 97–112.

Wang, X., Wu, Y. C., Zhou, M., & Fu, H. (2024). Beyond surveillance: privacy, ethics, and regulations in face recognition technology. Frontiers in Big Data, 7, 1–10.

Washington General Assembly (2017). Biometric Privacy Protection Act – House Bill 1493. https://lawfilesext.leg.wa.gov/biennium/2017-18/Pdf/Bill%20Reports/House/1493%20HBR%20TED%2017.pdf

White House’s OSTP (Office of Science and Technology Policy) (2022). Blueprint for an AI Bill of Rights: Making Automated Systems Work for the American People. Washington, DC. https://bidenwhitehouse.archives.gov/ostp/ai-bill-of-rights/

Xu, W., Wang, S., & Zuo, X. (2025). Whose victory? A perspective on shifts in US-China cross-border data flow rules in the AI era. The Pacific Review, 1-27.

Zeng, J., Stevens, T., & Chen, Y. (2017). China’s solution to global cyber governance: Unpacking the domestic discourse of “internet sovereignty”. Politics & Policy, 45(3), 432–464.

Top of page

References

Electronic reference

Michele Barbieri and Laura Georgiana Macarie, Faces at Stakes: Comparative Insights on Facial Recognition Technologies Policy Implementation Arrangements across the EU, the US, and the PRCInternational Review of Public Policy [Online], 8:1 | 2026, Online since 01 February 2026, connection on 10 April 2026. URL: http://journals.openedition.org/irpp/6126; DOI: https://doi.org/10.4000/15t8x

Top of page

About the authors

Michele Barbieri

DISA-MIS, University of Salerno, Fisciano (SA), Italy
mibarbieri@unisa.it
https://orcid.org/0000-0003-4748-093X

Laura Georgiana Macarie

DIKE, Tuscia University of Viterbo, Viterbo, Italy

Top of page

Copyright

CC-BY-4.0

The text only may be used under licence CC BY 4.0. All other elements (illustrations, imported files) may be subject to specific use terms.

Top of page
Search OpenEdition Search

You will be redirected to OpenEdition Search