Face Tracking Development Services and Biometric Compliance
Face tracking finds and follows the geometry of a face in a camera feed — landmark positions, head pose and expression — without necessarily identifying who the person is. That distinction carries far more weight in 2026 than it did when most face tracking pages were written, because biometric law now treats tracking, identification, categorisation and emotion inference as four separate things with four separate rule sets.
Mixcore Studio builds face tracking into mobile apps, browser experiences and social AR platforms. We have been shipping software for over eight years with a team of around twenty, and we treat this as an engineering problem with a compliance surface attached, not as a demo that happens to use a camera.
Face tracking, face recognition and emotion inference are not the same product
They are frequently sold as one capability. Legally they diverge sharply, and the classification decides your cost and your risk.
- Face tracking and landmarking — computes where facial features sit, frame by frame, to drive a filter, an avatar, a try-on or an accessibility control. It can run entirely on device and can be built so that no face template is ever created or stored.
- Face recognition — matches a face against a stored template to establish identity. This is the category that attracts Illinois BIPA claims, and in the EU it sits in the Annex III high-risk list as remote biometric identification.
- Biometric categorisation — infers attributes from a face. EU AI Act Article 5(1)(g) has prohibited inferring race, political opinions, trade union membership, religious or philosophical beliefs, sex life or sexual orientation from biometric data since 2 February 2025. There is no compliance path around that; it is a ban.
- Emotion recognition — infers emotional state. Article 5(1)(f) prohibits it in workplaces and education institutions, with narrow medical and safety exceptions, and has done since the same date.
Most briefs we receive describe the first category and specify the second. Correcting that at the specification stage is usually the single largest cost saving in the project.
What biometric regulation actually requires in August 2026
Two things changed this summer, and both are being reported wrongly in opposite directions.
- The high-risk deadline moved. Regulation (EU) 2026/1744, the Digital Omnibus on AI, was published in the Official Journal on 24 July 2026 and entered into force on 27 July 2026, six days before the deadline it changed. Annex III standalone high-risk obligations, which cover remote biometric identification, biometric categorisation and emotion recognition, moved from 2 August 2026 to 2 December 2027. Annex I embedded high-risk systems moved to 2 August 2028.
- Transparency obligations did not move. Article 50 took effect on 2 August 2026 as planned. Users must be told when they are interacting with an AI system, synthetic image, audio, video and text must carry machine-readable marking, and anyone exposed to emotion recognition or biometric categorisation must be given explicit notice. Systems already on the market have until 2 December 2026 to satisfy the marking requirement.
So the honest position is neither "the deadline passed, you are late" nor "nothing happens until 2027". Prohibitions have been live since February 2025, transparency duties have been live since a fortnight ago, and the heavy conformity-assessment machinery arrives in December 2027.
In the United States, Illinois BIPA remains the dominant exposure for anything touching face geometry. It requires written notice and written consent before collection, with statutory damages of $1,000 per negligent violation and $5,000 per intentional or reckless violation, plus attorney fees, costs and injunctive relief (740 ILCS 14/20). Because damages accrue per violation and the statute carries a private right of action, class action exposure is the practical risk rather than regulator enforcement. How violations are counted, and how later amendments to the Act reach cases already pending, are actively litigated and move, so treat the current position as something counsel confirms at the time you build rather than a constant.
We are engineers rather than lawyers. Your counsel decides what applies to you. We build the consent capture, retention and deletion, disclosure surfaces and per-jurisdiction switches that their position requires, and we write those into the statement of work rather than leaving them as an assumption.
The platform layer changed, and parts of it are dead
- Meta Spark AR is gone. Meta Spark Studio, Hub and Player shut down on 14 January 2025, and every third-party AR effect was removed from Instagram, Facebook and Messenger. Meta retained only its own first-party effects and named no successor. Instagram and Facebook accept no third-party face filters at all in 2026. Any proposal still recommending Spark is describing a platform that has been dead for nineteen months.
- Branded social face AR consolidated onto Snap Lens Studio and TikTok Effect House. Both are free to build on. Snap reports that over 350 million Snapchatters engage with augmented reality every day on average, which is the reach argument for the channel. Creative production for a custom lens is quoted per brief, with paid distribution budgeted separately.
- 8th Wall's hosted platform ended. The hosted 8th Wall platform was retired on 28 February 2026, and experiences still published on it stop running permanently on 28 February 2027. The technology now ships free and self-hosted at 8thwall.org, with the XR engine binary under a limited-use licence that permits commercial use and the surrounding tools and examples under MIT, and Face Effects is among the covered features alongside image targets and sky effects. Face tracking work on 8th Wall is therefore more salvageable than the shutdown suggests, but anything still hosted needs a migration plan now, not in 2027.
- MediaPipe Face Landmarker is the neutral default. Google AI Edge's model returns 478 three-dimensional face landmarks, blendshape coefficients for expression, and transformation matrices for effect rendering, with builds for Python, Android, iOS and Web/JS. Its documentation was last updated on 28 May 2026. It still carries the MediaPipe Solutions Preview and early release designation, which is not a GA stability guarantee, and we raise that with procurement before they find it themselves.
- Android XR face tracking sits in its own library. ARCore for Jetpack XR covers plane detection, anchors, hand tracking, face tracking, depth and device pose. Google's documentation states that a session can only be created on an Android XR device or on a supported ARCore device, so the target hardware list is something to confirm per project rather than assume. It is a separate library from the classic mobile ARCore SDK, which is not deprecated and sits on the 1.54.x line. Google Sceneform is archived and should not be proposed for new work.
Where face tracking earns its place
- Virtual try-on — eyewear, cosmetics and jewellery, where landmark stability and correct occlusion matter more than photorealism.
- Avatars and telepresence — blendshape coefficients driving a rigged character in real time, on device, with no video leaving the handset.
- Accessibility input — head pose and facial gestures as a control surface for people who cannot use touch or a pointer reliably.
- Social and brand AR — Snap Lens Studio and TikTok Effect House campaigns, where no-install reach beats an app store download for almost every consumer brief.
- Camera and production tooling — auto-framing, relighting, retouching and effect rendering that needs landmark geometry rather than identity.
- Liveness and anti-spoofing — usually as a component inside an identity flow that a regulated provider operates, not as a bespoke identity system of our own.
How we build it
- On device by default — landmarks computed on the handset or in the browser, with no frame leaving the device unless a named feature requires it. This one decision cuts latency, hosting cost and legal exposure at the same time.
- No template storage unless identity is genuinely the product — a filter, avatar, try-on or accessibility control does not need a stored face template, and not creating one removes most of the BIPA surface rather than mitigating it.
- Consent as a real flow — written notice and written consent captured before first collection, versioned, timestamped, revocable, with deletion that actually deletes and can be evidenced.
- Disclosure wired to jurisdiction — Article 50 notice where a system touches emotion recognition or biometric categorisation, machine-readable marking on synthetic output, and per-region behaviour instead of one global lowest-common-denominator experience.
- WebGPU where it is available, with a WebGL2 fallback that is mandatory rather than decorative — WebGPU is not Baseline. Web Platform Status still records it as limited availability, with Chrome 144, Edge 144 and Safari 26 among the browsers shipping it, so the WebGL2 path has to be built and measured on real devices rather than stubbed. Browser face tracking reads the camera directly and does not depend on WebXR, so its availability is not tied to a given browser's XR support.
- Measured bounds, not claimed ones — accuracy and frame rate tested across device tiers and lighting, with the degraded path defined for occlusion, glasses, masks, off-axis heads and mid-tier Android thermal throttling.
- Open, portable output — glTF for meshes and standard blendshape naming, so the asset library survives the next platform shutdown. Two major AR platforms died in fourteen months; portability is now a design requirement rather than a nicety.
When face tracking is the wrong choice
We turn down or redirect a meaningful share of face tracking enquiries, for reasons worth stating plainly.
- Emotion inference in a workplace or classroom — prohibited in the EU under Article 5(1)(f) since 2 February 2025. There is no architecture that makes it compliant, so we will not quote for it.
- Counting or attention measurement — if the question is "is someone present and engaged", a non-biometric signal such as device interaction, seat occupancy or anonymous person detection usually answers it with none of the consent burden.
- Workforce or campus access control in Illinois and similar states — the consent, retention and audit infrastructure frequently costs more than the badge reader it was meant to replace, and it carries a private right of action that the badge reader does not.
- Identity verification as a bespoke build — for KYC and account recovery, an accredited identity provider that carries the liability is normally the better answer than a face recognition stack you own and must defend.
- Audiences on low-end Android — per-frame landmarking plus rendering costs battery and thermal headroom. If most of your users are on mid-tier or older devices, that has to be tested on the real hardware before the feature is committed to, not after launch.
If your use case survives that filter, the engineering is well understood and the tooling is mature. If it does not, we would rather tell you in the first conversation.
Our expertise
- Facial landmark detection
- Expression and blendshape mapping
- On-device processing
- Consent and retention controls
- Jurisdiction and disclosure mapping
- Browser and WebGPU rendering
Frequently asked questions
Do I need consent to use face tracking in my app?
It depends on jurisdiction and on whether you create a biometric identifier. Illinois BIPA requires written notice and written consent before collecting a face geometry scan, with statutory damages of $1,000 per negligent violation and $5,000 per intentional or reckless one under 740 ILCS 14/20. A landmark-only pipeline that never builds or stores a template sits in a different position from a recognition system, which is why we settle that architectural question before writing code. Your counsel makes the legal call; we build to it.
Did the EU AI Act biometric obligations start on 2 August 2026?
Partly, and the widely quoted version is wrong. Regulation (EU) 2026/1744, the Digital Omnibus on AI, entered into force on 27 July 2026 and moved Annex III standalone high-risk obligations, including remote biometric identification, biometric categorisation and emotion recognition, from 2 August 2026 to 2 December 2027. What did start on 2 August 2026 is Article 50 transparency, including explicit notice to anyone exposed to emotion recognition or biometric categorisation. Article 5 prohibitions have applied since 2 February 2025.
What replaced Meta Spark AR for branded face filters?
Nothing from Meta. Meta Spark Studio, Hub and Player shut down on 14 January 2025, all third-party effects were removed from Instagram, Facebook and Messenger, and Meta named no successor, so those platforms accept no third-party face filters in 2026. Branded social AR consolidated onto Snap Lens Studio and TikTok Effect House, both free to build on, with paid placement budgeted separately.
Can face tracking work without storing anyone's face?
Yes, and for most products it should. Filters, avatars, virtual try-on and accessibility controls need landmark positions and expression coefficients for the current frame, not a stored template or a saved image. Running the model on device and discarding frames immediately removes most of the regulatory surface rather than merely reducing it, and it also cuts latency and hosting cost.
Is MediaPipe Face Landmarker production ready?
It is widely deployed and it is what we reach for first, returning 478 3D landmarks, blendshape coefficients and transformation matrices across Python, Android, iOS and Web/JS, with documentation last updated on 28 May 2026. It does still carry Google's MediaPipe Solutions Preview and early release designation, which is not a general-availability stability guarantee. We flag that to risk and procurement teams up front, pin versions, and define the fallback rather than letting the label surface late in review.
Contacts
We are always happy to talk with you.
Feel free to contact us in any suitable way
Request a quote
Let's discuss your project!
Please, provide us with a brief description of what you
already have and what you are going to achieve.
Mail us contact@brainiacminds.com