Is it legal for cinemas and concert venues to scan your face for entry?

At a glance

It isn’t banned — but a cinema or concert venue that scans your face is collecting your personal data under India’s DPDP Act, so it needs a clear notice and your free, informed consent, and it can only take what it genuinely needs to let you in. You can refuse and ask for a normal ticket or ID check instead. Where an ordinary ticket check would do the job, insisting on a face scan is hard to square with the law’s data-minimisation rule.

Educational resource only. This explains how face-scanning at venues is treated under India’s Digital Personal Data Protection Act, 2023 (DPDP Act); it is not formal legal advice.

The situation

You’ve booked tickets to a film or a concert, and at the gate there’s no ticket scan — there’s a camera scanning faces. Maybe you registered a selfie when booking; maybe the venue is matching your face against a list. You didn’t think hard about it in the queue, and now you’re wondering whether they’re even allowed to do this.

Does the DPDP Act cover your face?

Yes — your face is personal data, and the venue collecting it is a Data Fiduciary with duties to you. A facial image or scan identifies you, so it counts as personal data under the DPDP Act, and the venue deciding to collect it is a Data Fiduciary — the organisation answerable for how it’s handled.

One myth worth clearing: people assume the new law gives biometrics like your face a special, higher-protected status. It doesn’t create a separate “sensitive data” category the way the old IT Act rules or Europe’s GDPR do — under the DPDP Act your face is treated as ordinary personal data. That’s not a loophole, though: ordinary personal data still comes with real obligations — notice, consent, using it only for the stated purpose, and keeping it secure. The protection is genuine; it just isn’t a special biometric tier.

Can a venue make face-scanning a condition of entry?

Only if your consent is genuinely free — and if the scan is actually necessary, which for plain entry it usually isn’t. Consent under the DPDP Act (Section 6) has to be free: a real choice, not something forced on you by making it the only way in. It also has to be limited to the data the purpose actually needs — the data-minimisation principle.

Put those together and the everyday case is weak for the venue. If checking a ticket or an ID gets you through the gate, then capturing and storing your face isn’t the minimum needed for entry — so demanding it, with no alternative, is hard to justify. A face scan might be defensible where you’ve genuinely opted in for a convenience (a faster lane you chose), but “scan or you don’t get in” for a service you already paid for sits on shaky ground.

Honest caveat: the law is new and largely untested by the regulator on exactly this scenario, so this is the plain reading of the obligations, not a settled ruling. What’s clear is what the venue owes you — below.

What a venue must do if it scans faces

Before it scans, it owes you a clear notice and a real choice; after, it owes you security and deletion. At minimum, a venue collecting facial data has to:

• Give a clear notice (Section 5) — what it’s collecting, why, and how to withdraw — before the scan, not a small sticker you notice afterwards.
• Take free, specific consent — an actual opt-in for the stated purpose, not a blanket condition buried in the booking terms.
• Collect only what’s needed and use it only for entry — not to build a marketing profile or track you around the venue.
• Keep it secure and delete it once the purpose is over. Your face can’t be reissued like a password if it leaks, which is exactly why holding it loosely is a problem.
• Get verifiable parental consent for anyone under 18 — children’s data carries tighter rules.

What you can do about it

You can decline the scan, ask for the standard alternative, and escalate if they mishandle your data.

1. Ask for the notice. Politely ask what’s being collected, why, and whether there’s a non-face option. A venue that can’t answer is already falling short.
2. Ask for the alternative. Request a normal ticket or ID check. For ordinary entry there’s usually no reason this can’t work.
3. Refuse consent — it’s yours to give. You’re allowed to say no to an unnecessary scan; consent has to be free.
4. Withdraw later if you opted in. If you did register a face, you can withdraw that consent and ask for the image to be deleted (Section 12) — withdrawal must be as easy as signing up was.
5. Escalate if needed. If a venue collects your face with no notice, no choice, or won’t delete it, raise a grievance with the business, then the Data Protection Board of India.

FAQ