Advice column: Is it safe to unlock my phone with my face?

Welcome to “Ask a security trainer,” the column where the Digital Security Training team at Freedom of the Press Foundation (FPF) answers your burning questions at the intersection of journalism and security. Submit yours here! Let’s jump right into this week’s question.

Dear DST,

I have some sensitive data on my device, including source contact information. While I don’t think it’s especially likely to happen to me, I have heard stories of the police using face unlock to compel someone to open up their device to search. As I’m also thinking through the changing political circumstances in the U.S., I have to wonder, how safe (or unsafe) is it to use my face to unlock my device?

Signed,

Prima Facie

Dear Prima,

This is a great question. Unlocking mobile devices with features that detect your face or fingerprint can be more convenient than manually typing in a password, but whether this is safer for you depends on your context. Let’s unpack that.

In many public places, we’re surrounded by security and other kinds of cameras, so if that’s your concern, unlocking a device with biometrics will protect your password from being recorded. However, for the circumstances where you’re concerned about device seizure — at least in the U.S. — a password is usually safer than using biometrics such as Face ID to unlock the device.

The general consensus among U.S. courts is that there are more Fifth Amendment protections for passwords than for biometrics. Most courts consider compelling someone to provide information in their minds, like passwords, more constitutionally problematic than compelling them to unlock a phone with their face or fingerprints. That's because the Fifth Amendment prohibits self-incrimination through testimony, and these courts don't consider nonverbal acts like unlocking a phone with one's body to be testimonial.

With that said, courts are not uniform in their interpretations of related cases, and it’s possible we may see stronger protections for biometrics in the future. For example, in early 2025, the U.S. Court of Appeals for the D.C. Circuit ruled that compelling a search using biometrics to unlock a device is unconstitutional. We’re hopeful other courts will follow suit.

In most circumstances, using Face ID is fine and increases ease of use and can even increase your security if you're worried about cameras. However, if you are worried about your phone being seized or you being arrested, then keep that feature off and stick to a password.

Also keep in mind that there are a handful of things you can do to minimize the risk to information stored on your mobile device. No matter your circumstance, you can start by setting a long, (ideally) randomized password. Read our guide to securing your mobile device.

Best,

Martin Shelton