The agencies France is now relying on to identify riot suspects using official facial recognition databases were simultaneously running unauthorized biometric identification on city streets — and a near-tripling of their database consultation counts since 2019 may reflect both streams at once.

Justice Minister Gérald Darmanin announced that investigators will cross-reference images scraped from TikTok, Instagram, and Discord against the TAJ — Traitement des Antécédents Judiciaires — France’s national criminal records database, which holds up to nine million frontal photographs. The announcement arrived as France was still assessing the damage from riots that began October 17, swept through Paris, Lyon, Marseille, and other cities, and left at least 2,400 people in custody and nearly 1,000 police officers and gendarmes injured.

The operation is legally framed as retrospective forensic identification — authorized under Article R40-26 of the Code of Criminal Procedure — not live biometric scanning. That legal framework has survived court challenge. The institutions invoking it have not.

What the October Riots Set in Motion

The October 17 protests began as demonstrations against rising living costs and deteriorating school conditions in several French cities. They descended rapidly into what authorities called France’s most destructive civil unrest in years. In Limoges, crowds set the historic city hall ablaze — the building dates to 1883. In Paris, looters swept through commercial districts around the Place de la République. A 17-year-old in Saint-Étienne lost a hand to a crowd-control grenade; a 17-year-old girl in Mulhouse lost an eye. By October 20, the Interior Ministry had confirmed roughly 2,400 arrests and approximately 1,000 police and gendarmes injured, 7 of them seriously.

The government moved quickly to signal consequences. In Lille, three men between 20 and 25 years old — none with prior criminal records — were sentenced to 10 months in prison for looting a video game store in the city’s old town. Around 300 cases in Paris alone were referred to prosecutors in connection with the October 17 violence. France’s National Assembly launched a parliamentary inquiry covering both the riots and the state’s policing strategy, with a report expected by year’s end.

How the Digital Investigation Works

Around 200 investigators have been assigned to the identification effort nationwide; roughly a dozen of those hold the specialist authorization required to use biometric tools.

Police are working footage from approximately 80,000 security cameras blanketing Paris’s streets and public transportation system, as well as shop cameras from the looted commercial premises. Social media platforms — principally TikTok, Instagram, and Discord — are providing investigators with a parallel stream of visual evidence. Officers are also monitoring online resale platforms, where stolen goods have appeared in listings.

One officer described the workflow to France24 as methodical: investigators start with social media footage, verify it against their investigative tools, and check whether crime scenes visible in posts match known cases. In at least four confirmed instances in Paris, investigators have established identities by tracing subjects through social media, street-level CCTV, and public transit camera footage.

Darmanin confirmed that facial recognition is being applied to connect social media imagery with the TAJ. The pipeline is straightforward in design: an image of a suspect extracted from TikTok or a shop camera is processed against the TAJ’s biometric archive, generating a ranked list of candidates for human review.

What French Law Permits — and the Technology Behind It

French law draws a sharp line between two modes of facial recognition use, and the distinction carries legal, technical, and political weight.

Retrospective facial recognition — matching recorded evidence against the TAJ in the course of an authorized judicial investigation — is explicitly permitted under Article R40-26 of the Code of Criminal Procedure. The Conseil d’État upheld this framework on April 26, 2022, rejecting a challenge from digital rights group La Quadrature du Net. What Darmanin described falls within this framework: specially authorized investigators are cross-referencing post-event evidence against a lawful database, not scanning members of the public in real time.

Live facial recognition in publicly accessible spaces — scanning a crowd against a watchlist — remains prohibited under French law and under EU AI Act Article 5, which bans real-time remote biometric identification by law enforcement except in three narrow, prior-authorized emergency scenarios. France’s algorithmic video surveillance (VSA) systems — authorized first for the 2024 Paris Olympics and extended through 2027 — are specifically engineered to flag behavioral events such as crowd surges and abandoned bags while avoiding facial recognition, precisely to comply with that prohibition.

The TAJ database that underpins the current operation was created by a 2012 decree merging two prior police and gendarmerie records systems, the STIC and JUDEX files. It holds approximately 17 million records on people implicated in investigations, 48 million victim records, and between 8 and 9 million frontal photographs searchable via biometric tools. Queries produce a ranked list of candidates; a human officer is required to make the final identification call.

Does ‘Authorized’ Mean What It Claims to Mean?

The legal framework France is asserting for the current operation is real. The credibility of the institutions asserting it is not.

In 2023, investigative outlet Disclose first revealed that BriefCam — a video analytics platform with facial recognition capability, developed by an Israeli company and now a Canon subsidiary — had been deployed by the national police since at least 2015 and by the gendarmerie since at least 2017 without required data protection assessments and without notifying the CNIL. The deployments proceeded without oversight for years.

In a 2024 ruling, the CNIL confirmed that the gendarmerie had used BriefCam’s facial recognition function in public spaces without required approvals — including during the summer 2023 riots — making those deployments unlawful. The CNIL also issued a formal CNIL notice covering the Interior Ministry and six individual municipalities. On January 30, 2025, the Grenoble administrative court found that BriefCam’s use by the municipality of Moirans constituted “disproportionate processing of personal data not provided for by the law” and ordered immediate cessation.

At the time of the BriefCam revelations in November 2023, then-Interior Minister Darmanin told interviewers he was unaware of facial recognition use in French policing. The CNIL investigation confirmed the practice was ongoing under his ministry.

A Pattern That Official Counts Cannot Explain Away

Earlier this year, Disclose escalated the picture further. A March 16, 2026 investigation reported that patrol officers were using Cognitec facial recognition software on their “NEO” (Nouvel Équipement Opérationnel) professional smartphones during routine on-street identity checks — photographing individuals and immediately querying the TAJ database in real time. Cognitec Systems GmbH is a German biometric technology company; its facial recognition integration became available on NEO devices for gendarmes in 2020 and for police officers in 2022, according to a February 2022 internal instruction cited in a subsequent National Assembly question.

That practice is flatly prohibited. Article R40-26 restricts TAJ access to specially designated, trained officers acting within formal judicial investigations under magistrate authorization. Photographing someone during a street identity check and instantly querying their face against the national biometric database is not a judicial investigation. It is a patrol encounter, and it cannot legally generate a TAJ query. The gendarmerie denied Disclose’s allegations.

The scale of the data cannot be explained by authorized use alone. TAJ database consultations linked to facial recognition grew from approximately 375,000 in 2019 to roughly one million in 2024 — a near-tripling over five years. A 2023 internal report by the IGPN, France’s police watchdog, acknowledged TAJ was accessed during on-street identity checks and warned that unjustified consultations would increase as NEO devices spread through the force.

This is the structural implication the official figures cannot answer: the legal and illegal streams were running simultaneously, in the same database, by the same agencies, under a reporting framework that the IGPN itself acknowledged was insufficient to prevent unauthorized use. The official consultation count of approximately one million may therefore combine authorized judicial searches with unauthorized patrol-officer queries that were logged but never audited as distinct. There is no publicly available mechanism to determine what proportion of that figure represents each.

La France Insoumise deputy Ugo Bernalicis formally asked the Interior Minister in April 2026 who authorized the NEO instruction, when the ministry learned of misuse, how many agents currently have access, and what controls exist to prevent unauthorized queries. The questions have not received a public answer.

Who Bears the Structural Risk

The accuracy limits of facial recognition systems mean that the downstream consequences of the database count problem fall unevenly.

Independent research has documented error rates in commercial facial recognition systems that run as high as 34.7 percent for darker-skinned women, compared to 0.8 percent or below for lighter-skinned men, according to the Buolamwini–Gebru study. Clare Garvie, a researcher at Georgetown Law’s Center on Privacy and Technology, has noted that “there’s no consensus in the scientific community that [facial recognition] provides a positive identification of somebody,” and that human operators correct shortlisted results only roughly half the time.

Those accuracy gaps interact with a documented racial disparity in French stop-and-search practice. A study by the Open Society Justice Initiative found that Black and Arab men in Paris are stopped between 3 and 15 times more frequently than white men. Because stop-and-search feeds TAJ entries — TAJ holds records on everyone implicated in an investigation, not only those convicted — the groups most over-represented in the database through disproportionate street contact are also the groups most likely to appear in a biometric candidate list when a query is run. A facial recognition system that generates more false positives for certain demographic groups, operating over a database inflated by discriminatory policing, compounds both effects.

La Quadrature du Net, which lost its Conseil d’État challenge to the TAJ facial recognition framework in April 2022, argues that the database’s scope — covering more than a quarter of the French population — creates structural rather than individual risk, and that no effective safeguard against discriminatory application currently exists.

France in European Context

The riot investigation represents the most visible live deployment of large-scale retrospective facial recognition by a major EU member state since the AI Act took effect, and it is being watched closely as an early stress test of the law’s law enforcement provisions.

Neighboring Germany has taken a different path, though the picture there is more complicated than a simple contrast would suggest. The German Federal Police Act, passed July 17, 2026, authorizes live facial recognition in “urgent danger” emergencies — though the law passed amid quorum controversy during the parliamentary session. A separate proposal to amend Germany’s Code of Criminal Procedure (StPO) to explicitly authorize the kind of retrospective social-media facial recognition France is now conducting remains before the Bundestag and has not been enacted. The contrast reflects genuine legal uncertainty across EU member states about how to integrate the AI Act’s framework into existing criminal procedure law.

For France, the current operation appears to fall within the AI Act’s Article 5 exception for post-event investigation of criminal offenses carrying maximum sentences of four or more years — the crimes alleged include arson and looting with statutory maxima that clear that threshold. But the Cognitec NEO real-time street use that the IGPN warned was increasing would not fall within that exception, and the EU’s market surveillance authority and national data protection authorities are required under Article 5 to be notified of each use of an authorized exception.

CNIL has not yet commented publicly on the October 2026 operation. Under its existing enforcement authority — the same authority it exercised against the Interior Ministry and six municipalities over BriefCam — it would have grounds to review the deployment and request records of how authorization and oversight were implemented.

Is France’s Legal Compliance Claim Credible?

That question is not rhetorical. The agencies currently invoking the retrospective TAJ framework were confirmed by their own watchdog and by an independent data protection authority to have been running unauthorized facial recognition in parallel with the official authorized system — and the watchdog explicitly warned that unauthorized use was likely increasing, not decreasing, as the infrastructure spread.

Darmanin emphasized that only a handful of specialist officers are authorized to use biometric tools in the current investigation. That authorization structure is real, and the retrospective judicial-investigation framework it rests on has survived legal scrutiny. But the same emphasis on specialist authorization existed throughout the years when BriefCam was being operated illegally and when NEO patrol devices were enabling real-time TAJ queries by non-specialist officers. The authorization structure did not prevent either practice; it ran alongside both of them.

France’s National Assembly inquiry, expected to report by year’s end, will cover both the policing of the riots and the surveillance strategy deployed in their aftermath. That report will arrive in a political and legal landscape where the gap between what French law formally permits and what French police have actually been doing is documented, confirmed, and not yet subject to any accountability mechanism that has produced consequences.

Frequently Asked Questions

Is it legal for French police to use facial recognition to identify riot suspects?

Retrospective facial recognition — matching images from recorded footage against the TAJ database as part of an authorized judicial investigation — is legal under Article R40-26 of the French Code of Criminal Procedure and has been upheld by the Conseil d’État. The current operation, as Darmanin described it, falls within this framework. What is prohibited — and what French police and gendarmerie were confirmed to have been doing separately — is live real-time facial recognition in public spaces and unauthorized TAJ queries during street identity checks. The legal operation and the illegal one were running in parallel by the same agencies. For the Conseil d’État’s April 2022 ruling rejecting La Quadrature du Net’s challenge, see the linked source.

What is the TAJ database, and how large is it?

TAJ — Traitement des Antécédents Judiciaires — is France’s national criminal records database, created by a 2012 decree merging the national police’s STIC file and the gendarmerie’s JUDEX file. It holds records on approximately 17 million people implicated in criminal investigations (not only those convicted), around 48 million victim records, and between 8 and 9 million frontal photographs searchable via facial recognition. Authorized access requires a specialist officer acting within a formal judicial investigation under a magistrate’s authorization.

If TAJ consultations are logged, why can’t authorities audit what’s authorized versus unauthorized?

This is precisely the question that the IGPN 2023 report and the Bernalicis National Assembly inquiry have not been able to answer from public records. The IGPN acknowledged that TAJ was being accessed frequently during on-street identity checks — which is explicitly unauthorized — and warned that the problem would grow as NEO devices spread. TAJ queries may be logged by user and timestamp, but distinguishing a patrol officer’s unauthorized real-time street query from a legally authorized investigative query requires an audit that neither the Interior Ministry nor the gendarmerie has publicly conducted or reported. The near-tripling of the consultation count to roughly one million per year occurred during the same period when unauthorized use was documented and warned about by the watchdog.

What does the EU AI Act require when France runs this kind of operation?

Article 5(1)(h) of the EU AI Act prohibits real-time remote biometric identification in publicly accessible spaces by law enforcement except in three specific, prior-authorized emergency scenarios. France’s October 2026 operation is framed as retrospective, not real-time, and therefore falls outside Article 5’s ban — it relies on the exception for post-event investigation of serious crimes. However, each use of a permitted exception must be notified to the relevant market surveillance authority and the national data protection authority (CNIL). Any real-time facial recognition by patrol officers using Cognitec NEO phones — if still occurring — would not fall within the permitted exceptions and would constitute a violation of Article 5.