We call it registration. For the person in the line, it is closer to a toll.
Biometric identity has become the front door of assistance. To receive food, cash, shelter, or a place on a list, a person increasingly must give a fingerprint, an iris scan, a face. We adopted these systems for good reasons. They cut duplication, they speed verification, they satisfy the demand to prove that aid reached real people and not invented ones. The technology is impressive and, on its own terms, it works. But a tool that works is not the same as a choice that was free. We have built a door that opens only to the body, and then placed behind it the things a person cannot survive without. The question we skipped is the one that matters most. Convenient for whom.
This is not an argument that the people who deploy these systems act in bad faith. The motives are usually accountability and efficiency, both real. The problem is structural, it is shared across the sector, and because it is structural it is ours to redesign.
Why a scan becomes a condition
Follow the pressure and the pattern is clear. We are asked, rightly, to prove we did not pay the same person twice or invent recipients to inflate a count. Biometrics answer that demand cleanly, so they spread. Once one system requires a scan to enroll, the others align, because a shared identity is more efficient than many separate ones. Step by step, the body becomes the key to the whole system, and the person who would rather not hand over their biometrics finds there is no other line to stand in. The convenience is real, but it accrues mostly to the institutions doing the counting. The cost accrues to the person who must enroll to eat.
And that person holds the least power in the exchange. A household waiting on registration cannot negotiate the terms, cannot ask what happens to the scan, cannot decline and still receive help. Consent offered under that weight is not really consent. It is compliance with the only path to survival. We know this, and we have largely treated it as the unavoidable price of doing the work well.
The deeper risk is that a fingerprint is permanent in a way a card is not. A lost token can be reissued. A compromised identifier, tied to a body, cannot be changed. When we build a registry of the irises and fingerprints of people fleeing danger, we create something that can outlive the response, change hands, and in a different season become a way to find exactly the people who most needed not to be found. The danger is not the scanner in the moment. It is the existence of the record after.
A card can be reissued. A fingerprint cannot. We are building permanent keys to people who needed a door they could close behind them.
Registration that respects refusal
None of this means abandoning the duty to verify or returning to systems that could not tell one person from ten. It means building identity that earns the body rather than demanding it, and that leaves a way to say no.
Keep a path for those who decline. The clearest test of whether registration is a choice is whether refusing it still leaves a way to receive help. Where a person can opt out of biometrics and enroll by another means, the scan becomes an option. Where there is no other line, it was never a choice. An alternate route is the difference between identity and a toll.
Collect the least that verifies. Verification rarely requires the richest possible biometric. The discipline is to gather the minimum that confirms a person is who they say, and no more, because every additional identifier is a permanent risk we are choosing to hold on someone else’s behalf.
Let the identity belong to the person. A credential the person carries and controls, that they can present without us holding a central registry of their bodies, shifts the power. The aim is an identity that serves the holder across providers, not a database that serves the institutions and exposes the holder.
Govern the registry as a liability, not an asset. A store of biometrics from people in crisis is one of the most sensitive things we will ever hold. It deserves a hard limit on how long it lives, a short list of who may ever touch it, and a date it is destroyed, treated as a risk to be reduced rather than a capability to be expanded. Funders and authorities who ask us to verify carry the same interest in not creating a permanent target, and that restraint is something we can build together.
None of this slows down a response that needs to know whom it served. It makes the knowing accountable to the person it describes. A system that can verify without coercing, and confirm without keeping forever, is a stronger system, not a weaker one.
So the standard fits on a line. If a person cannot decline our registration and still receive help, we have not offered identity. We have charged a toll in the only currency they could not withhold, which is themselves. Building a door they can choose is work we can begin at the next enrollment we design.