Search-Preserving Anonymization (SPAn) is a biometric privacy technology that transforms biometric information into an anonymized form that preserves the ability to search and match biometrics, and to authenticate, verify, classify, and perform unique people counting, without revealing the identity of the individual concerned or allowing the extraction of personal characteristics from the biometric data. Traditional biometrics can permanently compromise users, whereas SPAn biometrics are anonymized, revocable, and reissuable, so there is a low or indiscernible risk of exploitation.

Many traditional biometric systems retain biometric data that link back to an individual or contain information that creates privacy and security risks if compromised. SPAn transforms biometric data into an anonymized form that retains only the information required for comparison and prevents original biometric information or personal characteristics from being extracted.  As well, traditional biometrics can represent a high level of risk because a breach can compromise a user permanently. In comparison, SPAn biometrics can be revoked and reissued, and if compromised, there is no viable risk of identifying the original biometric source.

Pseudonymization replaces identifiers with alternate values, but the resulting information can generally still be linked to an individual using additional information. Tokenization is a specific method used to achieve pseudonymization, so they are closely related. In comparison, SPAn is an anonymization approach. This means that the transformed biometric cannot be used to identify the original individual or biometric sample, nor to derive personal characteristics.

Homomorphic encryption allows computations to be performed on encrypted data without first decrypting it. The encrypted data remains protected, but someone with the appropriate key can still decrypt it. In comparison, SPAn is an anonymization approach that transforms biometric data into an anonymized form that supports biometric search and match without retaining the personally identifying information associated with conventional biometrics.

Sharding divides data into separate pieces and stores those pieces across different systems, locations, or databases. While this can reduce the risk of a single database being compromised, the underlying biometric data remains present across the shards and can be reconstructed when the pieces are combined. In comparison, SPAn transforms biometric data into an anonymized form that supports biometric search and match, preventing reconstruction of the original biometric or extraction of any personal characteristics.

Yes. Being able to search is a defining characteristic of Search-Preserving Anonymization. SPAn retains only the proximity information required for biometric comparison while removing information that could identify an individual or reveal personal characteristics from the original biometric.

Yes. SPAn can be applied to biometric systems that require comparison of biometric records, including facial recognition applications, which require search or match capabilities.

Yes. Search Preserving Anonymization (SPAn) is a privacy-preserving approach specifically designed for biometric data. SPAn preserves privacy by transforming an original biometric into an anonymized form that can no longer link back to the individual who provided the original biometric sample. SPAn requires optimal data minimization, retaining only the minimum amount of data required to perform biometric search and match.

SPAn can support a wide range of biometric applications, including authentication, verification, facial recognition, identity collaboration, digital identity programs, trusted credentials, trust ecosystems, age verification, and unique person counting. The objective is to preserve the operational benefits of biometric matching while reducing the privacy risks associated with retaining identifiable biometric data.

SPAn improves biometric privacy by minimizing the information retained in biometrics, transforming biometric data into an anonymized form, and supporting the revocation and reissue of transformed biometrics. This substantially reduces risks associated with data breaches, unauthorized access, insider misuse, and inappropriate use of biometric information.

No. SPAn is designed so that the transformed biometric does not contain the personally identifiable information associated with the original biometric.

SPAn is designed to prevent the transformed biometric from being used to re-identify the original individual or derive personal characteristics. This can substantially reduce re-identification risk compared with systems that do retain original biometric data or templates.

SPAn can reduce the impact of a biometric database breach by ensuring that stored and searchable biometric data is anonymized rather than using conventional and identifying biometric templates. An attacker who obtains the transformed SPAn biometric is not able to reconstruct the original biometric or extract personal characteristics from it.

Yes, SPAn is considered secure. SPAn improves the security and privacy of biometric data by preventing the transformed biometric from being reversed into the original biometric or being used to derive personal characteristics. SPAn satisfies the GDPR “motivated intruder” test (Recital 26), and unlike traditional biometrics, SPAn does not retain PII. This by itself addresses many security concerns.  SPAn also supports revocation and reissuance, allowing compromised biometric records to be replaced.  This maintains the trust life cycle, for example, when verifier organizations are newly authorized or access removed. Lastly, the ability to reissue biometric records can be used to remedy or add protection against known or future security concerns, including technologies such as quantum computing.

Yes. A key requirement of SPAn implementations, such as Attain Insight Intrinsic, is the ability to revoke and reissue anonymized biometric identifiers. This allows organizations to replace a biometric record when security concerns change, a verifier relationship changes, or additional protection is needed.

SPAn supports privacy principles such as data minimization, privacy by design, proportionality, and reducing the potential for re-identification. It can simplify aspects of privacy risk assessment by reducing the amount of identifiable biometric information retained. However, SPAn does not by itself make an organization compliant with a particular privacy law or regulation.

SPAn supports GDPR principles such as data minimization, privacy by design, proportionality, and protection against re-identification. SPAn is not, by itself, a guarantee of GDPR compliance. Compliance depends on what other data is collected, the purpose of processing, governance, security controls, and the organization’s legal basis for processing PII data, not just biometric data.

ISO/IEC 24745 addresses the protection of biometric information throughout its lifecycle. SPAn aligns with objectives of the standard by incorporating privacy protection, protection, data minimization, and the extent of protection against misuse that has been addressed by the proposed biometric solution.

ISO/IEC 30136 provides a framework for evaluating biometric protection mechanisms. SPAn requires non-reversible, and privacy-preserving biometric transformations.  Because SPAn requires non-reversible, revocable, data-minimized, and anonymized biometric transformations, it will directly address 75% to 80% of the core objectives outlined in the current 2018 ISO/IEC 30136 standard.

Yes. Search-Preserving Anonymization is a Privacy Enhancing Technology. This is because SPAn removes identifiable personal information from the transformed biometric, which enhances privacy while preserving the ability to perform biometric search and match functionality.

Yes. SPAn biometrics support trusted credential recovery and reissuance when a user loses access to a device or trusted credential. A biometric captured during enrollment can be converted into an anonymized (SPAn) biometric that is stored by the credential issuer or their service provider. During recovery, the user’s biometric can be matched against the stored SPAn biometric to verify the user’s identity and therefore their entitlement to recover or reissue the credential.

No, it is not necessary, but it is recommended. Most issuers will offer alternative identity proofing options that do not require biometrics. However, identity proofing must be strong, otherwise recovery/reissue is likely to be targeted for vulnerabilities by bad actors. Biometric verification can provide a fast, accurate, and potentially self-service way to verify that the person requesting recovery is the legitimate credential holder. Unlike SPAn, traditional biometrics often rely on retaining PII, which adds complexity, cost and risk, as well as public concern about the safety of personal biometric information.

A SPAn-based recovery process typically involves two stages:

1. During enrolment for the trusted credential, and after or during the identity proofing step, one or more biometric(s) are captured to support the recovery or reissue process. The biometric(s) are converted to a SPAn biometric for centralized storage and a later search/lookup at the time of recovery/reissue.
2. When a recovery/reissue request is received, a user will provide their biometric to assert their identity and confirm their right to recover/reissue. The biometric is matched to the SPAn biometric captured and stored during enrolment to complete identity proofing and entitlement to recover/reissue. In many cases, this process can be completed entirely through self-service.

For a trusted credential recovery use case, the SPAn biometric can be stored by the credential issuer . The main requirement is to store a privacy-preserving biometric that can be matched to verify the user’s identity and therefore their entitlement to recover or reissue a trusted credential.

The required assurance level is determined by the credential issuer and the requirements for the credential. The assurance level must be maintained throughout the entire enrollment process.

Yes. Maintaining chain of custody throughout enrollment and recovery is essential for trusted credentials. The issuer must be able to establish that the biometric and identity evidence used during enrollment and recovery belongs to the legitimate credential holder and that every identity, private key, and digital certificate remains authentic, uncompromised, and verifiable from initial creation through end use.

Yes. The credential issuer determines whether a trusted credential is device-bound. If a credential is restricted to one device, recovery can issue the credential to a new device while revoking the credential on the previous device, noting that digital wallets that offer built-in synchronization across devices will not synchronize trusted credentials that have a requirement for device-specific binding.

If the trusted credential is not device-bound, the issuer can determine whether the trusted credential may be used on multiple devices and how many devices are permitted. It is then optional for a user to revoke credentials on a prior or lost device (until any cap on the number of devices is reached).

The traditional centralized storage of biometrics poses a significant security and privacy risk, which is why such approaches are often considered unsuitable for commercial applications today. SPAn addresses this risk by changing what is stored and searched. Instead of retaining conventional biometrics linked to personal information, SPAn stores an anonymized biometric that cannot be used to reconstruct the original biometric, derive personal characteristics, or link biometric information to individuals.

SPAn reduces the potential impact of a breach by removing identifiable biometric information from the stored biometric information. An attacker who gains access to a SPAn database is not able to recover the original biometric data or derive personal characteristics.

Unlike traditional biometrics, the SPAn transformation removes identifiable biometric information so that what is stored is void of PII. This by itself addresses many security concerns because the stored information is not useful to a hacker. Also, by definition, SPAn supports the ability to cancel and reissue biometrics, which adds further protection against perceived threats or concerns.

Age verification and age assurance processes frequently use conventional biometric information to confirm who a person is before retrieving their age details or applying age assurance tests. SPAn, however, can verify that a person corresponds to an enrolled individual without knowing their actual identity, making it possible to complete age verification without using or storing conventional identifying biometric information. Importantly, SPAn allows biometric age assurance processes to occur at the same time as the age test is applied, whereas many systems only perform biometric verification at the time of enrollment making them vulnerable to fraud or misuse, for example, if another person has access to the device.

Yes and No. SPAn significantly reduces the risk of age assurance steps being exploited. SPAn does not perform age assurance itself but is highly complementary to age assurance processes. SPAn relies on anonymized biometric information to confirm who a person is before retrieving age details or initiating age assurance tests. Because SPAn preserves the ability to perform biometric search and match, it is highly suitable for supporting age assurance processes, and unlike many other approaches SPAn allows biometric identity proofing to occur at the same time as the age tests are applied, significantly reducing risk of the age assurance system being manipulated.

Yes. SPAn can support solutions in which different parties receive only the information they need to perform their role. For example, one service can verify that a person corresponds to an enrolled individual without knowing their actual identity and then provide their anonymized SPAn biometric to a second service that is able to apply the requested age test for that individual (i.e. double-blind age verification). SPAn-based age verification solutions store only anonymized biometric information and use biometrics to prove age information is for the same person who is being verified, whereas some systems only perform biometric verification at the time of enrollment, making them vulnerable to fraud or misuse, for example, if another person has access to the device.

Yes, SPAn requires that the transformed SPAn biometric cannot be used to derive secondary characteristics such as age, gender, ethnicity, or eye colour. This means a biometric system cannot be repurposed for demographic profiling.

Yes. SPAn can be applied to decentralized architectures in which biometric processing or storage occurs on a user’s device or at the edge. The device can perform authentication locally without storing a biometric that is vulnerable to permanent compromise.

Using SPAn to store biometrics on edge-computing devices provides a strong foundation for secure, privacy-first device authentication. Rather than relying on traditional biometric matching, which requires decrypting or processing sensitive raw biometric data, SPAn permanently transforms a biometric into a mathematically anonymized form. It retains only the spatial proximity or “closeness” information required to confirm that a live authentication attempt matches an enrolment record, without storing a biometric that is vulnerable to permanent compromise. Unlike a SPAn biometric, it can’t be revoked or reissued.

SPAn represents a significant and recent technical advancement in how centralized biometric databases can be secured, particularly against the “honeypot” risk. SPAn is defined by a set of criteria that guarantees data minimization and anonymization. Because SPAn is new, there is still considerable focus by professionals on older, traditional methods of cryptographic centralization or, alternatively, decentralization as a risk mitigation strategy. As privacy regulation, cybersecurity concerns, and public expectations around biometric data continue to evolve, there is increasing interest in approaches that build privacy protection directly into stored biometrics.

SPAn takes a different approach from encryption, decentralized storage, and conventional biometric template protection. Rather than relying only on controlling access to identifiable biometric templates, SPAn is designed to transform the biometric into an anonymized form while preserving the ability to search and match. SPAn can also be integrated into centralized, decentralized, edge, or hybrid architectures depending on the requirements of the application.

Organizations increasingly need to use biometrics for identity, authentication, security, public safety, digital identity, and other applications while addressing growing concerns about privacy and cybersecurity. SPAn provides an approach for making biometric anonymization part of the underlying architecture rather than relying exclusively on controls applied after biometric data has been collected which have risks, vulnerabilities and process management challenges.

Yes. Attain Insight offers licensing opportunities for organizations interested in integrating Search-Preserving Anonymization technology into biometric systems, digital identity platforms, privacy-enhancing technologies, trusted credentials, and other identity-related solutions.

Yes. Search-Preserving Anonymization (SPAn) prevents AI agents from obtaining personal biometric data and reduces the public anxiety associated with autonomous AI agents. As AI agents grow more capable of crawling the web, scanning environments, and autonomously executing transactions, they present significant threats to personal identity, privacy, and accountability. SPAn addresses these threats by mathematically altering the biometric templates so they cannot be used to identify an individual or to extract an individual’s characteristics.

No. SPAn biometrics do not include information that would identify an individual or provide characteristics about an individual such as age, gender, ethnicity, or eye colour. If AI agent(s) were to breach a database of SPAN biometrics, they would only find a sea of anonymized mathematical patterns. They cannot reverse engineer these into biometric traits or link them to real people. SPAn preserves the information needed for biometric comparison while removing information that links back to individuals.

Search Preserving Anonymization (SPAn) is designed to protect biometric templates by removing personally identifiable information (PII) while keeping enough mathematical “closeness” for data matching. For this reason, SPAn does not stop AI agents that break into trusted communication, but it will stop agents from being able to exploit a person’s sensitive biometric data. This is because there are no links to individuals retained or that support segmentation by trait or characteristic. This makes SPAn a significant impediment to AI agents that act with malicious intent or that overstep boundaries of privacy, policy, or regulation.

Yes, SPAn directly supports and complements the First Person/First Peoples Project. The First Person community-oriented approach relies on self-certifying decentralized identifiers (DIDs), verifiable relationship credentials (VRCs), and cryptographic proofs to authenticate peer-to-peer connections and establish relationships between people and organizations. SPAn adds a biometric method that verifies whether a person is the individual enrolled in the relationship, without storing sensitive, permanent, personally identifying biometric data. As a result, these approaches are highly complementary and bring the full value of their respective strengths when used together.

Yes, SPAn directly supports and is complementary to FIDO Passkeys by providing a more secure approach for the management of biometric information. FIDO Passkeys rely on the device operating system to collect and verify a PIN number or biometric(s) provided by the end user. If the PIN or biometric(s) match stored versions, then the operating system permits the private key to be accessed in order to establish the trusted connection using FIDO passkey’s cryptographic handshake of private/public key pairs.

SPAn is able to provide biometric verification without the operating system having to store personal and non-revocable biometric data, i.e. it is a more secure approach for the operating system to manage biometrics. While the FIDO passkey workflow offers protection from one set of attack vectors, such as man-in-the-middle attacks by never sending out a password that could be compromised, SPAn offers protection from a different set of threats, such as a biometric being exposed by a compromised local device.

SPAn is likely to become best practice for systems that utilize biometric information to match a user against a list of known individuals. As a privacy-preserving approach, SPAn offers several advantages over traditional methods, including stronger privacy protection, reduced data exposure, lower complexity and greater versatility.

SPAn does not require the retention of an individual’s original biometric information, which can significantly reduce the honeypot risk associated with centralized biometric databases. SPAn also supports revocability and the ability to reissue, which means SPAn biometrics are not permanent unlike traditional biometrics. As well, SPAn biometrics are mathematically more efficient than the encryption methods often used to protect traditional biometric data. Because of its characteristics, SPAn can help organizations address requirements in many standards and privacy frameworks. For example, SPAn represents optimal data minimization for the common purpose of searching and matching biometric samples. SPAn is an anonymization method which means it can be used to meet requirements of standards that require double-blind protections.

By reducing the need to retain conventional biometric data, SPAn can support both centralized and decentralized architectures equally, without making the choice of solution architecture solely on the basis of biometric data exposure, privacy or regulatory concerns.

Yes, SPAn indirectly supports AgeKey and the OpenAge initiative. SPAn and AgeKey solve different problems. AgeKey itself relies on FIDO2 passkeys to provide double-blind age verification. Because local device verification is explicitly considered as a core part of the FIDO specification, if SPAN is used for local verification, a more secure solution results. While the FIDO passkeys offer protection from one set of attack vectors, by never sending out a password that could be compromised, SPAn offers protection from a different set of threats, such as a biometric being exposed from a compromised local device.

Yes, SPAn can easily be combined with biometric systems that test for liveliness. Because liveliness testing and biometric matching address different parts of the biometric verification process, SPAn and liveness detection can be used together as complementary components of a biometric authentication verification solution.

Yes, SPAn can easily support temporary biometric requirements, for example, if a biometric is only permitted for use during a specific time period. This is possible because SPAn allows revoking of a biometric either on demand or after a set period of time.