Does a fingerprint or face scan prove someone is eligible to vote?

No. A fingerprint or face scan on a phone only unlocks the device or an authenticator stored on it, such as a passkey; it shows that the person holding the phone can unlock it, not that they are legally eligible to vote. Eligibility is a separate legal question decided by a registration authority under the law of a jurisdiction. My Vote Forward collects no biometric data, and nothing in its demo marks anyone as eligible or registered.

The objection in its strongest form

The objection, put strongly, is that modern phones make it look as if identity is solved. A person’s face or finger unlocks banking, payments, and government apps. A voting or participation system that uses the same unlock gesture invites people to believe it has verified who they are and whether they may vote. If a framework ever describes its sign-in as “secure” or “verified,” critics argue, it will be heard as a claim about eligibility, and that misunderstanding could be exploited by anyone who wants to claim a result was cast only by eligible voters.

A second form of the objection runs the other way. If biometrics cannot establish eligibility, critics ask, what can, at a distance? Remote systems must link a person to a registration record somehow. If the answer is “a government-issued digital identity,” then the framework depends on infrastructure most jurisdictions do not have. If the answer is “documents uploaded to the operator,” the operator becomes a store of sensitive identity data. Either way, the critic says, remote participation that claims to count only eligible people rests on an unsolved problem.

Why the objection matters

The objection matters because confusing authentication with eligibility can produce two opposite harms. It can make an opt-in result look like it came from verified voters when it did not, lending false authority to the result. And it can lead to designs that collect biometric or identity data that no educational or demonstration project should hold. My Vote Forward’s credibility depends on keeping these layers distinct in what it says and what it builds.

Defined terms

• Identity proofing: establishing that a person is who they claim to be, usually against documents or authoritative records.
• Authentication: confirming that the person signing in controls a credential previously linked to an account.
• Eligibility: whether a person meets the legal requirements to vote in a particular election, such as citizenship, age, and residence.
• Registration: the official record, held by an election authority, that a person is eligible and enrolled.
• Passkey: a phishing-resistant credential stored on a device and unlocked locally by a biometric, PIN, or device password.

Evidence

What NIST says about biometrics. The National Institute of Standards and Technology’s digital identity guidelines state that “Biometric characteristics do not constitute secrets” and that “A biometric characteristic is not recognized as an authenticator by itself”.⁠¹ They require that “Biometrics SHALL only be used as part of multi-factor authentication with a physical authenticator”.⁠¹ They also set performance requirements: a false match rate of “one in 10000 or better for all demographic groups” and presentation attack detection for facial recognition.⁠¹ These rules concern authentication assurance. They say nothing about voting eligibility, and they are not approvals of any voting system.

What a passkey does. The FIDO Alliance, which publishes the passkey standards, explains that the user approves a sign-in “with the same biometric or PIN or on-device password that the user has to unlock their device,” and that “Biometric information and processing continues to stay on the device and is never sent to any remote server”.⁠² A passkey proves control of a device-held key. It does not carry legal attributes such as citizenship or age.

What eligibility requires, United States. The U.S. government’s voter information page lists the requirements to vote in federal elections: being a U.S. citizen, being 18 years old on or before Election Day, meeting the state’s residency requirements, and being registered by the state’s deadline, with the note that North Dakota does not require registration.⁠³ Federal law requires each state to maintain “a single, uniform, official, centralized, interactive computerized statewide voter registration list,” and generally requires a registration applicant to provide a driver’s license number or “the last 4 digits of the applicant’s social security number”.⁠⁴ Eligibility is established and recorded by the state, not by a device.

A national digital identity, Estonia. Estonia’s internet voting requires “an ID-card, Mobile-ID, Smart-ID, or digital identity document with valid certificates and PIN codes”.⁠⁵ The identity layer is a state-issued credential with certificates and PIN codes, not a phone’s biometric unlock. Estonia also states that “Transfer of ID-card and its codes is prohibited”,⁠⁶ which acknowledges that a credential proves control, not that the rightful person is the one using it.

A large biometric identity that is not proof of citizenship, India. Under India’s Aadhaar Act, 2016, “Every resident shall be entitled to obtain an Aadhaar number by submitting his demographic information and biometric information”.⁠⁷ Section 9 of the same Act provides that the Aadhaar number or its authentication “shall not, by itself, confer any right of, or be proof of, citizenship or domicile”.⁠⁷ The law ties enrollment to residence and states in plain terms that a biometric identity at national scale is not, by itself, proof of citizenship.

How comparable systems have handled it

The examples show three separate layers that working systems keep apart. A registration authority decides eligibility under law (United States,⁠^3,4). A state-issued credential links a person to that record for remote use (Estonia⁠⁵). A device-level unlock, biometric or not, protects the credential on a phone (passkeys⁠² NIST.⁠¹). Even a national biometric identity, as in India, is kept legally distinct from citizenship⁠⁷ No comparable system treats a phone’s biometric unlock as proof of eligibility.

Competing interpretations

One interpretation holds that strong authentication plus a link to an official registration record is enough for remote participation, and that the remaining risks are manageable. Estonia’s internet voting is an example of this approach, with its own safeguards such as the ability to vote again (see can a household coerce a remote voter?).

A second interpretation holds that no remote identity chain can confirm that the eligible person, acting freely, is the one using the credential at the moment of voting. On this view, authentication strength is beside the point; the gap is between “this credential was used” and “this eligible person chose freely.”

A third interpretation focuses on privacy. Linking every participation event to a government identity creates a record that could be misused, and collecting biometrics centrally creates a target. On this view, the safest design collects as little identity data as possible and accepts weaker claims about who took part.

What the framework answers

My Vote Forward’s rules are:

• The educational website requires no account and collects no identity or eligibility data (see identity and registration).
• The demo authenticates accounts with passkeys where supported, and an authenticated demo account is not a verified voter and does not prove residence (see identity and registration).
• The demo collects no birth date, home address, government ID, biometric sample, citizenship document, or video proof.
• Registration stays with the election authority. The demo can link to official registration processes; it never marks anyone registered (see identity and registration).
• Any future official layer would need identity proofing at an assurance level set by the authority, eligibility determined by the authority, and identity data kept separate from ballot data (see hardware and security).

Where the objection still wins

The objection’s second form wins: the framework has no answer to remote eligibility. It does not have, and does not propose, an identity chain that links a remote participant to an official registration record. Without one, any future official remote use would depend on infrastructure the framework does not control. The first form wins in part, too: the framework cannot stop others from describing passkey sign-in as “verified,” even though the framework does not.

Unresolved questions

• Could a future official remote system link to registration records without creating a new store of identity data?
• What assurance level would an authority require, and who would perform identity proofing?
• How should duplicate counting across remote, mail, and in-person channels be prevented in practice?
• How could eligibility be confirmed for people without the documents or devices a digital identity requires?

Related

• Identity and registration
• Hardware
• Security
• Can a household coerce a remote voter?
• Is this an official voting service?
• Hard questions