Rules
Part of Why forced-choice lookalike quizzes feel so convincing
What uploading your own photo to a lookalike quiz actually hands over
Lookalike quizzes now ask for your own photograph. What an upload hands over, where the match score comes from, and who else is in the frame with you.
The part of the quiz format that changed most is not the questions. It is the transaction. Lookalike quizzes now frequently ask the player to supply a photograph, run a comparison on it, and return a result that reads like a measurement. What happens to that photograph afterward is the thing worth thinking about before the score is.
What to take away
- A quiz that asks you to upload a face is collecting a biometric-quality image, not a fun input.
- The output score comes from a system whose error rate is unknown to you and varies with the image and the subject.
- Illinois, Texas, Washington, California and the European Union all treat a face scan used to identify someone as regulated data, and none of them exempt entertainment.
- Consent for the person in the photograph is the part that is almost never present, especially in group shots.
- Anything a quiz tells you about resemblance is bounded by the same limits as any other comparison, and a number does not lift them.
What an upload actually hands over
A face-matching system wants a clear frontal face photo. A quiz request for one looks identical to an identification system's request. The player cannot see whether the image is discarded, stored, used for training, or tied to an account.
There are named examples of both ends of this. The selfie feature in the Google Arts & Culture app asks for a photograph of your face and returns a museum portrait as your lookalike, and the result is built to be shared. Face-search companies show where the same image can travel: Clearview AI built a searchable face database from photographs scraped off the web, and it has been sued under Illinois's biometric privacy law and investigated by European data protection authorities.
The honest questions before uploading are dull and short. Ask if there is a stated retention period, a deletion path that works, and whether the image is processed on the device or sent somewhere.
If a quiz does not answer those in plain words, assume the least favorable one. The retention question decides whether a lookalike quiz pair outlives the quiz that produced it.
There is a second consent problem that almost nobody raises. Uploading a photograph of yourself is your decision. Uploading a group photograph, a family picture or a picture of a child is a decision made on behalf of people who were not asked.
What the law says about a face photograph
A face image used to identify a person is regulated biometric data in several places that apply to US users today. The Illinois Biometric Information Privacy Act (BIPA) requires a private entity to give written notice and obtain a written release before collecting a face scan, to publish a retention and deletion schedule, and not to sell or profit from the data; Illinois users enforce it themselves through a private right of action. Texas's Capture or Use of Biometric Identifier Act (CUBI) and Washington's biometric law, RCW 19.375, both bar capturing a biometric identifier for a commercial purpose without notice and consent, and both are enforced by the state attorney general.
Outside the US the same image may fall under Article 9 of the GDPR, which treats biometric data used for identification as a special category needing explicit consent and is enforced by national data protection authorities. In California, biometric information counts as sensitive personal information under the CCPA, enforced by the California Privacy Protection Agency and the state attorney general. Deceptive claims about what a quiz does with a photo fall to the Federal Trade Commission, and a complaint to the FTC or to a state attorney general is the route a consumer actually has.
Entertainment is not an exemption in any of these laws. A quiz that collects an Illinois user's face scan without a written release runs into BIPA whether it calls the feature a match, a score or a game, and the quiz's own privacy policy is the document that is supposed to answer the retention and deletion questions.
What the score is coming from
Face-matching systems return a similarity value, and a value is not a verdict. The technology compares a probe image against stored templates and reports a distance, and that distance depends on the image quality, the pose, the lighting and the demographics of the data the system was built from.
The National Institute of Standards and Technology has measured this on a large scale. Its Face Recognition Vendor Test (NIST FRVT), the government evaluation of commercial face-recognition systems, found error rates that differed by demographic group, with some groups seeing far more false matches than others. The same score does not carry the same meaning for every person who receives it.
A consumer quiz will not tell you which system it used, what threshold it applied, or what its measured error rate is.
What has not changed at all
The underlying limits are exactly as they were. Two images under unknown conditions do not settle whether two people resemble each other. Adding a number to the output changes presentation, not evidence.
Why a machine score does not settle the question is the same reason an impression does not: the two photographs were taken under conditions nobody recorded, and the system that compared them has not been named.
If anything, the automated version is more misleading, because a number reads as a measurement while an impression reads as an impression. A player who would have discounted their own hunch will not discount a percentage.
A short checklist before playing
| Ask | Why |
|---|---|
| Does it need my photograph at all? | Many formats work without one, and the ones that do not are asking for something |
| Whose faces are in the image? | Anyone else in the frame did not agree to this |
| Is there a written retention and deletion policy? | Absence is an answer |
| Does it name a real person as my match? | That is a published pairing with your face attached to it |
| Does it report any uncertainty? | A single number with no range is a presentation, not a result |
The fourth row matters more than it looks. A quiz that tells you which public figure you resemble has generated a pairing involving you and someone who never agreed to be in it, and that output is designed to be shared. The reasoning behind refusing to publish such pairings applies to automatically generated ones as much as to submitted ones.
Before you upload a face
- Does it need my photograph at all?
- Whose faces are in the image?
- Is there a written retention and deletion policy?
- Does it name a real person as my match?
- Does it report any uncertainty?
What is worth playing
Formats that use unfamiliar faces, ask same-or-different rather than who-is-this, and report a chance baseline. Those measure something. Everything else is a picture game, which is fine as long as nobody mistakes the result for information about a face.
Common questions
Is an on-device comparison safer than an uploaded one?
Materially, yes, if it genuinely runs on the device. Whether it does is usually not something a player can verify.
Does a high match percentage mean anything?
It means one system, on those two images, at that threshold, returned a high value. Change the images and it changes.
Should I let a quiz use a photograph of my family?
That is a decision for each person in the photograph, and most of them were not asked.
