Prohibited AI Practices Under the EU AI Act: Inferring Sensitive Characteristics From Biometrics

The EU AI Act is a risk-based regulatory framework, but some practices are considered unacceptable and are prohibited outright.

This article examines the prohibition on biometric categorization used to infer specified sensitive characteristics, drawing on the Commission’s final July 29, 2025 Guidelines on prohibited artificial intelligence practices. These guidelines superseded the February 2025 draft and provide the detailed examples discussed below.

For an overview of all prohibited practices, see Prohibited AI Practices Under the EU AI Act: Where Europe Draws the Line.

Inferring Sensitive Characteristics From Biometrics Under Article 5(1)(g)

Article 5(1)(g) prohibits placing on the market, putting into service for this specific purpose, or using biometric categorization systems that individually categorize people from their biometric data to deduce or infer specified sensitive characteristics.

The prohibition protects human dignity, privacy and non-discrimination. Biometric information can reveal—or purport to reveal—sensitive characteristics without a person’s knowledge. Assigning people to categories on that basis can expose them to unfair or discriminatory treatment, such as denying a service because of their assumed race.

Commission Guidelines, §§ 8–8.1, paras. 271–272.

Four cumulative conditions must be satisfied:

1. The practice involves placing on the market, putting into service for this specific purpose, or using an AI system (see, Prohibited AI Practices Under the EU AI Act: Where Europe Draws the Line sub-title "What Conduct Does Article 5 Regulate?")
2. The system is a biometric categorization system.
3. Natural persons are individually categorized based on their biometric data.
4. Its objective is to deduce or infer race, political opinions, trade-union membership, religious or philosophical beliefs, sex life or sexual orientation.

The prohibition applies to providers and deployers within their respective responsibilities. It expressly excludes certain labeling or filtering of lawfully acquired biometric datasets, including in law enforcement, as explained below.

Commission Guidelines, § 8.2, paras. 273–275.

No significant-harm threshold:

Unlike Article 5(1)(a) and (b) (harmful manipulation and deception and exploitation of vulnerabilities), this provision does not require material behavioral distortion or actual or likely significant harm. Nor does it require proof that someone was denied a service or otherwise disadvantaged. The prohibited categorization itself is the relevant practice when all conditions are met.

• For more on the prohibitions on harmful manipulation and deception and exploitation of vulnerabilities see: Prohibited AI Practices Under the EU AI Act: When AI Persuasion Becomes Prohibited Manipulation and Prohibited AI Practices Under the EU AI Act: When AI Exploits Vulnerability.

Commission Guidelines, § 8.2, paras. 273–274; Article 5(1)(g).

1. A Biometric Categorization System

Definition

Article 3(40) defines a biometric categorization system as an AI system that assigns natural persons to specific categories based on their biometric data, subject to a narrow exclusion for features ancillary to another commercial service and strictly necessary for objective technical reasons.

• Categorization assigns someone to a group with a particular characteristic. It differs from identifying a person or verifying their identity. An advertising display that selects advertisements according to a viewer’s estimated age or gender illustrates categorization, although those attributes alone do not meet Article 5(1)(g)’s sensitive-characteristic condition.
• The AI Act’s biometric-data definition is broader than the GDPR definition under Article 4(14): unique identification is not required. For more on what is Personal Data under the GDPR, see What is ‘personal data’ under EU data protection law?

Commission Guidelines, § 8.2.1, paras. 276–277.

1.(a) The Biometric Basis

Biometric inputs may include facial features, skin color, DNA or behavioral characteristics such as keystroke patterns and gait.

• The Commission excludes categorization based on clothing, accessories such as scarves or crosses, or social-media activity from the definition of biometric categorization. The relevant distinction is the basis of the inference. Analyzing biometric features in photographs posted online differs from analyzing someone’s posts or accessories.

Commission Guidelines, § 8.2.1, paras. 277–278; § 7.2.1(d), paras. 250–252 and footnote 160.

Example: Inferring religious orientation from facial features or tattoos can fall within the prohibition. Categorizing someone from a cross worn as an accessory lacks the biometric basis identified by the Commission, although other laws may still apply.

Commission Guidelines, § 8.2.1, para. 277; § 8.2.3, para. 283.

Practice Tip: Trace each inferred attribute to its inputs. A photograph can contain biometric features and non-biometric context; the fact that an inference comes from an image does not settle the analysis.

1.(b) The Ancillary Commercial Features Exclusion

Two conditions must be met to fall outside the biometric-categorization definition:

1. the feature must be ancillary to another commercial service and
2. strictly necessary for objective technical reasons.

Under Recital 16, an ancillary feature is intrinsically linked to the principal service and cannot, for objective technical reasons, be used without it.

Commission Guidelines, § 8.2.1, paras. 279–280.

The Commission identifies features that may qualify:

• Online-marketplace filters categorizing facial or bodily features so consumers can preview products on themselves.
• Social-network filters categorizing facial or bodily features so users can add or modify photographs or videos as part of the content-sharing service.

These examples depend on the statutory conditions; they do not exempt every integrated filter or commercial feature.

The Commission contrasts them with prohibited targeting:

• A social-media system infers users’ political orientation from biometric data in uploaded photographs and sends targeted political messages.
• A system infers sexual orientation from users’ photographs and serves advertisements on that basis.

Even if ancillary to advertising, those inferences are not strictly necessary for objective technical reasons.

Commission Guidelines, § 8.2.1, para. 280.

Practice Tip: Distinguish technical necessity from commercial usefulness. Embedding sensitive biometric inference in an advertising service does not make it necessary or exempt.

2. Individually Categorizing Natural Persons

The prohibition requires individual categorization from biometric data. The Commission distinguishes this from categorizing a group as a whole without examining individuals.

• Individual categorization can include estimating demographic attributes from faces, height, skin, eye or hair color, or singling people out by a scar or tattoo. Those operations meet only part of the test: the remaining conditions, including inference of a listed sensitive characteristic, must also be satisfied.

Commission Guidelines, § 8.2.2, paras. 281–282.

Names and identity matching are unnecessary: People may be categorized for statistical purposes without being identified and without any objective of identifying them. An anonymous demographic count can therefore involve individual biometric categorization, even if it does not necessarily infer an attribute prohibited by Article 5(1)(g).

Commission Guidelines, § 8.2.1, para. 276; § 8.2.2, para. 282.

Practice Tip: Examine how aggregate results are produced. Counting people after classifying each individual is different from categorizing a group without examining its members. Removing names or displaying only totals does not resolve the individual-categorization condition.

3. With The Objective Of Inferring the Listed Sensitive Characteristics

Article 5(1)(g) covers a specific list:

• race;
• political opinions;
• trade-union membership;
• religious or philosophical beliefs;
• sex life; and sexual orientation.

This is not a prohibition on all biometric categorization or an incorporation of every special category of personal data under Article 9 GDPR. Unlike Article 9, Article 5(1)(g) does not expressly list ethnic origin, health or genetic data, or biometric data for the purpose of uniquely identifying a natural person. The EU AI Act only targets individual biometric categorization used to infer the specific attributes listed above. Age or gender estimation and categorization by skin or eye color do not, by themselves, meet that condition. These practices may nevertheless be subject to GDPR protections, the AI Act’s high-risk requirements or other applicable rules.

Commission Guidelines, § 8.2.3, para. 283; § 8.4, para. 287.

Examples: Systems that claim to deduce race from voice or religious orientation from tattoos or faces are prohibited. Systems categorizing skin or eye color or analyzing crime victims’ DNA in relation to their origin are outside of the prohibition.

• These distinctions concern the particular inference and context. They do not establish that any use of skin color, tattoos, voice or DNA is automatically permissible. The social-media examples above illustrate how biometric inputs become prohibited when used to infer political opinions or sexual orientation.

Commission Guidelines, § 8.2.3, para. 283; § 8.2.1, para. 280.

Practice Tips: (1) Claimed (not actual) capability triggers the prohibition. Providers should not assume that questionable scientific validity of the classification removes a system from the prohibition. (2) Review the meaning of the output, including scores or audience segments. A label such as “audience affinity” does not change an inference that assigns individuals a presumed political opinion or sexual orientation from biometric data.

Lawful Dataset Labeling and Filtering Exclusion

Article 5(1)(g) expressly excludes labeling or filtering lawfully acquired biometric datasets, such as images, based on biometric data, and addresses biometric categorization in law enforcement. The Commission explains this carve-out through dataset-processing examples, including bias prevention, medical diagnosis and investigative work.

Commission Guidelines, § 8.3, paras. 284–286; Recital 30.

(a) Representative Data and Medical Uses

Labeling may help assess whether training data adequately represent demographic groups and prevent a model from reproducing historical or collection bias. The Commission notes that some labeling operations may even be needed to meet the Act’s high-risk requirements.

• Its examples include labeling data to prevent an ethnic group from being disadvantaged by a recruitment algorithm trained on biased outcomes, and categorizing patient images by skin or eye color to support medical diagnosis, such as cancer diagnosis.

Commission Guidelines, § 8.3, para. 285.

Practice Tip: Document the dataset purpose and lawful acquisition. Distinguish labeling to assess representation or reduce bias from using biometric data to infer sensitive traits for decisions or targeting concerning individuals.

(b) Law-Enforcement Dataset Processing

The Commission gives the example of lawfully acquired datasets suspected of containing child sexual abuse material. AI may help detect and redact sensitive information, then label or filter images by age, gender, eye or hair color, scars or markings to identify victims or connect cases. Filtering images of abusers’ hands by finger length, markings or tattoos may also assist identification of suspects.

• These examples concern permitted dataset operations. Law-enforcement status does not provide a general exemption for inferring the listed sensitive characteristics from individuals’ biometric data.

Commission Guidelines, § 8.3, para. 286; § 8.4, para. 288.

NOTE ON OTHER REQUIREMENTS: Falling outside Article 5(1)(g) does not establish overall lawfulness. Biometric categorization according to sensitive or protected attributes may qualify as high-risk under Article 6(2) and Annex III, point 1(b). Applicable data-protection law—including the GDPR, the Law Enforcement Directive and the EU institutions’ data-protection regulation—continues to apply. The Commission also connects the prohibition with Article 11(3) of the Law Enforcement Directive, which prohibits profiling that produces discrimination based on special categories of personal data.

Commission Guidelines, § 8.4, paras. 287–288.

Practice Takeaway: Assess the biometric input, individual categorization and inferred attribute together. Identity matching and proof of downstream harm are unnecessary. The commercial-feature exclusion requires both ancillary status and objective technical necessity; the dataset carve-out concerns lawful labeling and filtering, not a general permission to infer sensitive traits for targeting or treatment of individuals.

Other Resources and Recommended Reading

• EU AI Act — Sensitive Biometric Categorization — Article 5(1)(g) lists the prohibited inferences and exclusions. Recital 30 explains the prohibition and lawful dataset labeling or filtering / Articles 3(34) and 3(40) define biometric data and biometric categorization. Recital 16 discusses categories and ancillary functionality.
• EU AI Act — Other Biometric-Categorization Requirements — Article 6 and Annex III, point 1(b), address high-risk categorization; Article 50(3) addresses transparency. See recitals 54 and 132.
• European Commission — Guidelines on Prohibited AI Practices — Explains individual categorization, biometric inputs, listed sensitive characteristics and the scope of exclusions. See § 8, paragraphs 271–288.
• General Data Protection Regulation — Special Categories — Articles 4(14) and 9 distinguish biometric identification and the broader special-category list. See recital 51.
• Law Enforcement Directive — Articles 10 and 11 address sensitive-data processing and automated decisions; recital 38 discusses discriminatory profiling. An AI Act exclusion does not displace these safeguards.
• EU Institutions Data Protection Regulation — Regulation (EU) 2018/1725, Article 10 and recital 29, addresses special categories of data processed by EU institutions.

Related The De La Torre Review Articles

• Prohibited AI Practices Under the EU AI Act: Where Europe Draws the Line — Explains the wider prohibited-practices framework and the conduct covered by Article 5. Read the Article.
• Prohibited AI Practices Under the EU AI Act: When AI Persuasion Becomes Prohibited Manipulation — Explains the elements separating persuasion from prohibited harmful manipulation and deception. Read the Article.
• Prohibited AI Practices Under the EU AI Act: When AI Exploits Vulnerability — Examines exploitation linked to age, disability and social or economic circumstances, including the requirements of behavioral distortion and significant harm. Read the Article.
• Prohibited AI Practices Under the EU AI Act: The Social Scoring Ban — Explains when evaluations of behavior or personal characteristics lead to prohibited adverse treatment and how social scoring differs from legitimate assessments. Read the Article.
• Prohibited AI Practices Under the EU AI Act: Limits on Crime Prediction — Examines the prohibition on predicting individual criminal conduct based solely on profiling or personal characteristics and the exception for supporting human assessments grounded in objective, verifiable facts. Read the Article.
• Prohibited AI Practices Under the EU AI Act: Facial-Recognition — Explains the ban on untargeted scraping of facial images from the internet or CCTV footage to create or expand facial-recognition databases. Read the Article.
• Prohibited AI Practices Under the EU AI Act: Emotion Recognition at Work and School — Examines prohibited emotional inferences from biometric data in workplaces and educational institutions, including the medical and safety exceptions. Read the Article.
• Prohibited AI Practices Under the EU AI Act: Real-Time Remote Biometric Identification — Explains the conditions, exceptions and safeguards governing real-time biometric identification in publicly accessible spaces for law-enforcement purposes. Read the Article.
• Prohibited AI Practices Under the EU AI Act: Non Consensual Intimate Material and Child Sexual Abuse — Examines the new Digital Omnibus prohibitions on generating or manipulating non-consensual intimate material or child sexual abuse material, including provider safeguards and deployer responsibilities. Read the Article.