We cannot identify the visitor and that is the point

A datasheet says 1080p. A privacy page says the device does not identify passing visitors. Only one of those sentences is enforceable, and it is not the one on the privacy page. Face recognition distance at 1080p is settled by geometry before any policy is written, and the number it produces is smaller than most people assume.

There is a whole industry that runs this calculation. Security integrators size cameras by pixels-per-face every day, and they do it to push the identification range out as far as the budget allows. The same arithmetic run in the opposite direction produces something more useful for a trade show booth: a hard ceiling on who the hardware can ever recognise, set in glass and sensor rather than in a settings screen.

What sets face recognition distance

Face recognition distance is the greatest range at which a camera still resolves enough pixels across a face for an embedding model to attach an identity to it. It is not a property of the brand, the processor, or the software. It follows from three numbers: horizontal resolution, horizontal field of view, and the 16-centimetre width of an adult face. The threshold those numbers have to clear is not a matter of opinion either. Quinn and Grother measured it for NIST in 2011, in Performance of Face Recognition Algorithms on Compressed Images, and concluded that images “should be tokenized to no less than 96 pixels between the eyes to ensure optimal recognition accuracy” — stricter than the ISO/IEC 19794-5 requirement of 60 — while distances above 96 pixels “provide no perceivable benefit”. That gives the arithmetic below a fixed target to aim at.

Those three numbers fix an angular scale in pixels per degree. A 1920-pixel-wide sensor behind a 120-degree lens gives 16 pixels per degree. A face 16 centimetres wide subtends about 9.1 degrees at one metre, 6.1 degrees at 1.5 metres, and 3.1 degrees at three metres. Multiply through and the face is 146 pixels wide at one metre and 49 pixels at three. Detection, deciding a face is present at all, needs 20 to 30 pixels. Identification, matching that face to a stored embedding, needs closer to 100. The gap between those two thresholds is where a privacy guarantee can live.

Everything below is arithmetic that sets a hardware requirement. None of it is a measurement of a built device, because there is no built device to measure.

The arithmetic, and the script that produces it

Two functions do all the work. One converts a resolution, a field of view and a distance into pixels across a face. The other inverts it, returning the greatest distance at which a face still spans a target pixel width. Both use the standard library only, so any reader can paste them into a Python prompt and change the assumptions.

import math

FACE_W = 0.16  # adult face width, metres

def face_px(hres, hfov, d):
    """Pixels across a face of width FACE_W at distance d."""
    return math.degrees(2 * math.atan(FACE_W / 2 / d)) * (hres / hfov)

def dist_for_px(hres, hfov, px):
    """Greatest distance at which a face still spans px pixels."""
    deg = px / (hres / hfov)
    return FACE_W / 2 / math.tan(math.radians(deg) / 2)

# detection 25px / identification floor 80px / identification target 100px
for hres, hfov in [(1280, 120), (1920, 120), (1920, 90), (2560, 120), (3840, 120)]:
    print(hres, hfov, [round(dist_for_px(hres, hfov, p), 1) for p in (25, 80, 100)])

Run forward, the pixel budget looks like this.

Run backwards, the same numbers become distances, which is the form a booth layout needs.

At 1080p across 120 degrees, identification holds to about 1.5 metres and detection reaches 5.9. The device knows a person is standing at three metres. It has no way to know which person.

Why 720p is disqualified

720p fails the requirement, not the budget. At 1280 pixels across 120 degrees, the 100-pixel identification target arrives at 1.0 metre and the 80-pixel floor at 1.2 metres. A consultation table is wider than that, so the staffer across it falls outside the range the system exists to cover.

The temptation is real, because 720p is cheaper in every direction at once. It halves the pixel rate the encoder has to sustain, cuts storage per show day, and shortens every transfer. Vendor documentation quotes storage figures at 720p for exactly that reason. Those figures are useful for sizing a card and useless for choosing a capture profile.

The decision that follows is worth stating as a rule, because it is the opposite of how spec sheets are normally trimmed. When storage runs short, the bitrate comes down and the framerate comes down. The resolution does not move. Bitrate and framerate are recoverable trade-offs against file size; resolution is the thing the recognition requirement is derived from, and dropping it silently moves the identification ceiling inside the table. This is the same reasoning that decides what to record at and what to run inference at, where the safe direction is to record high and sample low.

What the number means for a person standing two metres away

At two metres a face spans 73 pixels at 1080p and 120 degrees, above the detection threshold and below the 80-pixel identification floor. The system registers a presence at that range: someone standing roughly there, for roughly that long. It cannot say who, and no processing recovers what the sensor never sampled.

Translate that into booth geometry. A staffer seated across a consultation table sits inside 1.5 metres, so identity attribution works where the design needs it and where the person has an employment relationship with whoever deployed the device. A visitor browsing the aisle stands at two to three metres and registers as a body in a position. Someone walking past at four metres is barely a detection.

The boundary lands where a privacy argument wants it, which is a coincidence worth being honest about. Nobody designed the width of a human face or the arctangent. The design decision was to pick the resolution that puts the boundary at the table edge and then refuse to raise it. Raising it later is not a firmware update. Recognising returning visitors would require 1440p or a narrower field, and that is a specification change with a cost, an encoder consequence, and a new privacy conversation attached. The limit stays because moving it is expensive and because we would rather not.

A promise your optics keep for you

A written commitment not to identify visitors depends on whoever holds the pen. Policies get rewritten, a new owner inherits the right to revise them, and enforcement arrives years after the floor is swept. An optical ceiling has none of those properties. At 73 pixels, identification is not withheld by a rule. It is unavailable.

This is why the limit belongs in marketing copy as a feature rather than in a footnote as a constraint. The security-camera industry publishes the same tables to answer the question “how far out can we identify someone”, and every number in them is a maximum to be pushed. Reading the table for its minimum inverts the purpose without changing a single value. The most credible privacy claim available to any capture device is the one where the mechanism, not the intention, does the enforcing.

It pairs with the other rule we have written into hardware rather than into a document. The recording indicator has no off switch, because minimum brightness and blink are held in firmware where the app cannot reach them. Both choices share a shape: take the thing a policy would promise and move it somewhere a policy cannot revise. Notice and identification limits are also the two questions that booth recording law asks in every jurisdiction, in different words and with different remedies.

The cost is symmetrical and worth naming. A device that could identify everyone in the aisle would be a better analytics product, and several buyers would prefer it. That version cannot be built here without discarding the argument, in the same way that covering the hallway would require a wearable and the hallway therefore stays uncovered.

Where this calculation is optimistic

Every figure above is optimistic, and the design note it comes from says so in its own appendix. The pixel budget assumes an ideal rectilinear projection in which every degree of field maps to the same number of pixels. Real wide-angle lenses do not behave that way, and the error runs in one direction only: worse than calculated, never better.

Two effects do the damage. A 120-degree lens reaches that field by compressing the edges, so a face at the periphery covers fewer pixels than the flat pixels-per-degree figure predicts, and it arrives geometrically distorted, which costs an alignment step accuracy before the embedding is even computed. Separately, lens MTF falls off away from the optical axis, so those edge pixels carry less real detail than centre pixels of the same count. A face resolved at a nominal 98 pixels near the frame edge is not the equal of 98 pixels dead centre.

The consequence for the table is direct. The 1.5-metre identification figure is a centre-of-frame number. Toward the edges the usable distance shrinks by an amount this arithmetic cannot predict, because it depends on the specific lens, its distortion profile, and how well the correction handles the corners. Sensor noise at booth lighting levels pulls the same way.

Nothing here should be read as a specification until it has been corrected by measurement with the actual lens. Published as-is, the number is a ceiling that the physical build will sit under, which is the safe direction for a privacy claim and the unsafe direction for a capability claim. The honest reading is that identification is unavailable beyond roughly 1.5 metres and may be unavailable somewhat closer than that.

What we still have to measure

The unmeasured list is short and specific. Face pixels across the real frame, centre to corner, with the lens that ships. Identification accuracy at 1.5 metres under exhibition-hall lighting. Whether three simultaneous 1080p30 encodes hold under sustained load, which a datasheet’s single-stream maximum does not answer. None of these has a number yet.

Publishing a calculation before a measurement is defensible in exactly one direction. A requirement says what the hardware must not get wrong; a performance figure says how well the finished thing works. The tables above are the first kind, which is the same distinction that governs what we will and will not claim about separating two conversations, where no accuracy figure exists either. Where a claim would need a measurement we have not taken, the note field stays empty on purpose.

The design that comes out of it is narrow and mostly made of refusals. A camera on the counter, aimed across the table, that resolves the people who work there and stops resolving anyone else about where the table ends. Nobody wears it, nobody switches it on, and the visitor two metres away is a presence, never a name.