New Zealand has long been recognized as a global leader in privacy protection. The Privacy Act 2020, which replaced the 1993 Privacy Act, modernized the country's framework to address contemporary data challenges, including the rise of biometric technologies. The national supervisory authority is the Office of the Privacy Commissioner (OPC). New Zealand is not a member of the European Union, but its privacy framework has been deemed adequate by the EU, meaning personal data can flow freely between New Zealand and the EEA. New Zealanders are heavy users of social media platforms like Facebook, Instagram, and Trade Me, the country's dominant online marketplace. Whether you are verifying an online date, investigating a suspicious seller on Trade Me, or protecting your own photographs from impersonators, understanding New Zealand privacy law is essential before using any face search engine. For a comparison with another Commonwealth nation, see our guide to face search in Australia.
Face Search in New Zealand Overview
Face search allows you to upload a photograph to a face search engine and receive a list of public web pages where the same face appears. In New Zealand, this technology is used for identity verification, dating safety, marketplace fraud prevention, and personal image protection. Under the Privacy Act 2020, biometric information — including facial images used for identification — is not classified as a separate special category in the way it is under the GDPR. Instead, it is covered by the Act's 13 Information Privacy Principles (IPPs), which govern the collection, use, disclosure, and storage of personal information. The OPC has issued specific guidance on biometrics, emphasizing that agencies must collect biometric information only when it is necessary for a lawful purpose, must be transparent about the collection, and must not retain it longer than necessary. To understand the underlying technology, read our complete guide to facial recognition.
The OPC and New Zealand Enforcement
The OPC is New Zealand's independent privacy regulator. Under the Privacy Act 2020, the Commissioner has enhanced enforcement powers, including the ability to issue compliance notices, launch own-motion investigations, and issue binding decisions in complaints. The OPC can also refer matters to the Human Rights Review Tribunal, which can award damages of up to 350,000 New Zealand dollars. The OPC has been active in the biometrics space, publishing a dedicated biometrics guidance that sets out expectations for agencies collecting and using biometric information. The guidance stresses that biometric collection must be proportionate, that less intrusive alternatives should be considered first, and that individuals must be informed when their biometric information is being collected. The OPC has also warned about the risks of public-facing face search tools that build permanent biometric databases, noting that such practices may breach the storage and security principles of the Act.
The Privacy Act 2020 and Its Key Principles
The Privacy Act 2020 is built around 13 Information Privacy Principles (IPPs) that apply to agencies — a broad term that includes businesses, government departments, and most organizations. The principles most relevant to face search are IPP 1 (purpose: collect only for a lawful purpose), IPP 3 (collection from the individual: collect directly unless impractical), IPP 10 (use: use only for the purpose of collection), and IPP 9 (retention: do not keep longer than necessary). The Act also requires agencies to take reasonable steps to protect personal information against loss, unauthorized access, and disclosure. For face search, this means that a service must have a clear purpose for processing, must be transparent about what it does with uploaded photos, must not use the photos for unrelated purposes, and must delete them promptly. The Act's extraterritorial reach means that overseas services offering face search to New Zealanders may be subject to New Zealand law.
Legal Use Cases in New Zealand
- Online dating safety — verifying that a match on Tinder, Bumble, or NZDating is using authentic photos
- Marketplace fraud prevention — checking whether a seller on Trade Me or Facebook Marketplace NZ is using stolen images
- Identity verification — confirming the identity of freelancers, contractors, or online business contacts
- Personal image protection — discovering whether your own photos are being misused by impersonators
- Journalistic and OSINT research — verifying subjects in stories of public interest
- Community safety — vetting individuals in close-knit communities where trust and reputation matter
How to Use Face Search Responsibly in New Zealand
Using reverse face search responsibly in New Zealand means choosing a tool that respects the Privacy Act 2020 and the OPC's biometrics guidance. A compliant service deletes uploaded photos immediately after processing, does not retain facial templates, and does not build a permanent biometric database. The Privacy Act does not include a formal household exemption, but it generally does not apply to individuals acting in a purely personal or domestic capacity. However, if an individual uses face search in a way that extends beyond the personal sphere — for example, publishing results or using them for commercial purposes — the Act's obligations may apply. New Zealand users should also be mindful of the country's strong cultural emphasis on privacy and respect, and of the specific obligations under the Harmful Digital Communications Act 2017, which prohibits using digital communications to cause serious emotional distress. Always use results ethically: do not stalk, harass, or discriminate. To find someone by photo today, try facesearching by visiting the facesearching home page.
New Zealand Privacy Rights and Redress
Under the Privacy Act 2020, New Zealanders have robust rights: the right to know whether an agency holds personal information about them, the right to access that information, the right to request correction, and the right to complain to the OPC. The OPC can investigate complaints, issue compliance notices, and make binding decisions. If a complaint is not resolved, it can be taken to the Human Rights Review Tribunal, which has the power to award damages and issue injunctions. The Act also introduced a mandatory data breach notification requirement: agencies must notify the OPC and affected individuals of any breach that poses a risk of serious harm. If a face search service processes your facial data in violation of the Act, you have multiple avenues for redress. For more on safeguarding your online presence, see our guide to protecting your digital identity.
New Zealand's OPC has set clear expectations that biometric collection must be proportionate and transparent — any face search engine serving Kiwis must delete uploads immediately and never build a permanent biometric database.