Privacy, Identity, and Biometrics

Proctorio's Privacy Notice lives in a public GitHub repository, so anyone can read the exact language this post describes and compare it against what we used to say. In October 2026, we updated that notice, and we felt one change would benefit from a fuller explanation: how we use and talk about biometrics.

The history: "no biometrics"

For years we've said, plainly and often, that Proctorio's own technology doesn't use biometrics. That was true of every feature we offered.

The shifting demand, and our response

Over the last couple of years, our customers have been asking for stronger identity verification, not weaker. To meet that demand, we've built optional identity verification features that we believe fit a biometric description. Our implementation avoids the hazards of other, more popular biometric technologies, but it's still worth a discussion. Here is exactly what these features are, and what they entail.

There are two implementations, and both are available only to customers who choose to activate them:

• Instant ID: third-party biometrics. This is a high-level, sophisticated ID verification that checks the validity of the document itself and matches a selfie to the image on the ID. It is delivered through our interface, but a third party performs the actual check. If your organization turns this on, and the user opts in, our third-party verification provider creates a biometric template to confirm your photo ID matches your face. That template is created and held by the provider. Proctorio never receives it, sees it, or stores it.

• On-device biometric matching: Proctorio's own technology. New features we are building, called Match ID, Automated Re-verification, Institution-Provided ID Check, and Continuity Check, can compare a face using Proctorio's own technology. Below, I explain how that works, and how it differs both from the third-party check above and from most conventional understandings of "biometrics."

Note: None of this touches K-12. No K-12 deployment includes biometric features, Instant ID, or third-party identity verification.

Not facial recognition, and not one-to-many matching

Section 3.2.2 of the Privacy Notice defines facial recognition in two sentences that both matter:

Facial recognition uniquely identifies specific people by assessing whether the face in one image matches the face in another image.

It requires a database of either images of people's faces, or biometric representations of them, and technology that compares new images or biometric representations with entries in that database.

Privacy Notice, Section 3.2.2

On-device biometric matching doesn't meet that definition. Every comparison is one-to-one: the person at the keyboard against their own reference, a photo for most of these features, or a geometric measurement for Continuity Check. Never against anyone else's, and never against a database. Proctorio's servers never receive or store a biometric identifier or template.

Continuity Check is the clearest documented example:

The geometric reference exists only in your device's memory while your exam session is running. It is never written to disk, stored, or transmitted anywhere, and it is destroyed automatically when your exam session ends. Proctorio cannot see, retrieve, or reconstruct it. The reference cannot be used to determine who you are. This feature uses no database of faces, and its comparison is made only against the person who started your exam, never against anyone else.

Privacy Notice, Section 3.2.3

The image stays on the device, and is locked down where it doesn't

For Continuity Check, the geometric reference exists only in your device's memory while your exam session is running. It is never written to disk, never stored, never transmitted anywhere, and it is destroyed automatically when the session ends. There is nothing to intercept, because it never leaves your device in the first place.

For the other features, where a face comparison uses a reference photo instead, the images Proctorio handles are end-to-end encrypted the same way exam recordings are:

Test-taker audio, video, and screen recordings and images received from Institutions and processed by Proctorio are end-to-end encrypted and can only be decrypted by Institution-approved representatives. Only the Institution holds the decryption keys; Proctorio cannot decrypt this content.

Privacy Notice, Section 3

What Proctorio keeps, and for how long

Outside of that, Proctorio keeps and can read the following data in order to run the check: the verification result and reference number, the match score from our own on-device check, and, for Validate ID, the cross-institution record. The ID image and selfie you give a provider stay with that provider. When your institution reviews your exam, they are fetched for display and never saved by Proctorio.

That cross-institution record is a hash: a one-way scramble of the ID number rather than the number itself, made with a secret key stored separately, so it can be compared but never reversed.

In the Validate ID options (Instant ID and Standard ID), Proctorio stores the type of ID presented and a keyed cryptographic hash (HMAC) of the ID number, computed with a secret key that Proctorio keeps in a secure key store, separate from the stored values. Proctorio does not store the ID number itself, and without the key the stored value cannot be reversed to reveal the number or the contents of your document, or matched against guessed numbers.

Proctorio retains this hashed value for a maximum of twelve months from the verification, for a single purpose: detecting when the same ID is presented at more than one institution. If that happens, Proctorio notifies the affected institutions so they can review the matter together. Proctorio does not decide whether anything improper occurred; that determination belongs to your institution.

Privacy Notice, Section 3.4.5

Identity verification data follows the same logic. Under an active verification license, the provider keeps it for one year from license activation, so you don't have to verify again before every exam. That is a change from the immediate redaction the June 17 notice described, which was written before this feature existed. You can ask your institution to request deletion at any time. See sections 3.4.6 and 3.4.8.

No profiles, and Proctorio never becomes the decision-maker

None of this changes how Proctorio uses what it collects:

Proctorio does not and has not established "normal" profiles or compare Test Takers against any preserved or aggregated normal.

Proctorio does not make any decisions related to the Test Taker from flagged activity.

Privacy Notice, Section 3.3

That is the whole shift: two new ways to verify identity, one run by a third party and one run on your own device, both optional, and Proctorio keeps no face database. The language is public on GitHub, and I invite you to review it and bring us your questions.

As always, thank you for the work you do to make assessment integrity a priority. Let's keep moving forward together.

Mike