Monaco's Facial Recognition Bill

A bill has been sitting in Monaco's Conseil National since December 2023 that would let the Direction de la Sûreté Publique apply facial recognition to footage from cameras in publicly accessible places. It has not been voted. In December 2025 the APDP delivered an unusually critical opinion on it, and the National Council has listed it among its significant dossiers for 2026.

Nothing in this bill obliges your business to do anything today. But it is the clearest available preview of how Monaco intends to regulate the automated analysis of images — and if you run cameras, sell through a physical space, or have been pitched "smart" video analytics by a vendor, it is worth understanding before the vote rather than after.

Where the bill actually stands

Projet de loi n° 1087 concerns the use of vidéoprotection and vidéosurveillance in publicly accessible places for the detection, search and identification of wanted or flagged persons by means of remote biometric identification systems. It was deposited at the Conseil National on 19 December 2023 and referred to the Commission de Législation, where elected members may amend it.

The text would authorise the Sûreté Publique — not private operators — to run remote biometric identification against video images in order to find people who are wanted or reported for reasons the law itself would define. Officials have consistently framed it as automating work officers already do manually, targeting only faces already flagged in law enforcement systems, rather than monitoring the general public.

At the request of the President of the National Council, the APDP examined the text and published its opinion, délibération n° 2025-022, on 10 December 2025. The bill has still not been voted. Monaco's legislative timelines are not fixed, so treat any specific predicted date you read as speculation.

What the APDP objected to

The authority's opinion is worth reading in full if this affects you, because it is far more pointed than the usual regulatory language. Its principal criticisms:

• The text does not define "remote biometric identification", and does not distinguish real-time use from after-the-fact analysis — two very different things in practice.
• The trigger threshold is broad. Use would be permitted in connection with offences carrying a minimum penalty of one year, which the APDP notes covers the great majority of the Penal Code, rather than being reserved for serious threats.
• There are no meaningful geographic or temporal limits, so the system could in principle operate continuously across the whole territory.
• There is no requirement for prior judicial authorisation, and no obligation to inform the people identified.
• Oversight and sanction are asymmetric: no sanctions are provided for improper use by Sûreté Publique personnel, while the penalties contemplated for private actors sit below those already in Law No. 1.565.
• Because Law 1.565 exempts police and justice processing from impact assessment, no formal risk analysis would precede deployment.

The APDP's conclusion was not that facial recognition can never be introduced in Monaco. It was that this text is not adequate to what the technology represents, and that real prior reflection is needed — including, in its view, the possibility of experimental legislation with a defined scope and an evaluation at the end.

It does not hand facial recognition to private business

This is the part most often misread. Bill 1087 is about state powers. It would not create a right for a hotel, a retailer, a private club or a building manager to identify visitors by face.

For private-sector operators, the governing text remains Law No. 1.565 of 3 December 2024, under which biometric data is treated as a special category with a narrow set of lawful grounds. In the employment context the APDP has been explicit: biometric access control can be justified for restricted-circulation premises, but not for attendance or time tracking. Identifying customers or passers-by by face is a very different proposition and would be extremely difficult to justify. If a supplier tells you otherwise, get that in writing and have it checked by counsel or clarified with the APDP before you sign anything.

Your existing cameras are already regulated

Long before any facial recognition arrives, ordinary CCTV is regulated processing under Law 1.565. If you have not looked at your setup since the law came into force, the recurring gaps are predictable: cameras absent from the register of processing activities, no defined retention period (footage kept until the disk fills), no visible signage at entrances, viewing access shared far more widely than necessary, and cameras pointed at employee workstations or the public highway.

The precise obligations depend on what your cameras cover and why, and the APDP publishes guidance on the point. If any part of your setup is uncertain, verify it with a professional rather than assuming — the sanctions under 1.565 are not nominal.

AI video analytics is the quieter question

The more immediate commercial issue is not police facial recognition, it is what your own camera vendor is selling. Footfall counting, dwell time, queue detection, heat maps, age or gender estimation, "customer recognition" for returning VIPs — these are marketed to Monaco retail, hospitality and yachting businesses as anonymous analytics.

Sometimes that is accurate. Sometimes the system computes a facial template to work at all, which changes the legal analysis entirely. Before deployment, ask the vendor three specific questions: does the system generate a biometric template of any kind, where is processing performed and where is data stored, and can a given individual be re-identified across visits. Ask for the answers in writing. The same discipline applies to any AI tool you put into an operational process — the useful ones survive being asked how they actually work.

What to do before the vote, not after

Concretely, and in order: confirm your cameras appear in your register of processing activities with a stated purpose; set and enforce a retention period; check your signage; restrict who can view recordings and log that access; and pause any purchase of face-based analytics until its lawful basis is documented. If your compliance position under 1.565 has never been reviewed, that is the wider piece of work, and it is worth doing properly with data protection support rather than in reaction to a complaint.

Bill 1087 may pass in amended form, or it may sit longer. Either way, the direction of travel is clear: Monaco is legislating its own path on automated image analysis, separately from both France and the EU, and it is doing so with a data protection authority that has shown it will say so publicly when a text falls short. Businesses that already have their own video and automation practices in order will find whatever arrives next much easier to absorb.

If you would like your camera, analytics and data-protection setup reviewed against Law 1.565 before the debate moves on, get in touch.