As facial-recognition technology has improved significantly in recent years, it has attracted the interest of governments and law enforcement agencies. That’s led to debates over whether certain uses of the technology violate constitutional protections against unreasonable searches (see “As It Searches for Suspects, the FBI May Be Looking at You”). Privacy advocates also point out that research has shown the technology to be less accurate with older photos and with images of women, African-Americans, and children (see “Is Facial Recognition Accurate? Depends on Your Race”).

Last month, U.S. Customs and Border Protection began scanning the faces of people boarding a daily flight to Tokyo from George Bush Intercontinental Airport in Houston. In May, it began doing the same for a flight leaving Dulles for the United Arab Emirates. In Atlanta and Boston, Delta will soon begin testing what it calls eGates, which scans passengers’ faces before they can board the plane. JetBlue says it is testing a similar system in place for a flight out of Boston headed to Aruba. The data from those programs goes to CBP.

In each case, airline-owned cameras at the gate capture passenger photos so they can be compared with the passport and visa photos associated with the identities of the people on a given flight manifest. Don’t be fooled by the term “testing,” says Harrison Rudolph, a law fellow at Georgetown Law’s Center on Privacy and Technology. They are operational, at least in the sense that CBP is already using these systems to create “biometric exit records” for foreign nationals, he says.

Rudolph and others are raising alarms because as part of the process, CBP is also scanning the faces of U.S. citizens (in fact, at this point only customers with U.S. passports can participate in JetBlue’s “self-boarding” program in Boston). They say Congress has never expressly authorized the collection of facial scans from U.S. citizens at the border routinely and without suspicion. The Trump administration revised his executive order to clarify that the biometric exit program did not pertain to U.S. citizens.

As it is still early in what appears to be a broader effort to deploy facial recognition in airports across the country, we don’t yet know how easy or difficult it will be for travelers to avoid. Both JetBlue and Delta say people can opt out, but it is not clear if that applies to foreign nationals. According to DHS, if a U.S. citizen asks not to participate, an available CBP officer “may use manual processing to verify the individual’s identity.”

No matter whose face is being scanned, though, we don’t know much about what happens to the information after CBP collects it at the gate and verifies a passenger’s identity, but DHS says that all data pertaining to the images is deleted within 14 days.