The Lobby Camera Logged Her Face Before the Tenant Signed the Annex on Page 47
Manila condo buildings rolled out facial recognition at the front desk. The marketing clause sits buried in a T&C nobody walks tenants through.
Walk into a mid-tier Mandaluyong condo this year and the guard no longer asks for an ID. A tablet at the turnstile reads your face, blinks green, and lets you through. Property managers call it frictionless. The annex you signed at move-in calls it consent.
Tenants in BGC, Ortigas, and parts of QC have started comparing notes in unit group chats after one resident noticed her face appeared in a developer's email blast for a new tower launch. She did not pose for it. She walked past a lobby camera.
The clause that does the heavy lifting
The contracts vary by developer but the structure repeats. A standard lease bundles a House Rules document. The House Rules reference a Privacy Notice. The Privacy Notice grants the property manager rights to process biometric data for security, plus a line about sharing with affiliates, partners, and analytics providers for service improvement.
Service improvement is doing a lot of work in that sentence. Some property management groups operate under the same parent company as the developer's sales arm, its mall operator, and its co-working brand. Affiliate sharing means the face that opens your lobby door can also train models for foot traffic analytics at a sister mall down the road.
The National Privacy Commission has rules on biometric processing. Consent must be freely given, specific, and informed. A clause buried on page 47 of a move-in packet, presented after the security deposit clears, does not meet any of those words honestly.
Refusal is not really an option
Ask the front desk for the manual override and you get a printed visitor log, a wait, and a guard who has been told the new system is mandatory. One tenant in a Pasig building said her request to opt out was acknowledged in writing, then ignored for three months while the tablet kept scanning her anyway.
The contract she signed includes a clause saying continued use of the premises constitutes ongoing consent. Walking through your own lobby becomes the legal act that authorizes the scan.
What the marketing partners actually get
Developers will say they share aggregated, anonymized data. Aggregated data built from facial scans is still facial data at the point of capture. The vendor running the recognition model holds the raw template. Templates can be matched across buildings if the same vendor sells to multiple properties, which several do.
That means a tenant who lives in one tower, works in a co-working space run by the same group, and shops at the affiliated mall can be tracked across three locations without ever consenting to a cross-property profile. Advocacy groups working on data privacy have flagged this pattern in filings to the NPC. Enforcement has been slow.
What tenants are doing
Some unit owners are demanding written opt-outs and keeping copies. Others are filing complaints with the NPC, which has the power to order deletion and impose fines under the Data Privacy Act. A handful of buildings have rolled back to PIN pads after enough residents pushed back in HOA meetings.
The lobby tablet costs the developer a fraction of a guard's monthly wage. The face it captures funds a marketing pipeline the tenant never agreed to feed. Until the NPC issues a clean order on biometric consent in residential leases, the annex on page 47 is the contract that holds, and the camera keeps logging anyone who walks through the door.
