Does online notarization require a biometric face scan?

If you are shopping for a remote notarization platform, you will see biometric face matching presented as the serious, compliant option — the thing that separates a real RON tool from a video call. It is a genuinely useful fraud control. It is also, in most states, not what the statute actually asks for. Knowing the difference matters, because it changes which features you should be paying for and which ones are simply being sold to you.

What US RON rules actually require

Remote Online Notarization is authorised state by state — 49 states now have permanent authorisation, with California the outlier, operating a limited pilot with full permanent authorisation not taking effect until January 1, 2030. The rules are not uniform, but the dominant pattern for a signer who is not personally known to the notary is identity proofing built from two components:

• Credential analysis — an automated forensic check of the ID document. It parses the machine-readable barcode or MRZ, cross-checks it against the printed details, tests security features, and looks for signs of tampering. It answers is this card genuine.
• Knowledge-based authentication (KBA) — a short set of timed multiple-choice questions generated from public and credit records, typically five questions with a minimum pass score and a limited number of attempts. It answers does this person know what the record-holder would know.

Some states accept a biometric comparison as an alternative identity-proofing method rather than KBA, and plenty of platforms bundle face matching on top of both as their own fraud control. But if you are looking for the single component most consistently written into US RON statutes, it is KBA plus credential analysis — not a face scan.

And identity proofing is only part of it. Most RON states also require an electronic journal with prescribed fields, retention of the session recording — often five to ten years — and a tamper-evident electronic seal. The notary must be commissioned and separately registered to perform RON in their state, and a few states require the platform itself to be approved.

Canada works differently

Canadian remote commissioning and notarization are principles-based. The requirement is that the commissioner or notary be satisfied as to the identity of the person — a professional judgement, made on the record. There is no Canadian equivalent of the US identity-proofing mandate: no statutory requirement for automated credential analysis, no KBA, no biometric match.

That is why the ordinary Canadian approach looks the way it does — a qualified professional comparing a government ID against the person on live video, with a recording and an audit trail as evidence that they did it properly. That satisfies the standard because the professional's judgement is the standard.

Side by side

What this means when you are choosing a tool

• Working in Canada? A tool built around your judgement — live video, government ID on screen, a recording and a defensible audit trail — meets the standard. Automated document checking is a genuine upgrade over eyeballing alone, but it is an improvement, not a requirement.
• Working under US RON? Check three things before the feature list: are you RON-registered in your state, does your state require an approved platform, and does the tool provide KBA. That last one is where most general-purpose tools stop, and it is the component you cannot skip in states that require it.
• Either way, ask what happens to the images. A platform that computes and stores a faceprint has taken on biometric-privacy obligations — Illinois BIPA, Texas CUBI, Quebec's Law 25 — and so, to a degree, have you by using it.

Why we built ours the way we did

EZ PDF Editor's Video Signing Room is built for the Canadian shape of the problem, and for witnessed and acknowledged signings generally: you see the signer live, you see their ID, you decide, and the decision is recorded with who did it and when. We added an optional automated check of the ID document — credential analysis — because it strengthens that judgement without changing who makes it.

We deliberately did not add facial recognition or liveness detection. Our privacy impact assessment rejected it as disproportionate: it would create a materially more sensitive category of information than the photograph it replaces, and it would introduce documented accuracy disparities across skin tone, age and gender into a determination a qualified professional is already making on the record. No faceprint is ever computed, and the ID images are destroyed once you decide. The full reasoning is in our Identity Verification & Biometrics Policy.

To be equally clear about the limits: we do not provide KBA, and we are not a state-approved RON platform. If your state requires either, you need a RON provider, and we would rather say so than let a feature list imply otherwise.

One caveat, stated plainly

This is general information, not legal advice. RON requirements differ meaningfully between states and are amended regularly, and Canadian rules differ by province and by profession. Before you rely on any of it, confirm your own obligations with your regulator, your law society, or your counsel.