What the NSW facial recognition Code of Practice means for hotels and clubs

In March 2026, facial recognition in NSW pubs and clubs went from a grey area to a governed one. Liquor & Gaming NSW released its Code of Practice: Facial Recognition Technology in Hotels & Clubs, the first clear government-backed framework for how venues should use the technology to identify self-excluded patrons. If you run a venue with gaming machines, or you're weighing up facial recognition, here's what the Code says and what it means for you.

What the Code actually is

The Code took effect on 18 March 2026 and is, for now, voluntary. It was developed by Liquor & Gaming NSW for hotels and clubs with gaming machines. It covers one specific use: identifying patrons who have excluded themselves from gambling. Importantly, it does not cover facial recognition used for anti-money-laundering checks, general venue security, or staff sign-in. Its scope is deliberately narrow.

It was shaped through several rounds of consultation with government, industry and privacy experts, including the Office of the Australian Information Commissioner (OAIC) and the NSW Privacy Commissioner. It is designed to sit alongside the Privacy Act 1988 (Cth) and the Australian Privacy Principles.

Why it exists

Self-exclusion programs let people experiencing gambling harm bar themselves from venues, often for long periods. Traditionally, enforcing those bans has relied on staff recognising an excluded person from a photograph, a tall order in a busy room on a Friday night. Facial recognition automates that first check, flagging a potential match so staff can step in.

The Code is explicit on one point: the technology supplements staff, it doesn't replace them. A match is a prompt for a human decision, not the decision itself.

What the Code requires

The Code turns broad privacy principles into concrete operational duties. In practice, a compliant venue is expected to:

• Complete a Privacy Impact Assessment before switching the system on, addressing whether facial recognition is necessary and proportionate.
• Display clear, prominent signage wherever the technology is in use, such as venue and gaming-area entrances.
• Maintain a privacy policy that specifically covers how biometric data is collected and handled.
• Store patron information securely, with controlled access and documented rules on who can use it.
• Monitor system performance on an ongoing basis, including false positives and false negatives, then keep records.
• Train authorised staff before they get access to the system, and retain training records for at least five years.
• Delete biometric data once it is no longer needed, in line with the Privacy Act.
• Set staff response procedures covering how a match is verified then escalated.
• Install then maintain the hardware to the technical specifications the Code sets out.

The Code also includes a technical checklist (Attachment A) for your facial-recognition provider to complete. It gives you a way to get the technical assurances in writing, though accountability for the system still sits with the venue.

Voluntary today, mandatory tomorrow

This is the part worth circling. The NSW Government has committed to mandating facial recognition in hotels and clubs with gaming machines once the statewide exclusion register is operating, as part of a broader reform that also covers third-party exclusions. The voluntary Code is explicitly described as an interim step toward that mandate. In other words, the requirements you can adopt by choice today are a preview of what will likely be required by law tomorrow.

Why act now, even though it's voluntary

Because the Code is not a 'safe harbour'. Following it doesn't switch off your existing obligations: the Privacy Act still applies and the OAIC keeps full enforcement powers. What the Code does give you is a clear, government-endorsed way to demonstrate good practice: to manage privacy and ethical risk, to navigate genuine public concern about the technology and to build trust with patrons. Venues that align early also avoid a scramble when the mandate arrives.

What to do next

The groundwork is the same whether you act now or when the mandate lands: a Privacy Impact Assessment, a privacy policy that names biometric data, signage at the right points, the Code's technical checklist, data handling you can explain plus trained staff with records to prove it. Our full compliance checklist walks through each step.

The shortcut is choosing a provider built for the Code rather than retro-fitted to it. Ottica was designed around these obligations, so most of that list is already handled the day you go live. We assist venues in navigating the complexities of a PIA, supply privacy policy wording, give you clear instructions on where signage belongs, hold the technical checklist in our dashboard and help you set up the staff training register.

How Ottica approaches it

Much of what the Code now asks for has been built into Ottica from the start. We design for privacy first. Detection runs at the venue and data is held in Australia under strict access controls. If a patron isn't on the exclusion register, their biometric data is discarded on the spot and they are never identified. The only biometric information kept belongs to people on the register. Our facial recognition is built and maintained in-house in Australia and is already live across hundreds of gaming venues. That means we can stand behind exactly how it works, support your Privacy Impact Assessment and complete the technical checklist the Code asks of providers.

The goal is simple: help your venue meet a higher standard without making your team carry the technical load.

The bottom line

The NSW Code is the clearest signal yet that facial recognition for self-exclusion is moving from optional to expected. Treat the voluntary period as a head start. If you'd like to talk through what compliance looks like for your venue, or see a privacy-first system that already meets the Code's requirements, we're happy to help.

Current as at July 2026. This article is general information, not legal advice. Check the current version of the Code before acting on it.

Sources

Liquor & Gaming NSW — Code of Practice: Facial Recognition Technology in Hotels & Clubs. NSW Government — media release on the facial recognition code. Lander & Rogers — NSW takes a governance-first approach to facial recognition technology.