How to choose a family resemblance app: the 10 criteria that matter

1. Which AI model is used?

The most technical but most structuring criterion. A serious resemblance app uses a deep learning model trained specifically for face recognition (ArcFace, FaceNet, DeepFace, Dlib). These models have proven themselves in scientific literature and on public benchmarks (LFW, VGGFace2).

Conversely, some consumer apps use "fun filters" that compute a rough approximation without real AI. The result is entertaining but not reproducible: two identical tests may give very different scores.

Question to ask: does the app document the model used? If it stays vague ("proprietary algorithm"), it is often a sign there is not much science behind it.

2. Is the score global or per-trait?

A global score like "70% dad, 30% mom" is a simplification. To understand why your child looks more like one parent, per-trait detail (eyes, nose, mouth) is much more useful.

Concretely, your child may have:

• dad's eyes (85% similarity);
• mom's nose (60% similarity);
• a shared mouth (50/50);

This granularity changes the reading: it shows the genetic recombination at work, not an abstract average.

3. Is there a guest mode (no sign-up)?

An app that requires an account before the first test often signals a hidden subscription business model. An app that offers a free guest test, without even asking for an email, is more visitor-respectful.

To watch: guest mode must also protect photos (fast deletion, no tracking). Otherwise it is just bait to harvest images.

4. What is the business model?

Three main models exist:

• One-shot (one-time analysis pack): transparent, no surprise.
• Subscription ($5-10/week or $30-50/month): pay as long as you forget to cancel. Beware "free" trials that auto-convert.
• Free with ads: the service pays via targeted advertising — your behaviour is tracked, sometimes your images too.

For occasional or gift use, one-shot is almost always cheaper. For very frequent use (multiple analyses per week), a subscription may make sense — but it is rare.

5. Where are your photos stored?

Essential question often neglected. Face photos are biometric data under European GDPR (Art. 9), thus "sensitive".

To check in the privacy policy:

• Server location: EU, USA, other?
• Encryption type in transit and at rest.
• Sub-processors (cloud hosts, AI partners).

An app entirely hosted in the EU (with EU sub-processors too) offers the best GDPR guarantee. US-hosted apps rely on Standard Contractual Clauses, which is legal but offers less protection.

6. How long are photos retained?

Retention period should be explicit in the TOS. A serious app:

• keeps photos only as long as needed (e.g. 12 months after last activity, automatic deletion beyond);
• allows manual deletion at any time from the profile;
• sends reminder emails before automatic deletion.

If the policy mentions "indefinite retention" or is silent on the topic, it is a red flag.

7. Are data shared with third parties?

Read the "data sharing" section of the TOS. Three commitment levels exist:

• No commercial sharing (desirable model): data never leaves the service perimeter.
• Anonymised sharing for research: acceptable if consent is explicit and opt-in.
• Selling data to third parties (advertisers, pharma labs): to avoid, even if "anonymised" (face re-identification remains possible).

GDPR requires any data monetisation to be clearly announced — but in practice the wording can be fuzzy. When in doubt, ask by email before testing.

8. What does the DPIA / GDPR impact assessment say?

For biometric processing, GDPR mandates a Data Protection Impact Assessment (DPIA — Article 35). This document describes risks and mitigation measures.

A service that openly mentions having performed a DPIA, names a GDPR officer (DPO or equivalent), and publishes a detailed privacy policy (≥ 3000 words) shows serious commitment. Apps that settle for a generic "we respect your privacy" provide no guarantee.

9. Is the interface available in your language?

Beyond comfort, an interface in your language (with a bilingual FR/EN site) is generally a sign of a European service — therefore strictly subject to GDPR.

Conversely, an app machine-translated or available only in English may indicate a US or Asian service, with a different legal framework. Not a deal-breaker, but a factor to integrate.

10. Can you delete your account easily?

GDPR mandates the "right to be forgotten" (Art. 17). A compliant app offers:

• account deletion in one click from the profile;
• effective deletion of photos and embeddings within 30 days;
• export of all your data (DSAR — Art. 15) in JSON or ZIP;
• a documented procedure for email requests (gdpr@..., contact@...).

If deletion requires a waiting email, justifications or manual response, it is non-compliant and a sign that the service relies on your inertia to keep your data.

Recap: the checklist to use before testing

Before trying a resemblance service, check:

1. The AI model is documented (ArcFace, FaceNet or equivalent).
2. The score is per-trait (eyes, nose, mouth).
3. A guest mode is offered before requiring an account.
4. The business model is transparent (one-shot, no hidden subscription).
5. Servers are in the EU (or with clear GDPR guarantees).
6. Photo retention is explicit (≤ 12 months inactive).
7. No data sale to third parties.
8. A DPIA is mentioned and a GDPR officer identified.
9. The interface is in your language (at least bilingual FR/EN).
10. Account deletion is self-service.

A service ticking all 10 boxes is rare — but it is the standard to aim for. If a service ticks fewer than 6, that is a signal to switch alternatives.

❓ Frequently asked questions

📚 Also worth reading

• What's the best photo for a resemblance test? →
• How facial recognition AI works →
• DNA test vs AI: what to choose? →