Your privacy may be violated as you travel for the holidays. At more than a dozen airports around the U.S., from Houston to Boston, the Department of Homeland Security uses facial recognition to ensure people haven’t overstayed their visas. But according to a new report by the Center on Privacy and Technology at Georgetown University, that can end up violating the privacy of American citizens.

The report says that “without explicit authorization DHS should not be scanning the faces of Americans as they depart on international flights.” It doesn’t have that say-so, “but DHS is doing it anyway” as people pass through airport terminals. The authors also explain that the DHS is “failing to comply with a federal law requiring it to conduct a rulemaking process to implement the airport face scanning program—a process that DHS has not even started.”

This all echoes concerns with the technology that we’ve written about in the past.

As it turns out, the tech isn’t working very well, either. The systems “erroneously reject as many as 1 in 25 travelers using valid credentials.” That equates to as many as 1,632 passengers per day at John F. Kennedy International Airport who suffer delays. It also seems that women and African-Americans are more likely to get pulled aside, highlighting the problem of biases baked into AIs (see “Are Face Recognition Systems Accurate? Depends on Your Race.”)

Perhaps worst of all, the DHS doesn’t yet appear to be able to point to any direct benefit from using the system. All of which is worth remembering as you smile into a camera at the airport this Christmas.