The use of automatic facial recognition (AFR) technology by South Wales Police is unlawful, the Court of Appeal has ruled.
It follows a legal challenge brought by civil rights group Liberty and Ed Bridges, 37, from Cardiff.
Mr Bridges said being identified by AFR had caused him distress.
The court upheld three of the five points raised but also found its use was proportionate interference with human rights.
The ruling said there was no clear guidance on where AFR Locate could be used, and who could be put on a watchlist.
It said as a result a data protection impact assessment was deficient and the force did not take reasonable steps to find out if the software had a racial or gender bias.
Responding to the ruling, Mr Bridges said: “I’m delighted that the court has agreed that facial recognition clearly threatens our rights.
“This technology is an intrusive and discriminatory mass surveillance tool.
“For three years now, South Wales Police has been using it against hundreds of thousands of us, without our consent and often without our knowledge.
“We should all be able to use our public spaces without being subjected to oppressive surveillance.”
Mr Bridges’ face was scanned while he was Christmas shopping in Cardiff in 2017 and at a peaceful anti-arms protest outside the city’s Motorpoint Arena in 2018.
He had argued it it breached his human rights when his biometric data was analysed without his knowledge or consent.
Liberty lawyer Megan Goulding described the judgment as a “major victory in the fight against discriminatory and oppressive facial recognition”.
She added: “It is time for the government to recognise the serious dangers of this intrusive technology. Facial recognition is a threat to our freedom – it has no place on our streets.”