Via Futurism:

Apple’s security overview emphasized that FaceID was designed with security in mind, and requires the user’s eyes to be open and directed at the camera in order to work. The phone’s facial mapping system, and the neural networks that analyze the maps, have been designed and trained to counter “both digital and physical spoofs.” Furthermore, Apple has stated that it is not storing facial patterns in the cloud.

Apple set forth six scenarios in which Face ID would ask for the passcode instead of unlocking the iPhone: after being turned on or restarted; when it hasn’t been unlocked for more than 48 hours; when the passcode hasn’t been used to unlock in the last 156 hours and Face ID hasn’t been used to unlock in the last four; after a remote lock command; after five failed facial matches; and after someone has initiated power off or the Emergency SOS signal.