Mayor of London Sadiq Khan has written to the King's Cross Central development asking for reassurance its use of facial-recognition technology is legal.
Argent, the developer of the 67-acre (0.3-sq-km) site, has said facial recognition is being used to "ensure public safety".
But Mr Khan wrote there was "serious and widespread concern" about the legality of facial-recognition cameras.
And he has called for new laws to clarify how the technology can be used.
Argent has declined to say how long the facial recognition cameras have been in operation, what the legal basis is for their use, or what systems it has in place to protect the data it collects.
A spokeswoman for Argent has said: "These cameras use a number of detection and tracking methods, including facial recognition, but also have sophisticated systems in place to protect the privacy of the general public."
The King's Cross Central development is home to both King's Cross and St Pancras International stations, as well as restaurants, shops and cafes.
There are also offices occupied by companies such as Google and Central Saint Martins college.
In his letter to Argent's Robert Evans, the chief executive of the King's Cross development, Mr Khan said public spaces should be "open, free to use and offer the highest level of public access".
He requested more information about how facial recognition cameras were being used, as well as "reassurance that you have been liaising with government ministers and the information commissioner's office (ICO) to ensure its use is fully compliant".
Ben Robson, a partner at Oury Clark solicitors, said using facial recognition was a "high-risk" option for businesses, given the privacy implications the technology presented.
"The law states that biometric data, including facial data for identification purposes, must be dealt with to a higher standard than other types of less sensitive personal information, and the information commissioner has publicly indicated that this area is high on the list of her priorities," he said.
"Currently no clear position has been adopted by the ICO, the courts or the UK government on how facial-recognition software deployment for security and law enforcement will be approached.
"However, it seems unlikely that indiscriminate facial scanning is consistent with the requirements of the GDPR [General Data Protection Regulation].
"Close attention will be paid to the initial test cases of this technology and any regulatory action that follows."