States Advance Facial Recognition Laws Amid Absence of U.S. Federal Regulation

In the absence of a comprehensive federal framework, U.S. states are advancing their own facial recognition regulations, creating a patchwork of laws that vary in scope, restrictions, and enforcement. This decentralized approach reflects growing concern over privacy, surveillance, and the long-term risks posed by biometric technologies.

State activity and evolving laws

By 2025, nearly two dozen states had enacted or expanded restrictions on facial recognition, according to recent legislative trackers. Many measures target law enforcement use, while others focus on commercial applications. Montana and Utah require warrants for most police deployments, while Maryland’s 2024 statute limits use to investigations of serious crimes and adds notice and transparency provisions without mandating a warrant. Illinois’s Biometric Information Privacy Act (BIPA) remains one of the most stringent laws in the country, requiring written consent for commercial biometric data collection and granting individuals the right to sue for violations.

Colorado’s rules illustrate the layered nature of state regulation. A 2022 law prohibits continuous, real-time facial recognition surveillance in public spaces without a warrant. In 2025, lawmakers added restrictions for K–12 schools, limiting use to preexisting systems and requiring consent for any new deployments. The state’s updated privacy law, effective in 2025, also includes consent requirements for biometric data collection. However, the ACLU of Colorado has raised concerns about the strength of enforcement and oversight mechanisms.

Law enforcement practices and transparency trends

Facial recognition in policing remains a flashpoint. Reports allege that the NYPD has circumvented its own policies by asking other city agencies, including the FDNY, to conduct facial recognition searches. The department states it “cannot and will never make an arrest solely using facial recognition technology,” framing the technology as an investigative lead rather than probable cause. Civil liberties advocates continue to press for clearer limits and independent oversight.

Even as the accuracy of top-performing algorithms in controlled testing continues to improve, experts caution that results vary significantly in real-world conditions and that vulnerabilities such as spoofing persist. Privacy advocates emphasize that because biometric identifiers are permanent, a breach can carry lasting consequences for individuals whose data is compromised.

Some states are pairing restrictions with transparency rules. California’s B.O.T. Act requires disclosure when a bot is used to knowingly deceive for a purchase or to influence voting. Legislators in other states have introduced bills to mandate labeling of AI-generated content and to ensure human contact options for AI-based services. As states act independently, the resulting differences in definitions, permissible uses, and enforcement standards are expected to continue, posing challenges for compliance by both government agencies and technology providers.

Source: NPR

–

By the ID Tech Editorial Team