Facial recognition privacy laws in the United States are a patchwork: there is no single federal statute, so your rights depend mostly on your state, on a handful of Federal Trade Commission enforcement powers, and on a narrow set of opt-out rights at the border.1U.S. Commission on Civil Rights. The Civil Rights Implications of the Federal Use of Facial Recognition Technology More than 20 states now regulate how companies collect faceprints, some let you sue directly for thousands of dollars per violation, and a growing list of cities has banned government use outright. Knowing which of those protections you actually have is the difference between exercising your rights and never knowing you had them.
What the Law Is Actually Protecting
Facial recognition systems don’t store your photograph. They measure the geometry between facial landmarks and turn those measurements into a mathematical template, sometimes called a faceprint. That template is biometric data, and the strongest state laws treat it with the same sensitivity as a fingerprint. The privacy problem is that a faceprint can be generated without your knowledge or participation. Unlocking your phone with your face is opt-in; a surveillance camera in a store or on a city street is not.
Is There a Federal Facial Recognition Law?
No comprehensive federal law directly regulates facial recognition.1U.S. Commission on Civil Rights. The Civil Rights Implications of the Federal Use of Facial Recognition Technology There is no federal statute requiring your consent before a company collects your faceprint, no federal retention limit on biometric databases, and no federal private right of action that lets you sue over unauthorized collection. Congress has introduced bills over the years and passed none of them. Federal oversight comes from two narrower sources.
FTC Enforcement Under Section 5
The FTC uses its authority over unfair and deceptive business practices to police biometric data collection. In a 2023 policy statement, the agency spelled out what it considers violations. Making false claims about the accuracy or reliability of facial recognition technology counts as deceptive. Collecting biometric data secretly, without giving consumers any way to know or opt out, can qualify as unfair.2Federal Trade Commission. Policy Statement on Biometric Information and Section 5 of the Federal Trade Commission Act
The agency expects companies to assess risks before deploying biometric systems, address known accuracy problems, train employees who handle the data, and monitor the technology on an ongoing basis. Its action against Rite Aid shows how this plays out. The FTC found the drugstore chain had used facial recognition for security in hundreds of stores without reasonable safeguards, leading to false matches that disproportionately affected women and people of color. The settlement banned Rite Aid from using facial recognition for surveillance for five years.3Federal Trade Commission. Rite Aid Corporation, FTC v.
The Foreign Adversaries Data Law
The Protecting Americans’ Data from Foreign Adversaries Act, enacted in 2024, prohibits data brokers from selling or providing access to personally identifiable sensitive data to North Korea, China, Russia, Iran, or entities controlled by those countries.4Office of the Law Revision Counsel. 15 USC Chapter 123 – Protecting Americans Data From Foreign Adversaries The statute explicitly classifies biometric information as sensitive. Violations can result in FTC enforcement with civil penalties of up to $53,088 per violation.5Federal Trade Commission. FTC Reminds Data Brokers of Their Obligations to Comply With PADFAA The law does not regulate domestic collection or use of biometric data, but it does create a real barrier to the international sale of faceprint databases.
State Biometric Privacy Laws
More than 20 states have enacted laws regulating the collection of biometric data. They vary significantly in strength, and the strongest of them establish what the federal government has not: a direct, enforceable right for you to control your own faceprint.
Consent, Retention, and Damages
The strongest state biometric statutes share a core structure. Before collecting a faceprint, a company must inform you in writing that biometric data is being gathered, explain the purpose and how long it will be kept, and obtain your written consent. Companies must publish a data retention policy and permanently destroy biometric identifiers when the original purpose has been fulfilled, or within a set period after your last interaction with the company, whichever comes first.
What makes these laws powerful is the private right of action. In states that allow individuals to sue directly, you do not need to prove you suffered a financial loss. The mere collection of your faceprint without consent is enough. Statutory damages under the strictest state law reach $1,000 per negligent violation and $5,000 per intentional or reckless violation, plus attorney’s fees. Those per-violation damages have driven major class-action settlements, including a $650 million settlement against a social media company for collecting facial recognition data from user photos without consent.
Not every state with a biometric privacy law includes a private right of action. Some limit enforcement to the state attorney general, which significantly reduces your individual leverage. Check your state’s specific statute before assuming you can sue.
Where You Might See These Rules in Daily Life
Employer time clocks and building access systems are one of the most common places biometric consent laws apply. If your employer uses facial recognition for clocking in or door entry, state biometric privacy laws in many jurisdictions require written consent before your faceprint is collected, with disclosure of what is collected, why, and how long it will be stored. Skipping that step exposes the employer to the same statutory damages as any other private violator.
Retailers are another. Some stores have run facial recognition on every customer who walked in, not just suspected shoplifters. The FTC treats that kind of secret collection as a potentially unfair practice.2Federal Trade Commission. Policy Statement on Biometric Information and Section 5 of the Federal Trade Commission Act In some jurisdictions, businesses that collect biometric data from customers must post clear, conspicuous signs near every entrance disclosing the practice.
Limits on Government and Police Use
Seven federal law enforcement agencies within the Departments of Justice and Homeland Security use commercial facial recognition to support criminal investigations.6U.S. Government Accountability Office. Facial Recognition Services: Federal Law Enforcement Agencies Should Take Actions to Implement Training, and Policies for Civil Liberties The FBI and U.S. Marshals Service are the primary users within the Justice Department, running faceprints against databases containing billions of images drawn from government sources like mugshots and passport photos, along with commercial tools that have scraped images from social media.7U.S. Commission on Civil Rights. U.S. Commission on Civil Rights Releases Report: The Civil Rights Implications of the Federal Use of Facial Recognition Technology
Agency policies generally treat a match as an investigative lead, not proof of identity. A match alone is not supposed to justify an arrest or support a search warrant. Several states have written that principle into law, requiring that a facial recognition result cannot be the sole basis for an arrest.8Congressional Research Service. Facial Recognition Technology and Law Enforcement: Select Constitutional Considerations At least four states require a warrant or probable cause before police can run a facial recognition search at all. Roughly half a dozen states limit the technology to investigations of serious crimes. More than a dozen cities have gone further and banned government use entirely, meaning municipal agencies including police cannot purchase, access, or use any facial recognition system.
Your Right to Opt Out at the Border
Customs and Border Protection uses facial comparison technology at airports and land border crossings to verify travelers against their passport or visa photos.9U.S. Customs and Border Protection. Biometrics If you are a U.S. citizen and prefer not to participate, you can decline the facial scan and request a manual passport inspection instead.10U.S. Customs and Border Protection. Biometrics: Privacy Policy CBP does not require biometric participation by U.S. citizens, and you do not need to explain your reason. Non-citizens generally do not have the same opt-out right, because biometric collection is part of the entry and exit verification process.
Why Accuracy Matters for Your Rights
Facial recognition is not equally accurate across all faces. The National Institute of Standards and Technology tested 189 algorithms and found that false positive rates varied by factors of 10 to 100 depending on race, sex, and age. False positive rates were two to five times higher for women than men across most algorithms. Among domestic law enforcement mugshot images, the highest false positive rates occurred for American Indian individuals, with elevated rates for Black and Asian populations as well. For one algorithm, the false match rate for American Indian women was 68 times higher than for white men.11National Institute of Standards and Technology. Face Recognition Vendor Test Part 3: Demographic Effects
These are not abstract numbers. In 2020, a man in Detroit was arrested at his home in front of his family, held for 30 hours, and later released when police acknowledged the facial recognition match was wrong. That case was the first publicly reported wrongful arrest linked to the technology, and others have followed. The pattern is consistent: the people most likely to be misidentified come from the demographic groups where the algorithms perform worst. If you are ever arrested based on a facial recognition match, the algorithm’s error rate is directly relevant to whether probable cause existed.
Practical Steps to Protect Your Privacy
Your legal rights depend heavily on where you live, but several practical steps apply everywhere.
- Decline CBP’s facial scan at international departure and arrival gates if you are a U.S. citizen, and ask for a manual passport check.10U.S. Customs and Border Protection. Biometrics: Privacy Policy
- Turn off facial recognition features in your device and app settings. Many smartphones, social media platforms, and photo storage services enable them by default.
- Read biometric consent forms before you sign. In states with strong laws, the form must specify what is collected, why, and for how long, and refusing is your right.
- Watch for signage at store entrances. Some jurisdictions require businesses that scan customer faces to post notice, and if you see a sign you can decide whether to walk in.
- Pick fingerprint or password login over facial recognition where a service offers a choice. Fewer companies holding your faceprint means less exposure.
If you believe a company collected your faceprint without consent, your remedies depend on your state’s laws. In states with a private right of action, you can file a lawsuit for statutory damages without proving financial harm. In states where only the attorney general can enforce, you can file a complaint with your state’s consumer protection office. Either way, document the circumstances: when the collection happened, what notice you received, and whether you consented. That record is what any future claim will rest on.