Facial recognition surveillance laws and privacy rights in the United States form a patchwork, not a system. There is no single federal statute. What you can do about a camera scanning your face depends on who is running it, why, and which state you happen to be standing in. Three states have dedicated biometric privacy laws, a handful of cities ban government use of the technology altogether, and federal agencies operate under internal policies with limited outside oversight. The practical result is that two people scanned on the same afternoon can have very different legal options by dinner.
Where You Live Decides Most of Your Rights
If a private company scans your face, your leverage comes almost entirely from state law. Three states have passed dedicated biometric privacy statutes, and one, Illinois, has real teeth.
Illinois: The Strongest Individual Protections
The Illinois Biometric Information Privacy Act, known as BIPA, requires any company collecting a biometric identifier to give you written notice, explain the specific purpose and duration of collection, and obtain a written release before capturing anything. Companies must also publish a retention schedule and destroy your data once the original reason for collecting it has passed.1Illinois General Assembly. 740 ILCS 14 – Biometric Information Privacy Act
What sets BIPA apart is that you can sue directly. A private right of action lets any person whose data was collected in violation of the law recover $1,000 per negligent violation or $5,000 per intentional or reckless violation.1Illinois General Assembly. 740 ILCS 14 – Biometric Information Privacy Act In Cothron v. White Castle (2023), the Illinois Supreme Court held that a separate claim accrues each time a company scans or transmits your biometric data without authorization, not just on the first scan.2Justia Law. Cothron v. White Castle System, Inc. An employee clocking in with a fingerprint reader every workday could accumulate hundreds of individual violations. BIPA class action settlements have reached tens of millions of dollars in individual cases.
Texas and Washington: Rules Without a Private Lawsuit
Texas prohibits capturing biometric identifiers for a commercial purpose without prior notice and consent, and requires companies to destroy captured data within a reasonable time, no later than one year after the collection purpose expires. The catch: only the Texas Attorney General can enforce the law, with civil penalties up to $25,000 per violation. You cannot sue on your own behalf.3Office of the Attorney General of Texas. Biometric Identifier Act Washington’s biometric statute uses a similar structure and also gives you no private right of action.4Washington State Legislature. Chapter 19.375 RCW Enforcement depends on the attorney general’s office deciding to act, and those offices have limited bandwidth.
California: Broad, Less Targeted
California treats biometric information as “sensitive personal information” under the California Consumer Privacy Act. You can ask companies what biometric data they hold about you, request deletion, and limit how the data is used and disclosed.5State of California Department of Justice. California Consumer Privacy Act (CCPA) The framework covers all personal data, so it is wider in reach but less targeted than BIPA. It doesn’t require written consent before collection; it gives you tools to discover and control your data after the fact.
Everywhere Else
Most states have no biometric-specific statute at all. Companies operating nationally often default to the most restrictive state’s rules to avoid a compliance patchwork, which effectively pushes BIPA-style consent language into national practices. But default is not law. Outside the states named above, your protection against a private business scanning your face is thin, and enforcement falls to the Federal Trade Commission acting under its general authority against unfair or deceptive practices.6Federal Trade Commission. Commission Policy Statement on Biometric Information
What the Constitution Does and Doesn’t Cover
The Fourth Amendment protects against unreasonable searches and seizures by the government, not by private businesses. Courts have generally held that features you expose in public carry a diminished expectation of privacy, which weakens constitutional claims against police cameras scanning a crowd.7Legal Information Institute. Fourth Amendment
That logic is under pressure. In Carpenter v. United States (2018), the Supreme Court held that acquiring historical cell-site location records was a Fourth Amendment search requiring a warrant, even though a third party held the data. The Court reasoned that digital surveillance can be so “detailed, encyclopedic, and effortlessly compiled” that it crosses a constitutional line.8Legal Information Institute. Carpenter v. United States The Supreme Court has not yet applied that reasoning directly to facial recognition, so as of now the constitutional protection for public face scanning remains unsettled.
When Police Can Use It Against You
Where facial recognition is legal for police, an algorithm match is generally treated as an investigative lead, not proof of identity. An officer typically cannot arrest you or get a warrant based solely on a software hit. Corroborating evidence, such as a witness identification, physical evidence, or records placing you at the scene, is needed before the case moves forward. Arrests built on nothing more than an algorithm are vulnerable on every step that followed.
A growing number of states now require police to obtain a warrant before running a faceprint against a database. Montana became the first, in 2023, adding a warrant rule and limiting facial recognition to serious crime investigations. Utah, Maine, and Massachusetts have imposed similar requirements. These rules force officers to show probable cause to a judge before accessing the technology.
When police use facial recognition without following required procedures, the exclusionary rule can keep the resulting evidence out of court. The Fourth Amendment’s protection is backed by making unconstitutionally obtained evidence inadmissible at trial.9Congress.gov. Amdt4.7.1 Exclusionary Rule and Evidence Defense attorneys also regularly demand the algorithm’s confidence score, a numerical measure of how closely the scanned face matched a database image. Low scores are corrosive to a prosecution.
Some cities have gone further than any state, banning government use of facial recognition entirely. San Francisco was the first major city to do so, and more than a dozen municipalities including Boston have followed. The bans typically prohibit city departments from purchasing the technology, using it, or getting around the ban by requesting results from a third party. Other jurisdictions require a surveillance impact report and council approval before agencies can buy scanning equipment. A police department’s access to facial recognition can change at a city line.
At the Airport: You Can Opt Out
The Transportation Security Administration uses facial recognition at identity verification, but the program is voluntary. At standard screening, a camera compares a live photo of your face against the photo on your ID. If you don’t want to be scanned, tell the officer you decline. The camera is turned off, and the officer manually compares your appearance to your ID. You keep your place in line.10Privacy and Civil Liberties Oversight Board. Use of Facial Recognition Technology by the Transportation Security Administration
TSA PreCheck Touchless ID is different: it matches your face against a database of enrolled travelers, and it is opt-in. You have to sign up through your airline’s app before it applies.11Transportation Security Administration. TSA PreCheck Touchless ID Signage at the checkpoint is required to notify travelers that facial recognition is in use and that opting out is available. Photos taken during standard screening are deleted after your identity is verified. When TSA retains images to test algorithm accuracy, the agency must notify travelers in advance and delete the data once testing is complete.10Privacy and Civil Liberties Oversight Board. Use of Facial Recognition Technology by the Transportation Security Administration
At Work and at School
The Equal Employment Opportunity Commission has stated that federal anti-discrimination laws apply to AI and facial recognition tools used in employment the same way they apply to any other hiring or management practice. If facial recognition is less accurate for people with darker skin tones and leads to disproportionate flagging or termination, that can constitute disparate impact discrimination under Title VII. Video interview software that penalizes applicants for atypical speech patterns caused by a disability faces the same exposure.12U.S. Equal Employment Opportunity Commission. The EEOCs Role in AI – What You Should Know
Employers using biometric timekeeping systems must also comply with whichever state biometric law applies. Much of the BIPA class action wave came from workplace scanners where employers had collected biometric data for years without ever obtaining written consent.
In K-12 and higher education, the Family Educational Rights and Privacy Act adds another layer. Federal regulations define a biometric record as “one or more measurable biological or behavioral characteristics that can be used for automated recognition of an individual,” and the definition explicitly includes facial characteristics alongside fingerprints, iris patterns, and voiceprints.13eCFR. 34 CFR 99.3 When a school maintains biometric records as part of a student’s education file, they fall under FERPA’s disclosure restrictions. The school generally cannot share them without parental consent, or the student’s consent if the student is over 18.
The Accuracy Problem Behind the Legal Fights
Facial recognition accuracy is not uniform across demographic groups, and that gap drives most of the policy fights. The National Institute of Standards and Technology runs the Face Recognition Vendor Test, evaluating algorithms from dozens of vendors. NIST has found that false positive rates, where the system wrongly declares two different people are the same, vary across demographics even with good image quality. These variations often trace back to underrepresentation of some groups in the training data.14National Institute of Standards and Technology. Face Recognition Technology Evaluation – Demographic Effects
False negatives compound the problem. Poor photography, especially underexposure of darker-skinned individuals or overexposure of lighter-skinned ones, drives error rates higher for specific populations.14National Institute of Standards and Technology. Face Recognition Technology Evaluation – Demographic Effects A false positive in a police context flags an innocent person as a suspect. A false negative in a workplace system locks out a legitimate employee. The demographic skew in error rates is the primary reason cities have banned the technology and the EEOC has flagged its use in employment as a discrimination risk.
Rights You Can Actually Exercise
Your specific rights depend on where you live, but several recur across state laws:
- Notice. You must be told before a company or agency collects your biometric data. In states with dedicated biometric statutes, this often means written disclosure of the purpose and duration of collection.
- Consent. Most biometric laws require some form of affirmative agreement before collection. Illinois requires a written release. Texas and Washington require consent but allow more flexible methods. California operates on an opt-out model.
- Deletion. If your biometric data is no longer needed for its original purpose, or was collected without proper authorization, you can request destruction.
- Access. Under comprehensive privacy laws like the CCPA, you can ask a company to disclose what biometric data it holds about you.5State of California Department of Justice. California Consumer Privacy Act (CCPA)
- Private lawsuits. In Illinois, you can sue a company directly for BIPA violations. In Texas and Washington, only the state attorney general can bring enforcement actions.
When biometric data is compromised in a breach, roughly 22 states specifically include biometric identifiers in the definition of personal information that triggers mandatory notification. Deadlines vary. Some states require notice within 30 days, others allow 45 or 60, and many use a more flexible “without unreasonable delay” standard.
Protecting your faceprint matters more than protecting a password, because you cannot change your face. Once biometric data leaks, no reset exists. That asymmetry is what has pushed legislation toward stricter collection rules rather than relying solely on breach remedies after the harm.