Is facial recognition legal? In most of the United States, yes, but the rules depend on who is using it and where. No comprehensive federal statute that I found in the sources checked bans it. Instead, you get a patchwork: state biometric privacy laws that restrict companies, city ordinances that limit local government, FTC enforcement against unfair uses, and in Europe a regulation that bans certain uses outright. The facts here were checked on October 10, 2026.

The short version for anyone asking whether facial recognition is legal: a store, employer or app that scans your face usually has to follow consent rules in states like Illinois and Texas, a city police department may be barred from using it, and federal agencies follow their own rules, which this post does not cover. Details follow.

Who is using it makes the difference

Lawyers split the question into three groups, and each has different rules.

  • Private companies (retailers, social networks, employers, app makers). Mostly governed by state biometric privacy laws, consumer protection law and, for some uses, FTC action.
  • Local and state government (police, city agencies). Governed by city and state ordinances, where they exist, and by constitutional limits.
  • Federal agencies. Governed by agency policy and statutes specific to the agency. I did not research these for this post, so they are outside its scope.

Illinois: the strictest private-sector law

The Illinois Biometric Information Privacy Act (BIPA) is the statute people mean when they talk about suing over face scans. The text counts a scan of face geometry as a biometric identifier. A private entity that wants to collect one must give written notice of what it is collecting and why, say how long it will keep the data, and get a written release first. It must also publish a retention schedule, and generally destroy the data once the purpose is met or within three years of your last interaction, whichever is sooner. Selling or otherwise profiting from the data is barred.

What makes BIPA unusual is the private right of action. Any aggrieved person can sue. Damages are $1,000 for a negligent violation or $5,000 for an intentional or reckless one, or actual damages if higher, plus attorneys’ fees.

The statute was amended in 2024 (Public Act 103-769, effective August 2, 2024, as cited on the Justia page). The current text says repeated collection of the same biometric data from the same person by the same method counts as a single violation, so a person recovers once rather than for every scan. It also defines an electronic signature as a valid written release. My source did not mark which words changed, so check a legal summary of the amendment if the history matters to you.

Texas: enforced by the attorney general, not by individuals

Texas has a similar consent requirement, but no private lawsuit. Under Business and Commerce Code section 503.001, as summarized on a statute-reference site, nobody may capture a person’s biometric identifier, including face geometry, for a commercial purpose without first informing the person and getting consent. The identifier must be destroyed within a reasonable time, and no later than one year after the purpose expires. The civil penalty is up to $25,000 per violation, and the attorney general brings the case.

I could not open the Texas attorney general’s own pages in this session, so I have not described any specific settlements under this law.

Cities that limited government use

The first wave of local bans was aimed at police and city agencies rather than private businesses. According to the Wikipedia entry on facial recognition systems, San Francisco became the first major US city to ban facial recognition for police and local government in May 2019. Somerville, Massachusetts followed in June 2019, Oakland in July 2019, and Boston in 2020. By mid-2020 the list also included Berkeley, Brookline, Cambridge, Northampton and Springfield in Massachusetts, and Portland, Oregon.

That is a secondary source describing events through 2020. Ordinances get amended, repealed and replaced, so a city’s own current code is the right place to check before assuming a ban is still in force. This post does not claim that any of these ordinances is unchanged today.

The FTC and unfair or deceptive uses

The Federal Trade Commission has no facial recognition statute either, but it enforces its unfairness and deception authority. In December 2023, it announced an order against Rite Aid. The agency alleged the pharmacy chain used AI facial recognition from 2012 to 2020 to flag suspected shoplifters, produced thousands of false-positive matches, and that employees followed, searched or removed shoppers on that basis. It said the company failed to test accuracy or train staff and that the impact fell disproportionately on people of color.

The order bars the company from using the technology for surveillance for five years, requires deleting collected images and algorithms built from them, and requires safeguards for any future biometric system. This was a settlement, and the FTC’s descriptions are allegations. The case shows a way into liability that does not depend on a facial recognition law: a company that deploys an inaccurate system carelessly can be accused of unfairness.

Clearview AI: what happens when a database is scraped

Clearview AI built a face search engine from images collected on the public web. Its legal troubles show several of these regimes at work. Per Wikipedia’s summary, a May 2022 settlement of the ACLU’s Illinois BIPA suit restricted Clearview’s US sales of facial recognition services to government agencies, not private businesses. The same page reports a Dutch fine of 30.5 million euros in September 2024 and a UK Upper Tribunal decision in October 2025 holding that GDPR applied and the ICO had jurisdiction. I relied on that single secondary page for these facts, so confirm them against the regulators’ own announcements before quoting them.

Europe: some uses banned outright

Under Article 5 of the EU AI Act, in the text published on this reference site, two prohibitions matter here. AI systems that create or expand facial recognition databases through untargeted scraping of images from the internet or CCTV are banned. And real-time remote biometric identification in public spaces for law enforcement is banned except where strictly necessary for narrow goals: searching for specific victims or missing persons, preventing a specific imminent threat to life or a terrorist threat, or finding a suspect in a listed serious offense. Even then, the use generally needs prior authorization from a judicial or independent authority, a fundamental rights impact assessment and registration. The page describes Article 5 as applying from February 2, 2025. It also carries a separate marker of December 2, 2026 on some provisions that I could not explain, so check the official text before relying on dates for any particular paragraph.

Why consent rules matter more than the technology

A pattern runs through every regime above. The law rarely cares whether software matches faces well; it cares about notice, consent, retention and purpose. BIPA, the Texas statute and the EU rules all start from the idea that a face is an identifier you cannot change, unlike a password. If a database leaks, you cannot get a new face.

That is also why the damages in BIPA cases look large next to ordinary privacy claims. The statute attaches a fixed sum to each violation, so a company that collected scans from thousands of workers without the written release can face a very large bill on paper. The 2024 amendment narrowed that arithmetic by treating repeat scans of the same person as one violation, but the basic structure remains.

For employers, the practical lesson is that timeclock face scans are a common source of claims, since an employee is a person whose scans are collected repeatedly. A written release at hiring, a posted retention schedule and a deletion process are what the statute asks for. These points are my reading of the statutory text, not a summary of any particular case.

A quick checklist if you want to know where you stand

  1. Check your state. Illinois and Texas have biometric consent statutes; other states differ and some have none.
  2. Look at the notice. A business collecting face scans in these states should have told you what it collects and how long it keeps it.
  3. Find out who is scanning. A private vendor, a city police department and a federal agency answer to different rules.
  4. Ask for deletion where a law gives you that right. Retention limits under BIPA and Texas law are a starting point.
  5. Report abuse. Consumer complaints can go to the FTC or a state attorney general.

Related questions

Can a store scan my face without telling me?

In Illinois and Texas, not for commercial purposes without notice and consent, on the statutes described above. In states without a biometric law, the answer depends on other consumer protection rules, and the sources I reviewed do not give a state-by-state answer.

Can I sue for a face scan?

In Illinois, yes, under BIPA, with damages of $1,000 or $5,000 per violation subject to the 2024 limit on repeat scans. In Texas, only the attorney general can enforce.

Is a photo the same as a faceprint?

BIPA excludes photographs from its definition of biometric identifiers. The faceprint, meaning the scan of face geometry, is what the law targets.

Does the EU ban police facial recognition?

It bans real-time remote use in public spaces by law enforcement except for the narrow cases listed in Article 5, and then with safeguards and authorization.

This is general information, not legal advice.

Sources