Facial Recognition Laws: Police Use & State Rules (2026)

Facial recognition technology (FRT) lets police and government agencies compare a photo or video frame against a database of identified faces to generate an investigative lead. No federal statute governs when they can do this. Instead, a patchwork of state statutes, city ordinances, and court rulings decides what is allowed, and that patchwork has moved in both directions in the last five years.

Information last verified on August 14, 2026. This article has not yet been reviewed by a licensed lawyer.

Jurisdiction scope: This article covers government and law-enforcement use of facial recognition technology in the United States: the federal legal gap, how police use FRT in investigations, state and city restrictions, and the court cases shaping the rules. It does not cover private businesses scanning customer faces for marketing or loss prevention, which is a separate body of state consumer-privacy law. For that, see Biometric Privacy Laws by State.

Is Facial Recognition Legal? The Federal Gap

There is no comprehensive federal statute governing how police or government agencies use facial recognition technology. Congress has considered several bills and passed none of them. The Facial Recognition and Biometric Technology Moratorium Act (S.681, 118th Congress) expired without a vote in 2024. Two bills are currently pending in the 119th Congress: H.R.4695, the Facial Recognition Act of 2025, and S.3779, the ICE Out of Our Faces Act, introduced in February 2026 by Senator Markey with Senators Merkley and Wyden, which would bar Immigration and Customs Enforcement and Customs and Border Protection from using facial recognition inside the United States and require deletion of previously collected data within 30 days. As of this writing neither bill has passed both chambers.

One narrow federal program is already live and is not a privacy law: the Department of Homeland Security operates a statutorily mandated biometric entry-exit system that scans faces at international arrivals and departures. A December 2025 DHS rule expanded CBP's authority to collect facial biometrics from non-citizens entering or leaving the country. TSA checkpoint facial recognition remains opt-out for US citizens.

On December 11, 2025, President Trump signed Executive Order 14365, "Ensuring a National Policy Framework for Artificial Intelligence." The order directs the Attorney General to stand up an AI Litigation Task Force within 30 days to challenge state AI laws on preemption and dormant Commerce Clause theories, directs the Commerce Department to publish an evaluation of "onerous" state AI laws, and authorizes conditioning some federal grants on states not enforcing conflicting laws. The order's stated focus is algorithmic discrimination and compelled disclosures about AI outputs; its text does not name facial recognition or biometric-privacy statutes such as Illinois's BIPA. Legal commentators have generally agreed that an executive order alone cannot preempt a state statute without congressional action, so its practical effect runs through litigation threats and funding leverage rather than automatic repeal. Treat this as an unresolved, live conflict to watch, not a settled fact about any specific state law's survival.

The Federal Trade Commission has used its general unfairness authority to police facial recognition in the private sector. The FTC announced in December 2023 that it had reached a settlement banning Rite Aid Corporation from using facial recognition technology for surveillance purposes for five years, after finding the pharmacy chain had deployed AI facial recognition in hundreds of stores from 2012 to 2020 to flag suspected shoplifters, producing erroneous matches that led to customers being wrongly accused.

How Police Use Facial Recognition: A Lead, Not Proof

An atomic answer for AEO: Police typically use facial recognition technology to generate an investigative lead by running a photo, such as a surveillance still or a booking image, against a database of enrolled faces. A resulting "match" is a candidate for further investigation, not a positive identification, and most state rules that address the technology directly bar a match from serving as the sole basis for probable cause.

The distinction between a lead and proof is not a technicality. Facial recognition software returns a ranked list of candidates with confidence scores, not a certainty. When an officer or prosecutor treats a high-confidence candidate as if it were a fingerprint match, the system fails in a specific, predictable way. That is what the discovery process, and the wrongful-arrest cases below, exist to check.

Williams v. City of Detroit is the case most often cited for this problem. In January 2020, Robert Williams was wrongfully arrested after a blurry 2018 surveillance image from a Shinola store theft was incorrectly matched to his expired driver's license photo. He was detained for roughly 30 hours. The ACLU filed suit in April 2021, and the case settled on June 28, 2024, in what the ACLU and University of Michigan Law described as producing some of the strongest police department facial recognition policies in the country. Under the settlement, the Detroit Police Department cannot rely on an FRT match alone to build a photo lineup or establish probable cause, officers must be trained on the technology's bias and reliability limits, and the department adopted a formal directive after a Board of Police Commissioners review. It is the first case nationally where FRT policy changes were negotiated as part of a wrongful-arrest settlement rather than left to a legislature.

A newer case follows the same pattern. In June 2026, the ACLU filed Dillon v. City of Jacksonville Beach on behalf of a Florida man who alleges he was wrongly arrested after a facial recognition system returned a 93 percent confidence match on a photo that was not actually him. The lawsuit's allegations are unproven, and the case is pending, but it illustrates the same underlying risk Williams raised nationally five years earlier: a high confidence score is not the same thing as a correct identification, and an officer who treats it as proof rather than a lead can build a warrant affidavit on a foundation the technology itself was never designed to support.

When a Match Goes to Court: The Discovery Fight

Once a facial recognition lead becomes part of a criminal case, a separate legal question arises: what does the defense get to see about how that lead was generated? On June 24, 2026, the New Jersey Supreme Court answered that question in State v. Miles, ruling that criminal defendants are entitled in discovery to the facial recognition software's name, its published error rates, the original probe photo used for the search, and the other candidate matches the system returned alongside the defendant's photo. The court did not require the government to turn over the software's underlying source code, drawing a line between what a defendant needs to test the identification against and what a vendor can keep as a trade secret.

That ruling matters beyond New Jersey because it addresses a gap most state FRT statutes do not: even where a state requires a warrant or a human review step before a search, it says little about what a defendant is entitled to know once that search becomes evidence in their case. A defense lawyer who cannot learn a system's error rate, or see the other candidates it returned, cannot meaningfully challenge whether a match was reliable.

State Rules for Police and Government Use of Facial Recognition

A handful of states have passed statutes specifically governing when and how a government agency can use facial recognition technology. The rules below reflect the source cited for each state; where a detail could not be independently confirmed, it is described as reported rather than stated as settled fact.

Virginia is the state most likely to be described incorrectly right now, because its rules just changed and the change ran the opposite direction from how it has been widely reported. Virginia banned local and campus law-enforcement use of facial recognition outright in 2021 (2021 Sp. Sess. I, c. 537): no local or campus police agency may purchase or deploy FRT unless a separate statute expressly authorizes it, and a statute that does not mention facial recognition does not count as authorization. In 2022, c. 737 layered a temporary, detailed authorized-use regime on top of that ban for the Virginia State Police (new Va. Code § 52-4.5) and, for local and campus police, amended § 15.2-1723.2 and § 23.1-815.1 to permit FRT for 14 enumerated purposes under guardrails: a publicly posted policy, an annual usage report due April 1, a requirement that any algorithm score at least 98 percent true positive accuracy on a NIST Face Recognition Vendor Test, and a bar on using a match alone to establish probable cause. The 2022 act itself said so in its closing line: "the provisions of this act shall expire on July 1, 2026."

That is what happened. Virginia's local and campus police rules changed on that date, but the detailed regime did not newly take effect then, it expired then. As of this writing, the Code of Virginia's official text of §§ 15.2-1723.2 and 23.1-815.1 has reverted to the original 2021 ban language: no local or campus police agency may purchase or deploy facial recognition technology unless a different statute expressly authorizes it, and this research did not find such an authorizing statute currently on the books. Any FRT a local or campus department does use under an authorizing statute must stay under that agency's exclusive control, with data kept confidential and accessible only by warrant. The Department of State Police's § 52-4.5 authority carried the identical July 1, 2026 sunset, and the official Code of Virginia site shows no successor provision in its place; whether and how state police FRT use is currently authorized is unresolved as of this writing and should be confirmed directly with the Virginia State Police or the General Assembly before relying on it.

Massachusetts limits facial recognition searches under M.G.L. c. 6, § 220, part of the state's 2020 police reform law effective July 1, 2021. A law enforcement agency may perform a facial recognition search only to execute a court order based on specific and articulable facts supporting an ongoing criminal investigation or a substantial risk of harm, or without an order to identify a deceased person or address an imminent emergency. Agencies must document each search and report quarterly to the state's Executive Office of Public Safety and Security.

Maine has, by reputation among privacy advocates, the strictest state framework. A 2021 law (LD 1585, enacted as PL 2021, c. 394) bars state, county, and municipal departments, employees, and officials from using, possessing, or contracting for facial recognition technology, with narrow exceptions where there is probable cause an unidentified person in an image committed a serious crime, or to identify a missing or deceased person. An individual who believes the law was violated can seek injunctive or declaratory relief, and a violating public employee faces discipline up to termination. This description is based on the ACLU of Maine's summary of the enacted law and contemporaneous reporting; the specific codified section number in the Maine Revised Statutes was not independently confirmed for this article.

Vermont imposed a moratorium on law-enforcement facial recognition use through S.124 (2020), codified at 20 V.S.A. § 4622. As enacted, state law enforcement may not use facial recognition technology, or information acquired through it, without future legislative authorization, with a narrow carve-out tied to drone-based data collection where the use is limited to a specific investigative target.

Montana enacted SB 397 in July 2023, codified at Mont. Code Ann. Title 44, Chapter 15 (§§ 44-15-105, -106, and -108). The law bans "continuous facial surveillance," meaning ongoing monitoring of public places or third-party image sets matched against a prepopulated watchlist, outright. Outside that ban, a law enforcement agency generally needs a warrant to run a facial recognition search, with an exception for an imminent threat to safety, and a match alone cannot establish probable cause. The law also requires meaningful human review of any identification before it is acted on.

Utah centralizes facial recognition authority under Title 77, Chapter 23e of the Utah Code, restricting comparisons against state-maintained or state-shared image databases to the Department of Public Safety, a narrower model than most states that let any agency run its own searches. Permitted purposes include felony investigations, violent crimes, and identifying deceased, incapacitated, or at-risk individuals. A 2024 amendment added a warrant requirement on top of the existing serious-crime limitation.

Connecticut took a different approach entirely in 2026, and it is worth being precise about what its new law does and does not do. Public Act 26-64, signed by Governor Lamont on May 27, 2026, amends the Connecticut Data Privacy Act to require businesses using facial recognition technology on their premises to post clearly legible signage at every public entrance, with a QR code or link to the business's facial-recognition policy. That signage duty begins October 1, 2026, with Attorney General enforcement starting February 1, 2027. This is a private-business notice requirement, not a restriction on police use of the technology, and should not be read as Connecticut regulating law-enforcement FRT the way Virginia or Massachusetts do.

New Jersey has no confirmed statewide statute or Attorney General directive governing general police use of facial recognition. What is confirmed is narrower: in January 2020, then-Attorney General Gurbir Grewal directed New Jersey police departments to stop using the Clearview AI app specifically. The AG's office solicited public comment toward a possible broader statewide FRT policy in February 2022, but no evidence was found that a final statewide directive was ever issued. Treat any claim of a general New Jersey police FRT statute as unconfirmed.

Which States and Cities Restrict Facial Recognition? A Restriction Tracker

The table below is illustrative, not a complete 50-state or nationwide-city survey; it lists the jurisdictions where this article's research could confirm a specific instrument and its current status. City ordinances on this topic move quickly and sometimes reverse, so treat "status" as the most recent confirmed information rather than a permanent fact, and verify directly with the jurisdiction before relying on any row for a specific decision.

Watch out: A city or state that "banned" facial recognition in 2019 or 2020 is not necessarily still banning it today, and the reverse is just as true: a regulated-use framework can lapse back into a ban. New Orleans reversed its ban in 2022, Baltimore's private-sector ban lapsed on its own sunset clause the same year without a replacement, and Virginia's detailed 2022 authorization framework for local and campus police carried a July 1, 2026 sunset clause that expired rather than newly took effect, reverting those agencies to a statutory ban. Confirm current status before relying on a jurisdiction's older reputation, or on press coverage of a law with a built-in expiration date.

Private Companies, Consumer Devices, and Biometric Privacy Law

Everything above concerns government and police use of facial recognition. A separate, older body of state law covers private businesses collecting biometric data, including faceprints, for commercial purposes, most prominently Illinois's Biometric Information Privacy Act (BIPA), Texas's Capture or Use of Biometric Identifier Act (CUBI), and Washington's RCW 19.375. That consumer-privacy layer is covered in full in this site's Biometric Privacy Laws by State guide and its BIPA hub; it is not duplicated here. Three recent controversies show how the government and commercial layers intersect.

Clearview AI, the facial recognition company that scrapes billions of images from the public internet to build its search database, tried to resolve a nationwide BIPA class action in an unusual way, and the attempt has since unraveled. The settlement, reached in June 2024, would have given the plaintiff class a 23 percent equity stake in Clearview AI, valued at roughly $51.75 million based on a January 2024 company valuation, rather than a cash payment. A federal district judge granted final approval on March 20, 2025 over the objection of a coalition of 22 state attorneys general and the District of Columbia, who argued the equity stake was speculative relief. Objecting class members appealed that approval, and in mid-July 2026, the Seventh Circuit Court of Appeals vacated it and sent the case back to the district court, holding that the settlement's unequal share allocation across state-based subclasses (Illinois class members received 10 shares, several other states 5, everyone else 1) created a structural conflict of interest among the class representatives under Federal Rule of Civil Procedure 23. As of this writing the settlement has been set aside, the litigation is active again, and there is no new settlement or trial date.

Amazon's Ring is the subject of a June 2026 class action, Sigwalt v. Amazon.com, alleging its "Familiar Faces" feature scans the faceprints of non-users, people who never signed up for Ring, without their consent. The complaint itself notes that Ring withholds the Familiar Faces feature in Illinois, Texas, and Portland, Oregon specifically because of those jurisdictions' stricter biometric laws, which is itself a useful illustration of how a state biometric statute changes a national product's default behavior rather than only creating a lawsuit risk after the fact. A near-identical pair of proposed class actions followed against a competing product in Google's Nest doorbell: Fennessy v. Google and Trevino v. Google, both filed in the Northern District of California in the summer of 2026, allege Nest's "Familiar Face Detection" scans bystanders who never bought or set up the device, and again describe Illinois as the one place Google disables the feature by default.

Madison Square Garden used facial recognition beginning in June 2021 to identify and deny entry to attorneys at more than 90 law firms that had active litigation against MSG's subsidiaries, using photos scraped from those firms' own websites. New York Attorney General Letitia James opened an inquiry in January 2023, questioning whether the practice violated state civil rights protections against retaliation. According to later reporting, an appellate court allowed the underlying exclusion policy to remain in place on the specific claims tested so far, meaning the policy was not struck down at that stage. A newer and legally distinct controversy followed in June 2026, when proposed class actions accused MSG Entertainment of a facial-recognition data breach exposing entry records; those negligence claims remain unproven and are a data-security question separate from the entry-ban policy itself.

Your Rights: Practical Questions

Can police run my photo through facial recognition? It depends entirely on where you are. In Maine and Vermont, government use is banned outright with narrow exceptions; Virginia's local and campus police reverted to a similar ban on July 1, 2026 when their 2022 authorization framework's sunset clause expired. In Massachusetts, Montana, and Utah, police can use FRT but only within statutory limits, generally a warrant or court order, an accuracy floor, or a serious-crime threshold. In most states, there is no FRT-specific statute at all, which means the legal basis for a search is whatever the agency's internal policy says, not a law a resident can point to.

Can stores or businesses scan my face? That is a different legal question from anything on this page. States including Illinois, Texas, Washington, Colorado, and Maryland, along with cities such as New York and Portland, place notice or consent requirements on private businesses collecting biometric data. See Biometric Privacy Laws by State for how that works state by state, since the rules for a retailer's camera are governed by consumer-privacy statutes, not the police-use rules described above.

What should I do if I believe I was wrongly arrested because of a facial recognition match? This is general information, not legal advice for your situation. Both Williams v. City of Detroit and the pending Dillon v. City of Jacksonville Beach case proceeded through a civil rights lawsuit after the underlying criminal matter, with counsel from the ACLU. A person in that position typically needs to document the arrest and any facial recognition evidence referenced in the police report or warrant affidavit, and consult a lawyer licensed in their state promptly, since civil rights claims carry filing deadlines that vary by jurisdiction.

Related Resources

• Automated License Plate Reader (ALPR) Laws covers the closely related vehicle-tracking technology many of the same police departments also use.
• Surveillance Camera Laws by State covers the general legal framework for security and public cameras.
• Biometric Privacy Laws by State covers private-sector collection of biometric data, including BIPA, CUBI, and similar state statutes.
• Illinois BIPA: Do I Have a Claim? covers how to evaluate a potential claim under Illinois's biometric statute.
• Oregon Police Bodycam Laws covers a state that separately restricts facial recognition on bodycam footage.
• Amazon Ring Sued Over "Familiar Faces" Facial Recognition, Google Nest Doorbell Facial Recognition Lawsuits, NJ Supreme Court Sets Facial-Recognition Discovery Floor, Virginia Police Facial Recognition Rules, Connecticut Requires Facial-Recognition Signs, Florida Man Sues Police Over Facial Recognition Arrest, and Madison Square Garden Faces Class Actions Over a Facial-Recognition Data Breach cover the current cases and laws referenced throughout this article.

---

Last updated: 2026-08-14.