Facial Recognition Technologies

States Regulated Facial Recognition and Biometric Data Use

After decades of failed research, facial recognition took off when programmers utilized “facial geometry” to turn faces into math problems that AI algorithms could solve. The new technique accelerated the accuracy of facial recognition software to the point that tech companies use facial recognition to unlock user devices or recognize and tag friends in photos, and law enforcement has used the technology to identify suspects. However, even after these advances, the technology has raised concerns from researchers over bias with studies showing it is less accurate when used on women and people of color.

The National Institute of Standards and Technology (NIST), an agency of the U.S. Department of Commerce, actually provides the most respected industry benchmark to test the accuracy of facial recognition technologies. And that’s one reason why President Biden’s recent AI executive order tasked NIST with setting the standards to test AI systems for safety.

Policymakers quickly became skeptical of facial recognition, especially when used on the public without consent. States initially moved forward but eventually backtracked on broadly banning facial recognition use by law enforcement. However, the leader in regulating how technology like facial recognition is used is Illinois.

In 2008, lawmakers enacted the Illinois Biometric Information Privacy Act (BIPA). The idea behind BIPA was spurred by a staffer at the Illinois ACLU after he observed that a local supermarket offered customers the option to pay using a fingerprint. The definition of biometric identifiers in the law includes facial geometry in addition to fingerprints, voiceprints, and retina scans. Under Illinois’ BIPA, companies collecting biometric data from individuals (1) must publish a general notice about the company’s biometric data period; (2) must provide specific notice and obtain consent from anyone whose biometric information is collected; and (3) are prohibited from selling or trading the personal biometric information for profit. Critically, BIPA provides a private right of action for anyone whose biometric information is violated under the law. And this has led to a flood of class action lawsuits.

Notably, Washington and Texas have also enacted biometric privacy laws, but neither of these statutes includes a private right of action for citizens to bring their own lawsuits. While no state has matched the reach of Illinois’ BIPA law, policymakers’ interest in privacy protections has only grown. And with the onset of proliferating AI technology, the AI regulatory debate will be closely entwined with the policy protection laws stacking up in the states.