Biometric data regulation governs the collection, storage, use, and sharing of biometric identifiers — including fingerprints, voiceprints, iris scans, facial geometry, gait analysis, and other physiological or behavioral characteristics. Illinois' Biometric Information Privacy Act (BIPA) pioneered this area, and numerous states have followed with their own biometric privacy frameworks.
Key compliance requirements include obtaining informed written consent before collection, establishing retention and destruction schedules, prohibiting the sale of biometric data, and providing private rights of action for violations. Penalties under biometric privacy laws can be substantial, as demonstrated by landmark BIPA class action settlements.
Prohibit Surveillance Price & Wage Setting
Colorado's HB 26-1210 would have banned individualized price and wage setting: using an algorithm that applies statistical modeling, data analytics, AI or similar techniques to surveillance data about a person's characteristics, online behavior or biometrics, as more than a de minimis factor in the price offered to a consumer or the wage offered to a worker. Cost-based, supply-and-demand, public-discount, loyalty and need-based pricing, consumer-report credit refusals, and wages based solely on seniority or hired-for tasks and performance with plain-language disclosure, would have been allowed. Violations would have been deceptive trade practices. Vetoed by the Governor on June 2, 2026.
Data brokers: data collection and deletion.
California's SB 361 expands what data brokers must report when registering with the California Privacy Protection Agency. Registrations must say whether the broker collects data such as account logins, government ID numbers, citizenship or immigration status, union membership, sexual orientation, gender identity or biometric data, and whether in the past year it shared or sold consumers' data to a developer of a generative AI system or model, a foreign actor, governments or law enforcement. Signed October 8, 2025 (Chapter 466); effective January 1, 2026.
An act relating to consumer data privacy
Vermont's S.93 (2025-2026 biennium) would have enacted a consumer data privacy law applying to businesses that process personal data of at least 100,000 consumers, or at least 25,000 consumers while deriving over 25 percent of revenue from selling data. It would have given consumers rights including opting out of profiling for solely automated decisions with legal or similarly significant effects, required consent for sensitive data including biometrics, and given the Attorney General exclusive enforcement. It died in committee after referral on February 27, 2025.
Relating to pornography access for minors
West Virginia's SB 498 (2026 regular session) would have added W. Va. Code 61-8A-6, requiring commercial adult websites (where sexually explicit material is more than 25% of content) to verify age with biometric facial recognition, a government-issued ID and an adult's credit card, repeated every 24 hours, without storing biometric data after verification. Penalties would include $1 million per violation and civil damages. It was sent to Senate Judiciary on January 19, 2026 and died when the session ended March 14, 2026.
An Act to implement the recommendations of the special commission on facial recognition technology
Massachusetts' H 4359 (193rd General Court, 2023-2024) would have made it unlawful for law enforcement to use biometric surveillance technology, including facial recognition, absent express legal authorization. The registrar of motor vehicles could use facial recognition to verify identity for licenses, and State Police could run searches for limited purposes such as a judge-authorized warrant for a felony or an emergency. Reported by Judiciary and sent to House Ways and Means on February 12, 2024, it saw no further action and died with the session.
Provides relative to prohibiting surveillance-based price discrimination
Louisiana's HB471 would have made 'surveillance-based price discrimination' an unfair or deceptive trade practice, so that no person could engage in it. It defines surveillance data, behaviors, biometrics and automated decision systems, and exempts cost-justified price differences, certain equal-terms discounts and refusals based on a Fair Credit Reporting Act consumer report. It was considered in House Commerce April 22, 2026 and died. A Senate bill on the same subject, SB362, also died.
Biometric data and license plate readers-regulation.
Wyoming's HB 0181 (2026) would have barred governmental entities from using biometric data to identify or verify people, geolocation data to locate people or vehicles, and automatic license plate reader (ALPR) systems to identify vehicles, with narrow law enforcement exceptions (mostly warrant-based), a seven-day retention limit for data not tied to an investigation, and a civil action for damages or injunctive relief. Received for introduction February 11, 2026; the House did not consider it for introduction on February 13, 2026, so it died.
Video Lottery Games, Table Games And Sports Wagering--the Rhode Island Consumer Protection Gaming Act
Rhode Island S 2491 (2022), as introduced on March 1, 2022, would amend the Consumer Protection Gaming Act to bar facial recognition technology and biometric recognition programs in video-lottery terminals at pari-mutuel licensees and in online betting applications. It would also prohibit algorithmic programs that use a gaming consumer's betting history to increase wagering, and AI or automated decision systems that promote play through intermittent reinforcement. The text states no penalties and takes effect upon passage.
Relating to biometric identifiers used in the performance of artificial intelligence.
Texas SB 2490 (2025), as introduced, would have amended Business & Commerce Code Sec. 503.001 (biometric identifiers) to define artificial intelligence and add Subsection (f) exempting AI-related training, processing or storage of biometric identifiers, unless done to uniquely identify a specific individual or the identifier is later used for another and separate commercial purpose. It states no penalty amounts. No enrolled version exists, so it died June 2, 2025.
Facial recognition technology, use of match as the sole basis of probable cause or arrest, prohibited
Alabama's SB 56 (Act 2022-420) bars state and local law enforcement agencies from using facial recognition technology match results as the sole basis to establish probable cause in a criminal investigation or to make an arrest; match results may be used for those purposes only together with other lawfully obtained information and evidence. Facial recognition technology is software that, to try to identify an unknown person, generates facial biometric data (a facial template), searches a database of many people's templates linked to identifying information, and returns matches by similarity. Signed April 14, 2022; effective July 1, 2022.
Prohibits the use of biometric surveillance technology by law enforcement; establishes the biometric surveillance regulation task force; and provides for the expiration and repeal of certain provisions
New York's A 1045 would bar police agencies, police officers, peace officers and state police members from acquiring, possessing, accessing or using any biometric surveillance system, or information derived from one, in their duties, and let a person sue for equitable or declaratory relief. Mobile fingerprint scanning, DNA index and fingerprint database comparisons are excepted. It would create a 12-member task force reporting between 2029 and 2030. Introduced January 8, 2025 and referred to the Governmental Operations Committee; it has not passed either house.
ICE Out of Our Faces Act
The federal S. 3779 (ICE Out of Our Faces Act) would make it unlawful for any covered immigration officer (officers, employees, agents and contractors of ICE or CBP and officials deputized under INA section 287(g)) to acquire, possess, access or use in the United States any biometric surveillance system, including facial recognition, or information from one run by another entity. Data collected would have to be deleted within 30 days after enactment. Introduced February 4, 2026 and referred to the Senate Homeland Security and Governmental Affairs Committee; no further action.
BIOMETRIC DATA-COMMERCIAL USE
Illinois's HB 2411 (100th General Assembly) would have amended Section 15 of the Biometric Information Privacy Act to bar a private entity from requiring a person or customer to provide a biometric identifier or biometric information as a condition of goods or services, except as needed for employer background checks or employee security protocols. It would not have applied to companies providing medical services, law enforcement agencies or governmental entities. It was not passed before the 100th General Assembly ended (Session Sine Die, January 8, 2019).
BIOMETRIC DATA-COMMERCIAL USE
Illinois's HB 4330 (100th General Assembly) would have amended Section 15 of the Biometric Information Privacy Act to bar a private entity from requiring a person or customer to provide a biometric identifier or biometric information as a condition of goods or services, except as needed for employer background checks or employee security protocols. It would not have applied to companies providing medical services, law enforcement agencies or governmental entities. It was not passed before the 100th General Assembly ended (Session Sine Die, January 8, 2019).
Providing for the modernization of notarization and the county register of deeds process with respect to real estate documents for the purpose of mitigation of real estate document-related fraud, requiring the development, implementation and administration of a two-tiered authentication system for…
HB2309 aims to modernize notarization and the county register of deeds process to reduce real estate document fraud, requiring new authentication systems and allowing fraud investigations.
Artificial Intelligence Training Data Transparency Act; transparency and disclosure requirements.
Virginia's HB 2250 (2025 Regular Session) would have amended the Consumer Data Protection Act and added an Artificial Intelligence Training Data Transparency Act (new Title 59.1 chapter, §§ 59.1-607 through 59.1-611) with requirements for generative AI developers. It would also have allowed third-party opt-out of data processing and required consent to process adolescents' data. Left in committee on February 4, 2025; it failed.
AN ACT to amend Tennessee Code Annotated, Title 10; Title 24 and Title 38, relative to historical location data.
Tennessee's HB2608 (114th General Assembly), the "Protecting Everyone from Excessive Police Surveillance (PEEPS) Act," would have barred government officials, including government contractors, from accessing a database (including license plate, facial recognition, biometric or cellular location data) that reveals a person's or vehicle's location more than 24 hours earlier, except with a felony search warrant, consent, exigent circumstances or other listed cases. Companion: SB 2215. Not passed before the session ended in April 2026; last action: Taken off notice for cal in s/c Criminal Justice Subcommittee of Judiciary Committee (March 25, 2026).
Video Lottery Games, Table Games And Sports Wagering--the Rhode Island Consumer Protection Gaming Act
Rhode Island H 7222 (2022), as introduced on January 26, 2022, would amend the Consumer Protection Gaming Act to bar facial recognition technology and biometric recognition programs in video-lottery terminals at pari-mutuel licensees and in online betting applications. It would also prohibit algorithmic programs that use a gaming consumer's betting history to increase wagering, and AI or automated decision systems that promote play through intermittent reinforcement. The text states no penalties and takes effect upon passage.
Surveillance and Investigatory Technology Amendments
Utah's H.B. 606 (Rep. Ryan D. Wilcox), Surveillance and Investigatory Technology Amendments, would have limited a law enforcement agency's use of surveillance or investigatory technology, defined to include facial recognition systems, biometric surveillance information, and location tracking, with "technology" defined to include AI technology. The limits would start July 1, 2027. The enacting clause was struck and the bill filed as not passed on March 6, 2026.
Ban on government social scoring with AI.
Wyoming's HB 91 (as introduced) would create W.S. 9-30-101 through 9-30-103 barring a governmental entity from using an AI system to evaluate or classify people on social behavior or personal characteristics to assign a social score that could lead to unrelated-context or disproportionate treatment or infringe rights, and from using AI to identify a person by biometric data or bulk image gathering in ways that infringe rights. A committee amendment would add law-enforcement exceptions. It would take effect July 1, 2026. The House Judiciary Committee recommended it amend and do pass 7-1, but the House did not consider it in Committee of the Whole; it died.
Providing for the modernization of notarization and the notary public process with respect to real estate documents for the purpose of mitigation of real estate document-related fraud, requiring the development, implementation and administration of a two-tiered authentication system for…
HB2696 aims to modernize the notarization process for real estate documents in Kansas to mitigate document-related fraud by implementing a two-tiered authentication system and requiring 3D biometric antifraud technology by December 31, 2027.
Relating to regulation of the use of artificial intelligence systems in this state; providing civil penalties.
Texas's HB 149, the Texas Responsible Artificial Intelligence Governance Act, bars developing or deploying AI intended to incite self-harm, harm to others or crime, with intent to unlawfully discriminate against a protected class (disparate impact alone is not enough), or solely to infringe U.S. constitutional rights, and making or distributing AI solely to produce or spread child pornography or unlawful sexual deep fakes. Government entities may not use AI for harmful social scoring or rights-infringing biometric ID. Agencies must tell consumers they are dealing with AI; health care providers must tell patients. AG enforcement; 60-day cure. Signed June 22, 2025; effective January 1, 2026.
Relating to biometric identifiers used in the performance of artificial intelligence.
Texas HB 3755 (2025), as introduced, would have amended Business & Commerce Code Sec. 503.001 (the biometric identifier law) to define artificial intelligence and to exempt AI training, processing, or storage unless done to uniquely identify a specific individual. If a biometric identifier captured for an AI commercial purpose were used for another, separate commercial purpose, the holder would become subject to the section's possession, destruction and penalty rules. It died when the regular session adjourned June 2, 2025.
To protect biometric information
Massachusetts H 63 (2023-2024) would have added a new chapter 93M to the General Laws restricting how private entities collect and process biometric information, including face geometry, with consent, a written privacy policy and a ban on monetizing the data. It did not pass: on May 13, 2024 the committee folded it into new draft H4632 (the Massachusetts Data Privacy Act), which was sent to House Ways and Means and recorded 'No further action taken' on December 31, 2024, when the session ended.
Artificial Intelligence & Biometric Technologies
Colorado's HB 24-1468 repealed and reenacted the facial recognition task force created by SB 22-113 as the Artificial Intelligence Impact Task Force. Membership grew from 15 to 26, and the focus widened from government use of facial recognition to protections for consumers and workers from AI and automated decision systems: definitions, transparency and disclosure rules, algorithmic discrimination, best practices and metrics, and facial recognition and biometric technology. It had to meet by September 1, 2024 and report by February 1, 2025, and is set to be repealed September 1, 2027. Signed June 6, 2024 (Chapter 467); effective on signature.
Provides that surveillance-based price discrimination is an unfair or deceptive trade practice or act. (8/1/26)
Louisiana's SB362 would have made 'surveillance-based price discrimination' an unfair or deceptive trade practice, so that no person could engage in it. The bill defines surveillance data, behaviors and biometrics, mentions automated decision systems, and exempts cost-based price differences, equal-terms discounts and credit refusals based on a Fair Credit Reporting Act report. It was considered in committee April 22, 2026 and died.
Governmental Use of Facial Recognition Technology
Utah SB 34 (2021) enacts Utah Code Title 77, Chapter 23e on government use of facial recognition technology, defined as a computer system that uses an algorithm to compare facial biometric data of an unknown person with known individuals. Only the Department of Public Safety may run facial recognition comparisons against image databases it shares or maintains, and only under listed conditions and a set request process. Employees must be trained, the public must be notified when a government entity uses facial recognition on images it takes, and the law sets which comparison records are public or protected.
An act relating to consumer data privacy and online surveillance
Vermont's H.208 (2025-2026 biennium) would have enacted a consumer data privacy and online surveillance law applying to businesses processing data of at least 25,000 consumers, or 12,500 consumers with over 25 percent of revenue from selling data. Consumers could learn whether their data is used in an AI system and opt out of profiling for automated decisions; sensitive data including biometric and neural data would be limited. It would have taken effect July 1, 2026. It was referred to House Commerce on February 12, 2025 and died.
Law enforcement: facial recognition and other biometric surveillance.
California's AB 1215 added Penal Code § 832.19, which barred law enforcement agencies and officers from installing, activating or using any biometric surveillance system, such as facial recognition, in connection with an officer camera (a body-worn camera or similar device) or its data, including by having another agency or a third party run it for them. Anyone could sue for equitable or declaratory relief. The section was repealed by its own terms on January 1, 2023, so the ban is no longer in effect. Signed October 8, 2019 (Chapter 579); effective January 1, 2020.
An act relating to public safety; ... regulating the use of unmanned aerial vehicles by law enforcement ... (Laws 2020, chapter 82)
Minnesota's Laws 2020, chapter 82 created Minn. Stat. 626.19 on law enforcement use of unmanned aerial vehicles (drones). Drones generally require a warrant, with listed exceptions, and under subdivision 4(b) an agency must not deploy a drone with facial recognition or other biometric-matching technology unless expressly authorized by a warrant. Agencies also may not arm drones or use them to collect data on protests without a warrant, evidence gathered in violation is inadmissible, and agencies must adopt written policies by Feb. 15, 2021. Section 626.19 took effect Aug. 1, 2020.
Relating To Law Enforcement.
Hawaii's Senate Bill 2049 (2026) would have barred law enforcement agencies and officers from using biometric surveillance technology, meaning software that performs facial recognition or other remote biometric recognition, on any person. Exceptions would have covered reasonable suspicion of a crime, executing a judge-authorized warrant based on probable cause that an unidentified or unconfirmed person in an image committed a crime, and emergencies involving immediate danger of death or serious injury. It was referred to committees January 22, 2026 and not enacted.
Public Surveillance Prohibition Amendments
Utah SB 231 (2024) defines biometric surveillance information as analysis of surveillance information using biometric software to identify a person or their location from physical attributes, and bars a government entity from obtaining it without a warrant, subject to listed exceptions. Entities must adopt policies on the use, management and auditing of such information. The act also amends the definition of a facial recognition comparison in the 2021 facial recognition chapter so it excludes biometric surveillance information. Effective May 1, 2024.
Law-enforcement agencies; surveillance technology reporting.
Virginia HB 1496 (2024) creates an annual inventory of police surveillance technology. Every state and local law-enforcement agency and sheriff's office must give the Department of Criminal Justice Services a list of the surveillance technologies it has procured by November 1 each year. Surveillance technology expressly includes biometric surveillance technology such as facial, voice, iris and gait recognition software and databases, and software that integrates or analyzes surveillance data, including predictive policing software. DCJS shares the lists with the State Crime Commission and the Joint Commission on Technology and Science. Effective July 1, 2024.
SCH CD-STUDENT BIOMETRIC INFO
Illinois's SB 1239 would amend the School Code to bar school districts from buying, acquiring, using or contracting for biometric systems, including facial recognition software, on students. Districts holding student biometric information would have to destroy it within 30 days after the Act takes effect. Filed January 24, 2025; re-referred to Assignments April 11, 2025; it has not passed either house.
ICE Out of Our Faces Act
The federal H.R. 7363 (ICE Out of Our Faces Act) would make it unlawful for any covered immigration officer (officers, employees, agents and contractors of ICE or CBP and officials deputized under INA section 287(g)) to acquire, possess, access or use in the United States any biometric surveillance system, including facial recognition, or information from one run by another entity. Data collected would have to be deleted within 30 days after enactment. Introduced February 4, 2026 and referred to the House Judiciary and Homeland Security committees (and the Border Security and Enforcement Subcommittee); no further action.
Relating To Consumer Protection.
Hawaii's SB 2036 (2026) would have added a new section to HRS chapter 481B prohibiting any person from engaging in 'surveillance pricing': offering or setting a customized price for a specific consumer or group based wholly or partly on information collected through electronic surveillance technology such as sensors, cameras, device tracking and biometric monitoring. A violation would be an unfair or deceptive practice under HRS 480-2. The Senate committee on LBT deferred it on February 11, 2026; it died.
Prohibits use of facial recognition technology on consumer except for legitimate safety purpose.
New Jersey's S3268 would make it an unlawful practice under the Consumer Fraud Act for a person selling goods or services at retail, or at a place of public accommodation, to use a biometric surveillance system (facial or other remote biometric recognition software) on a consumer, except for a legitimate safety purpose. Introduced February 2, 2026.
Prohibits the use of biometric identifying technology in schools for any reason other than certain specified purposes; adds fingerprint identification of teachers, administrators and students for the purpose of securely logging into a digital device for academic and administrative purpose to…
New York's A 6720-A would amend State Technology Law § 106-b so that public and nonpublic elementary and secondary schools, including charter schools, may not buy or use biometric identifying technology for any purpose, including school security, apart from listed uses. The bill would drop the current path under which the education commissioner can authorize it, and would add fingerprint logins to digital devices to the allowed uses. Introduced March 11, 2025, amended April 16, 2025 and referred to the Education Committee January 7, 2026; it has not passed either chamber.
Prohibits the use of biometric surveillance system or biometric surveillance information in places of public accommodation; prohibits entering into any agreement that authorizes any third party to use any biometric surveillance system or biometric surveillance information; provides penalties for…
New York's A 6211 (same as S 8004) would add Civil Rights Law § 40-h, making it unlawful for an owner, manager, employee or other agent of a place or provider of public accommodation to use a biometric surveillance system or biometric surveillance information, or to let a third party do so on its behalf. It would also require written notice and consent before collecting biometric information. Referred to the Assembly Governmental Operations Committee in February 2025 and again January 7, 2026; it has not passed either chamber.
Prohibits the use of biometric surveillance technology by law enforcement; establishes the biometric surveillance regulation task force; and provides for the expiration and repeal of certain provisions
New York's S 5609 (same as A 1045) would add Executive Law §§ 837-y and 236 to bar police agencies, police officers, peace officers and the state police from acquiring, possessing, accessing, installing, activating or using biometric surveillance systems (such as facial recognition) or information derived from them. A 12-member task force would study whether to allow police use. Reported from the Senate Internet and Technology Committee and committed to Codes February 25, 2026; it has not passed either chamber.
Requires legislative members to verify attendance on legislative session days via an identification card system and facial recognition technology.
New York's A 11119 would add Legislative Law § 5-c, requiring every member of the Assembly and Senate to verify daily attendance on session days through a biometric facial recognition system tied to an identification card in each chamber. A photograph taken when the card is used would confirm the cardholder is the elected member. Referred to the Assembly Governmental Operations Committee April 24, 2026; it has not passed either chamber.
Biometric Surveillance Act
Illinois's HB 5521 (104th General Assembly) would create the Illinois Biometric Surveillance Act. Law enforcement agencies could not obtain, retain, possess, access, request or use a biometric identification system, including through a third party or another government agency. It would give a private right of action and Attorney General enforcement. Re-referred to the House Rules Committee on March 27, 2026.
BIPA-IDOT TESTING VEHICLES
Illinois's HB 2593 (104th General Assembly) would amend Section 25 of the Biometric Information Privacy Act to add that nothing in the Act applies to companies registered with the Department of Transportation to conduct testing of autonomous vehicles. Re-referred to the House Rules Committee on March 21, 2025; the 104th General Assembly remains in session.
BIPA-VEHICLE SAFETY TECH
Illinois's HB 3292 (104th General Assembly) would amend Sections 10 and 25 of the Biometric Information Privacy Act to provide that nothing in the Act may be construed to apply to an entity using vehicle safety technology for a vehicle safety purpose. Last action: Rule 19(a) re-referral to the House Rules Committee on March 21, 2025, after assignment to Judiciary - Civil.
Prohibits the use of a wage-fixing algorithm in combination with personal or behavioral data to set or recommend wages or compensation
A 9638 would ban 'surveillance wages' in New York: employers could not use a wage-fixing algorithm, or its output, together with a worker's personal or behavioral data (such as financial, purchasing, browsing, biometric or location data, or profiles drawn from them) to set or recommend pay, whether the employer or a third party collects the data. Tools that use only job requirements, performance (not customer reviews), qualifications, labor market conditions or local cost of living are exempt. The Attorney General, the Labor Department and harmed workers could sue for the greater of actual damages or $3,000 per violation, tripled if willful. Pending in the Assembly Labor Committee.
Artificial Intelligence Consumer Protection Amendments
Utah's SB 226 replaces the 2024 generative AI disclosure rules with Utah Code Title 13, Chapter 75. A supplier using generative AI with an individual in a consumer transaction must disclose it is AI, not a human, if the individual clearly asks. Regulated professionals must prominently disclose generative AI at the start of high-risk interactions (collecting health, financial or biometric data, or personalized financial, legal, medical or mental health advice). AI that discloses itself at the outset and throughout gets a safe harbor. Fines up to $2,500 per violation. Signed March 27, 2025; effective May 7, 2025.
Extend Prohibition on School Facial Recognition
Colorado's SB 25-143 keeps the SB 22-113 ban on schools signing facial recognition contracts by deleting its July 1, 2025 repeal date. Contracts in effect April 18, 2025 stay allowed. New exceptions cover vendor tools used with board-approved curricula, which need opt-in consent, and safety uses: an articulable and significant threat, a missing student, or a person ordered to stay off school property. Safety systems may identify only the people involved and only while such a situation is occurring. Biometric identifiers may be kept no longer than 18 months, and aggrieved parties may seek an injunction. Signed and effective April 18, 2025 (Chapter 86).
AN ACT to amend Tennessee Code Annotated, Section 2-7-112 and Title 55, Chapter 50, relative to licenses.
Tennessee's HB 1316 (Public Chapter 297) renames the electronic driver license system the digital driver license system and limits its data use. A vendor providing the license app may not capture or retain biometric identifiers (retina or iris scans, fingerprints, voiceprints, hand or face geometry) except a photograph used solely to compare with the license photo on file, and neither the vendor nor the Department of Safety may collect geolocation data. Data from using a digital license may be kept no more than three days and not sold. Digital licenses cannot be used as voter ID. Signed April 24, 2025 (Public Chapter 297); effective on signing.
Requires the department of transportation to collect data from third-party identification verification services used by airline passengers for expedited security screening in public-use airports and submit a quarterly report to the governor, the temporary president of the senate and the speaker of…
New York's A 8209 would add Transportation Law § 14-o requiring each third-party identification verification service operating in the state (a private service using biometric data, including fingerprint and facial recognition, for expedited access to airport security checkpoints) to report quarterly to the department on passenger use, TSA identity checks, passengers lacking proper identification, security breaches and kiosks. The department would report quarterly to the Governor and Legislature. Would take effect immediately. Introduced May 5, 2025 and referred to the Transportation Committee (again January 7, 2026); it has not passed either chamber.
relative to the regulation of artificial intelligence technologies.
New Hampshire's HB 1725 (2026) would have created RSA chapter 359-V, "Responsible Artificial Intelligence Governance": a 7-member AI council, AI interaction disclosures, bans on AI developed with intent to unlawfully discriminate or for social scoring, limits on government biometric identification, a regulatory sandbox, and attorney general enforcement with civil penalties. The House voted it Inexpedient to Legislate on February 19, 2026, and it died.
BIPA-SECURITY PURPOSES
Illinois's HB 5635 (103rd General Assembly) would have amended the Biometric Information Privacy Act to waive certain requirements for collecting biometric identifiers or information in circumstances relating to security purposes, exclude information captured by a biometric time clock or lock that converts it to a mathematical representation, and add a one-year filing period and a 30-day cure notice. Died at Session Sine Die on January 7, 2025.
Prohibits the use of biometric surveillance system or biometric surveillance information in places of public accommodation; prohibits entering into any agreement that authorizes any third party to use any biometric surveillance system or biometric surveillance information; provides penalties for…
New York's S 8004 would add Civil Rights Law § 40-h making it unlawful for an owner, franchisor, franchisee or other operator of a place or provider of public accommodation to use any biometric surveillance system or its information, or let a third party do so on its behalf. Collecting biometric information would require written notice, a stated purpose and term, and a written release. Violators and those who aid or incite them would owe the aggrieved person at least the greater of $1,000 or actual damages per violation, plus attorneys' fees. Referred to Investigations and Government Operations January 7, 2026; it has not passed either chamber.
Relates to banning the use of biometric identifying technology in schools
New York's S 9643 would amend State Technology Law § 106-b so public and nonpublic elementary and secondary schools, including charter schools, are "prohibited from purchasing or utilizing biometric identifying technology for any purpose, including school security." Limited uses stay allowed: fingerprinting of prospective employees, fingerprint logins to digital devices, and identifying employees who consent in writing. Passed the Senate 38-22 on June 1, 2026 and was referred to the Assembly Education Committee; it has not passed the Assembly.
To implement the recommendations of the special commission on facial recognition technology
Massachusetts H4640, a new draft of H1946, would replace G.L. c. 6, s. 220 to bar law enforcement from using facial recognition and other biometric surveillance except for State Police searches under set conditions (registrar identity checks, judge-authorized felony warrant, emergency, deceased identification, another agency's request). Reported favorably by the Judiciary Committee and referred to House Ways and Means October 23, 2025; it has not passed either chamber.
To implement the recommendations of the special commission on facial recognition technology
Massachusetts S1053 would replace G.L. c. 6, s. 220 to bar law enforcement from using facial recognition and other biometric surveillance except for State Police searches under set conditions (judge-authorized felony warrant, emergency, deceased identification, another agency's request). Reported favorably by the Judiciary Committee and referred to Senate Ways and Means September 29, 2025; it has not passed either chamber.
Prohibit Use of Personally Identifying Feature
Colorado's HB26-1049 would have made it a crime to use another person's fingerprint, voiceprint, retina or iris scan, or facial map in an advertisement, deepfake, image, video, voice recording, or other digital depiction without permission: a class 5 felony, or a class 4 felony if done to intentionally harm that person. A harmed person could sue for damages and attorney fees. The House committee postponed it indefinitely February 12, 2026; it is dead.
To provide accountability in the use of biometric recognition technology and comprehensive enforcement
Massachusetts S36 would add G.L. Chapter 110I regulating biometric recognition technology: covered entities owe duties of loyalty, care and confidentiality, may not sell biometric data, and may not install biometric recognition equipment in places open to the public. Referred to committee February 27, 2025; on May 12, 2025 it accompanied S43 (An Act to protect personal biometric data), which was referred to Senate Ways and Means.
AN ACT relating to violations of privacy.
Kentucky's SB 180 would make it unlawful, without a court-approved warrant, for state and local agencies to obtain or use facial recognition technology or information derived from it, and would set consent, retention and disclosure rules for private entities holding biometric identifiers. Violations could be enforced by private suits or the Attorney General, and facial-recognition evidence would be inadmissible in Kentucky proceedings. Introduced February 6, 2024; sent to the Senate Judiciary Committee February 8, 2024. It died when the 2024 session ended.
Establishing the Massachusetts Data Privacy Act
Massachusetts H104 would add G.L. Chapter 93M (the Massachusetts Data Privacy Act) and Chapter 93N (location data). Individuals could access, correct, delete and port covered data and opt out of profiling used for automated decisions with legal or similarly significant effects; biometric data is sensitive data. Referred to the Advanced Information Technology, the Internet and Cybersecurity Committee February 27, 2025; on November 17, 2025 it accompanied new draft H4746, which was referred to House Ways and Means that day.
Prohibits use of biometric surveillance system by business entity under certain circumstances.
New Jersey's S1464 would make it an unlawful practice under the Consumer Fraud Act for a business to use a biometric surveillance system (facial or other remote biometric recognition) on consumers at its premises unless it gives clear and conspicuous notice and has a lawful purpose. Businesses could not sell or profit from the data collected.
Prohibits collection of biometric identifier information by public or private entity under certain circumstances.
New Jersey's A3926 would bar public and private entities from collecting, retaining, converting, storing or sharing biometric identifier information unless they post clear, plain-language notice at every common entryway about their use of a biometric surveillance system. Penalties would be $5,000 for a first violation and $10,000 for later ones, with criminal grading for a pattern of violations.
Surveillance-based price setting prohibited.
Not law. Minnesota's HF 3408 would have added Minn. Stat. 325D.141 barring retail food stores from surveillance-based price setting, meaning customized prices based on personal information gathered through electronic surveillance technology such as cameras, device tracking, biometrics and facial recognition. Stores using facial recognition would post entrance signage, and larger stores' electronic shelf labels could change prices only once a day. It never left committee.
Prohibits the use of facial recognition and biometric information as the sole factor in determining the existence of probable cause to place in custody or arrest an individual.
New York's A 1447 would amend the Executive Law (new § 837-z) so that biometric identifying technology, including facial recognition, cannot be the sole factor in determining probable cause to place a person in custody or arrest them. By January 1, 2027, every municipal police department, sheriff's office and the State Police would have to adopt a written policy barring stops, detentions or searches solely motivated by the technology, or the Division of Criminal Justice Services would order a penalty of withheld state funds. Would take effect immediately. Referred to Governmental Operations January 7, 2026; it has not passed either chamber.
Prohibit surveillance-based price setting
Minnesota's SF 4199 would have prohibited retail food stores from surveillance-based price setting, meaning customized prices based on personal information gathered through electronic surveillance such as cameras, sensors, biometric data or facial recognition. It would also have required facial recognition signage and limited electronic shelf label price changes. Introduced March 9, 2026 and never left committee.
Prohibits the use of biometric identifying technology in schools for any reason other than certain specified purposes; adds fingerprint identification of teachers, administrators and students for the purpose of securely logging into a digital device for academic and administrative purpose to…
New York's S 3827-A would amend State Technology Law § 106-b so public and nonpublic elementary and secondary schools, including charter schools, are "prohibited from purchasing or utilizing biometric identifying technology for any purpose," including school security. Exceptions cover fingerprinting of prospective employees, fingerprint logins to digital devices and employees who consent in writing. Passed the Senate 38-21 on June 12, 2025 and was referred to the Assembly Education Committee; it has not passed the Assembly.
BIPA-VEHICLE SAFETY TECH
Illinois's SB 2051 (104th General Assembly) would amend Sections 10 and 25 of the Biometric Information Privacy Act to provide that nothing in the Act may be construed to apply to an entity using vehicle safety technology for a vehicle safety purpose. Filed February 6, 2025; last action: referred to the Senate Committee on Assignments that day.
Prohibits collection of biometric identifier information by public or private entity under certain circumstances.
New Jersey's S 1463 would bar public and private entities in the State from collecting, retaining, converting, storing or sharing biometric identifier information gathered through biometric surveillance systems (including facial, iris, retina, voice, fingerprint or palm recognition), but would let them collect it if they post clear notice at every common entryway. Violations would carry civil penalties of $5,000 and $10,000, and a pattern of violations would be a crime. Referred to the Senate Law and Public Safety Committee January 13, 2026; it has not passed either house.
MIND Act of 2025 Management of Individuals’ Neural Data Act of 2025
The federal S. 2925 (MIND Act of 2025) would direct the FTC to study the governance of neural data and related biometric and behavioral data, including how AI changes the risks, and report to Congress within 1 year after enactment, with $10,000,000 authorized. OSTP would then develop guidance, OMB would issue binding guidance, and federal agencies could not procure or operate neurotechnology that processes neural data inconsistently with it. Introduced September 29, 2025 and referred to the Senate Commerce Committee; no further action.
To prohibit the Federal Government from establishing or maintaining a database that contains data collected through, or facilitates, the biometric identity verification of a citizen of the United States, and for other purposes.
The federal H.R. 3693 would provide that an agency of the Federal Government "may not establish or maintain a database" that contains data collected through, or facilitates, the biometric identity verification of a citizen of the United States. It defines biometric identity verification as automated recognition of an individual based on biological or behavioral characteristics, including fingerprints, iris patterns or facial features. The one-section text has no penalties or effective date. Introduced June 3, 2025 and referred to the House Oversight and Government Reform Committee; no further action.
No Biometric Barriers to Housing Act of 2025
The federal H.R. 3060 (No Biometric Barriers to Housing Act of 2025) would, starting 1 year after enactment, bar owners of covered federally assisted rental housing from using or authorizing facial recognition, physical biometric or remote biometric recognition technology in a unit or its building or grounds for surveillance or any use that adversely affects tenants' fair access to housing. HUD must report within 1 year. Introduced April 29, 2025 and referred to the House Financial Services Committee; no further action.
Prohibits facial recognition technology to be used in connection with an officer camera used by both local and state police including the storage of biometric data.
New York's A 3712 would have added Executive Law §§ 837-x and 236 barring local police, peace officers and State Police from installing, activating or using facial recognition or biometric surveillance systems in connection with an officer camera or data collected by one. A person could sue the agency or officer for equitable or declaratory relief. A mobile fingerprint scanner exception applied. Would have taken effect on the ninetieth day after becoming law and expired five years later. Introduced February 7, 2023; it died at the end of the 2023-2024 session.
Video Lottery Games, Table Games And Sports Wagering -- The Rhode Island Consumer Protection Gaming Act
Rhode Island S 146 (2023), as introduced on February 1, 2023, would amend the Consumer Protection Gaming Act to bar facial recognition technology and biometric recognition programs in video-lottery terminals at pari-mutuel licensees and in online betting applications. It would also prohibit algorithmic programs that use a gaming consumer's betting history to increase wagering, and AI or automated decision systems that promote play through intermittent reinforcement. The text states no penalties and takes effect upon passage.
An Act advancing the economic development of the commonwealth through comprehensive data privacy
Massachusetts' S 301 would add a new chapter 93M to the General Laws, the Massachusetts Information Privacy and Security Act, a comprehensive data privacy law with defined terms such as consent (which excludes dark patterns), controller, data broker and biometric information. In the captured text, a large data holder's risk assessment would also have to say whether processing relies on an algorithmic process, such as machine learning or AI, and describe its design, input data and outputs. The bill accompanied a study order on December 18, 2025 and did not advance.
Prohibits the use of biometric surveillance technology by law enforcement; establishes the biometric surveillance regulation task force; and provides for the expiration and repeal of certain provisions
Not law. S 1033 would have barred New York police officers, peace officers and police agencies, including the State Police, from using biometric surveillance systems such as facial recognition, with exceptions such as lawful DNA comparison, fingerprinting and internal security systems. A 12-member task force would have studied the technology's accuracy, effectiveness and harms, especially to vulnerable groups, and recommended whether and how police could use it. The bill was recommitted and its enacting clause stricken on February 21, 2025, which ends it. The Assembly version, A 1045, has its own page.
Educ-Tech Rts/Biometric Info
Illinois's SB 3735 (104th General Assembly) would create the Student Educational Technologies Rights Act, giving students and parents rights to opt out of school-issued devices and predictive analytics and to request human review of AI-generated grades. It would bar school districts from acquiring biometric systems for students and limit operators from letting AI train on student data. Re-referred to Senate Assignments May 22, 2026.
Realigning Mobile Phone Biometrics for American Privacy Protection Act
The federal H.R. 7124 (Realigning Mobile Phone Biometrics for American Privacy Protection Act) would require the Secretary of Homeland Security, within 30 days after enactment, to develop standards and guidelines for DHS and its components that bar use of the Mobile Fortify and Mobile Identify mobile applications (and successors) except for identification at ports of entry, bar sharing them with other agencies, require their removal and remote disabling, and require destruction of images and fingerprints of U.S. citizens. Introduced January 15, 2026; referred to the House Homeland Security Committee and, January 16, to its Subcommittee on Border Security and Enforcement; no further action.
Relative to the use of artificial intelligence by state agencies.
New Hampshire's HB 1688 adds RSA chapter 5-D. State agencies may not use AI to classify people in ways that cause unlawful discrimination, use real-time remote biometric identification for public surveillance (except law enforcement with a warrant), or use deepfakes for deceptive or malicious purposes. Irreversible AI decisions need human review, generative AI material not reviewed by a human must be labeled, and users must be told when they interact with AI. Signed July 12, 2024 (Chapter 209); effective July 1, 2024.
ILLINOIS PRIVACY RIGHTS ACT
Illinois's HB 5581 (103rd General Assembly) would have created the Illinois Privacy Rights Act, giving consumers rights to access, correct, delete and obtain a copy of their personal data and to opt out of targeted advertising, sale, or profiling in furtherance of solely automated decisions with legal or similarly significant effects. It would apply only to entities above specified consumer-data thresholds. Died at Session Sine Die on January 7, 2025.
Prohibits use of facial recognition technology on consumer except for legitimate safety purpose.
New Jersey's S 968 (2024-2025 session, as introduced) would make it an unlawful practice under the Consumer Fraud Act for a person selling goods or services at retail, or operating a place of public accommodation, to use a biometric surveillance system (software that performs facial recognition or other remote biometric recognition) on a consumer, except for a legitimate safety purpose. The bill's statement says violations would carry penalties up to $10,000 for a first offense and $20,000 after. Introduced January 9, 2024 and referred to the Senate Commerce Committee; it died when the 2024-2025 session ended.
Technology; artificial intelligence; state agencies; prohibited uses; permitted uses; Office of Management and Enterprise Services; effective date.
Oklahoma's HB 3545 (2026), as engrossed, would have set rules for state agency use of AI: banning cognitive behavioral manipulation, discriminatory classification, real-time remote biometric identification in public spaces (with warrant and emergency exceptions) and deceptive deepfakes, and requiring human review of high-risk AI decisions. It passed the House 96-0 on March 11, 2026 and was referred to a Senate committee April 1, 2026; it died when the session ended May 14, 2026.
AN ACT to amend Tennessee Code Annotated, Title 10; Title 24 and Title 38, relative to historical location data.
Tennessee's SB2215 (114th General Assembly), the "Protecting Everyone from Excessive Police Surveillance (PEEPS) Act," would have barred government officials, including government contractors, from accessing a database (including license plate, facial recognition, biometric or cellular location data) that reveals a person's or vehicle's location more than 24 hours earlier, except with a felony search warrant, consent, exigent circumstances or other listed cases. Companion: HB 2608. Not passed before the session ended in April 2026; last action: Assigned to General Subcommittee of Senate Judiciary Committee (March 23, 2026).
Prohibits use of biometric surveillance system by business entity under certain circumstances.
New Jersey's A3929 would make it an unlawful practice under the Consumer Fraud Act for a business entity to use a biometric surveillance system, meaning facial or other remote biometric recognition software, on a consumer at its physical premises unless it gives clear notice and uses it for a lawful purpose. Businesses could not sell, share or profit from the information. This describes the bill as introduced (pre-filed text); later amendments, if any, are not reflected.
Directs the commissioner of education to conduct a study on the use of biometric identifying technology; prohibits the use of biometric identifying technology in schools until July 1, 2022 or until the commissioner authorizes such purchase or utilization, whichever occurs later.
New York's A 6787-D barred public and nonpublic elementary and secondary schools, including charter schools, from buying or using biometric identifying technology until July 1, 2022 or until the Commissioner of Education authorized it after a public report, whichever was later. As signed it added Education Law § 2-e; Chapter 2 of 2021 moved it to State Technology Law § 106-b, had the Office of Information Technology Services write the report, and allowed employee fingerprinting and consenting-employee uses. In September 2023 the Commissioner banned facial recognition in schools and left other biometrics to local decision. Signed December 22, 2020 (Chapter 349); effective immediately.
Relating To Traffic Safety.
Hawaii's HB 1231 (Act 212 of 2025) bars photo red light imaging detector systems and automated speed enforcement systems from using or being equipped with facial recognition software or biometric identification technology. Automated license plate readers and non-biometric technology used to verify vehicle identity or registration or to produce photographic evidence of a violation are exempt. It also requires each county to impose a $5 motor vehicle registration surcharge for the safe routes to school program by December 31, 2025, and revises the mailing rules for speed camera citations. Became Act 212 June 25, 2025; effective on approval.
Prohibits the use of facial recognition and biometric information as the sole factor in determining the existence of probable cause to place in custody or arrest an individual.
New York's A 519 (2023-2024) would have amended the Executive Law (new § 837-y) so that biometric identifying technology, including facial recognition, could not be the sole factor in determining probable cause to place a person in custody or arrest them. By January 1, 2025 every municipal police department, sheriff's office and the State Police would have had to adopt a written policy barring stops, detentions or searches solely motivated by such technology. Referred to Governmental Operations January 9, 2023 and January 3, 2024; it never passed and died at the end of the 2023-2024 session.
Prohibits the use of biometric surveillance technology by law enforcement; establishes the biometric surveillance regulation task force; provides for the expiration and repeal of certain provisions.
New York's S 1609 (2023-2024) would have added Executive Law sections 837-x and 236 prohibiting police agencies, officers, peace officers and State Police members from acquiring, possessing, accessing or using a biometric surveillance system, or information derived from one. Exceptions covered mobile fingerprint scanning, the State DNA index and the statewide fingerprint system. It also created a Task Force on the Regulation of Biometric Surveillance. Reported and committed to Codes May 7, 2024, it died when the 2023-2024 session ended.
Prohibits the use of biometric identifying technology in schools for any reason other than specified purposes.
New York's S 7944 (2023-2024) would have amended State Technology Law § 106-b to prohibit public and nonpublic elementary and secondary schools, including charter schools, from purchasing or using biometric identifying technology for any purpose, replacing the earlier temporary bar. Schools could still use it for fingerprint identification of prospective employees as education law requires and to identify employees who consent in writing. Referred to Internet and Technology January 4, 2024, reported and committed to Education May 7, 2024; it died when the 2023-2024 session ended.
Directs the director of the office of information technology services to conduct a study on the use of biometric identifying technology; prohibits the use of biometric identifying technology in schools until July 1, 2022 or until the commissioner of education authorizes such purchase or…
This 2021 chapter amendment re-enacted New York's moratorium on biometric identifying technology, including facial recognition, in schools as State Technology Law 106-b. Schools, including charter schools, could not buy or use it until July 1, 2022 or Commissioner of Education authorization, whichever is later, and only after a state IT office study. After that report (August 2023), the Commissioner in September 2023 barred schools from using facial recognition and let them decide locally on other biometric technology.
To implement the recommendations of the special commission on facial recognition technology
Massachusetts H1946 would replace G.L. c. 6, s. 220 to bar law enforcement from using facial recognition and other biometric surveillance except for State Police searches under set conditions (judge-authorized felony warrant, emergency, deceased identification). Referred to the Judiciary Committee February 27, 2025; on October 23, 2025 it accompanied new draft H4640, which was reported favorably and referred to House Ways and Means.
Addressing artificial intelligence, student discipline, and surveillance in public schools.
Washington's SB 5956 (1st substitute, 2026 session) would have limited AI, automated decision systems (ADS) and surveillance technology in public school discipline. An ADS could not have been the sole or determinative basis for a discipline decision, districts could not have used ADS risk scores or watchlists predicting misconduct or violence, and biometric data could not have been used to infer emotions or other sensitive traits. It passed the Senate 35-13 on February 10, 2026 but was returned to Senate Rules on March 12 and died at adjournment.
Requires retailers to post warning signs of the tracking and collecting of customers biometric data through electronic devices; provides for civil penalties.
New York's S 2539-C would add General Business Law § 390-f. A retailer that tracks customers through a cell phone, store-installed camera or other electronic device would have to conspicuously post a plain-language warning sign at each entrance, and a retailer that collects biometric information would have to post a sign describing what is collected and how it is used. Selling, leasing, trading or sharing biometric information for value would be unlawful. Civil penalties are up to $100 for a first violation. Passed the Senate May 12, 2026 (55-5); on June 1, 2026 the Assembly substituted it for A1558-C and put it on its third-reading calendar. No Assembly vote is shown; not yet law.
To provide accountability in the use of biometric recognition technology and comprehensive enforcement
Massachusetts H96 would add G.L. Chapter 110I regulating biometric recognition technology: covered entities that collect or process biometric data owe duties of loyalty, care and confidentiality, may not sell it, and may not install biometric recognition equipment in places open to the public. Referred to the Advanced Information Technology, the Internet and Cybersecurity Committee February 27, 2025; on November 17, 2025 it accompanied new draft H4746, which was referred to House Ways and Means that day.
A bill for an act relating to private entity requirements concerning biometric data, and providing civil penalties.
Iowa's SSB 3085 would create Code chapter 554J requiring private entities holding biometric data (such as facial geometry, fingerprints or voice) to have a public retention policy, give written notice before collecting, never sell it, and protect it. The Department of Inspections, Appeals, and Licensing would enforce with civil penalties of $1,000, $5,000 and $10,000; no private right of action. Senate subcommittee recommended passage February 4, 2026.
State-by-State Regulation of Biometric Data
Artificial intelligence regulation is advancing at the state level. This page lists the 93 published bills we track on Biometric Data. State attorneys general, privacy regulators, and legislatures are developing a patchwork of laws that impose different obligations on businesses deploying AI systems related to this topic. Compliance teams and legal counsel must track both enacted laws and the pipeline of pending bills that could shift requirements at any time.
Obligations differ from bill to bill. Depending on the law, they can include consumer disclosure obligations, prohibition on specific high-risk uses, mandatory algorithmic impact assessments, bias audits, rights to explanation, and human override requirements. Penalties for non-compliance vary by state — use our Penalty Tracker to review enforcement provisions. For upcoming effective dates, see the Deadlines page.
To understand how Biometric Data laws intersect with specific industries, browse our Healthcare, Employment, Insurance, and Financial Services industry trackers. Compare how different state laws approach this topic using our Bill Comparator.