Facial recognition technology is one of the most heavily regulated areas of AI law. State legislatures have introduced bills covering law enforcement use, commercial deployment, consent requirements, and outright bans in certain contexts.
Key regulatory themes include biometric data collection, accuracy requirements, disparate impact on protected classes, and mandatory human review before consequential decisions.
Artificial Intelligence Safety Measures Act
Illinois' SB 315, the Artificial Intelligence Safety Measures Act, regulates developers of frontier AI models (foundation models trained with more than 10^26 operations). All frontier developers must publish a transparency report when deploying a new or substantially modified model and report critical safety incidents within 72 hours. Large frontier developers (over $500 million revenue with affiliates) need a state disclosure statement from January 1, 2027, and from January 1, 2028 a published frontier AI framework and annual independent audits. Large developers face Attorney General penalties up to $1 million, then $3 million. Signed July 6, 2026 (P.A. 104-0538); effective January 1, 2027.
Prohibit Surveillance Price & Wage Setting
Colorado's HB 26-1210 would have banned individualized price and wage setting: using an algorithm that applies statistical modeling, data analytics, AI or similar techniques to surveillance data about a person's characteristics, online behavior or biometrics, as more than a de minimis factor in the price offered to a consumer or the wage offered to a worker. Cost-based, supply-and-demand, public-discount, loyalty and need-based pricing, consumer-report credit refusals, and wages based solely on seniority or hired-for tasks and performance with plain-language disclosure, would have been allowed. Violations would have been deceptive trade practices. Vetoed by the Governor on June 2, 2026.
Data brokers: data collection and deletion.
California's SB 361 expands what data brokers must report when registering with the California Privacy Protection Agency. Registrations must say whether the broker collects data such as account logins, government ID numbers, citizenship or immigration status, union membership, sexual orientation, gender identity or biometric data, and whether in the past year it shared or sold consumers' data to a developer of a generative AI system or model, a foreign actor, governments or law enforcement. Signed October 8, 2025 (Chapter 466); effective January 1, 2026.
Law Enforcement – Use of Facial Recognition Technology – Images Captured by Camera Affixed to Dwelling Exterior
Maryland's HB 762 (2026, first reader text) would have added an exception to Criminal Procedure section 2-503 letting law enforcement use facial recognition technology on images captured by a camera affixed to a dwelling's exterior by the dwelling's owner or lawful tenant, to investigate arson, burglary and trespass offenses. It had a House Judiciary hearing set for February 24, 2026 and died when the 2026 session ended.
Research and Oversight of AI in Courts Act of 2026
The federal H.R. 7997 (Research and Oversight of AI in Courts Act of 2026) would require the Attorney General, through the National Institute of Justice, to set up a 15-member task force within 60 days of enactment to assess AI speech-to-text and automatic speech recognition use in U.S. courts. A final report is due 18 months later. Referred to the House Judiciary Committee March 19, 2026; it has not passed either chamber.
Research and Oversight of AI in Courts Act of 2026
The federal S. 4154 (Research and Oversight of AI in Courts Act of 2026) would require the Attorney General, through the National Institute of Justice, to establish within 60 days after enactment a 15-member task force on AI speech-to-text and automatic speech recognition technology in U.S. courts, with a final report due 18 months after it is established. Introduced March 19, 2026 and referred to the Senate Judiciary Committee; no further action.
Use of automated decision systems in employment settings regulated.
Minnesota's HF 4445 would have required employers to give workers written notice before using an automated decision system (ADS) for employment-related decisions, with consent, human review, post-decision notice, appeal and records rules, enforced by the Commissioner of Labor and Industry and by private suits. It would have banned using ADS for facial, gait or emotion recognition. Introduced March 18, 2026 and never left committee.
Acquisition and use of facial recognition technology by government entities prohibited.
Minnesota's HF 3661 would have barred state and local government entities, law enforcement agencies and officials from obtaining, retaining, accessing or using face surveillance systems or their information, or contracting with private entities to do so. Evidence from violations would have been inadmissible, and people could sue for damages of at least $1,000 or $100 per violation, whichever is greater, plus injunctions. Introduced February 23, 2026 and referred to Judiciary Finance and Civil Law and it never left committee.
Acquisition and use prohibition of facial recognition technology by government entities
Minnesota's SF 129 (93rd Legislature) would have barred state and local government entities, law enforcement agencies and officials from obtaining, retaining, accessing or using face surveillance systems or their information, or contracting with private entities to do so. People could have sued for damages of at least $1,000 or $100 per violation, whichever is greater, plus injunctions. Introduced January 11, 2023 and never left committee.
Eyewitness Identification
Not law: died in committee. Florida's HB 875, the House counterpart of SB 1202, would have amended s. 92.70, F.S., to set eyewitness identification procedures: a recorded description, independent lineup administrators, lineups with the suspect and at least five fillers, limits on show-ups and first-time in-court identifications, and audio and video recording. If facial recognition technology identified a suspect, a lineup could not be held without a basis independent of the technology. It died in the Criminal Justice Subcommittee on March 13, 2026.
An act relating to consumer data privacy
Vermont's S.93 (2025-2026 biennium) would have enacted a consumer data privacy law applying to businesses that process personal data of at least 100,000 consumers, or at least 25,000 consumers while deriving over 25 percent of revenue from selling data. It would have given consumers rights including opting out of profiling for solely automated decisions with legal or similarly significant effects, required consent for sensitive data including biometrics, and given the Attorney General exclusive enforcement. It died in committee after referral on February 27, 2025.
Relating to pornography access for minors
West Virginia's SB 498 (2026 regular session) would have added W. Va. Code 61-8A-6, requiring commercial adult websites (where sexually explicit material is more than 25% of content) to verify age with biometric facial recognition, a government-issued ID and an adult's credit card, repeated every 24 hours, without storing biometric data after verification. Penalties would include $1 million per violation and civil damages. It was sent to Senate Judiciary on January 19, 2026 and died when the session ended March 14, 2026.
Stop Non-Consensual Distribution of Intimate Deep Fake Media Act
West Virginia's SB 454 (2026 regular session) would have created the Stop Non-Consensual Distribution of Intimate Deep Fake Media Act (new W. Va. Code art. 61-3F), making it a crime to intentionally or knowingly distribute a deep fake of a person's face showing sexual conduct the person did not engage in, with intent to coerce, harass, intimidate or damage reputation, and without consent. Maximum prison terms would range from 90 days to 5 years. It was sent to Senate Judiciary on January 16, 2026 and died when the session ended March 14, 2026.
Stop Non-Consensual Distribution of Intimate Deep Fake Media Act
West Virginia's SB 170 (2025 regular session) would have created the Stop Non-Consensual Distribution of Intimate Deep Fake Media Act (new W. Va. Code art. 61-3F), making it a crime to intentionally or knowingly distribute a deep fake of a person's face showing sexual conduct the person did not engage in, with intent to coerce, harass, intimidate or damage reputation, and without consent. Maximum prison terms would range from 90 days to 5 years. It was sent to Senate Judiciary on February 12, 2025 and went no further.
Providing for 4th Amendment Restoration Act
West Virginia's SB 688 (2025 regular session), called the Responsible Use of Facial Recognition Act in its text, would have limited law enforcement use of six listed technologies, including facial recognition, to uses under a warrant based on probable cause, created a facial recognition working group in the Department of Homeland Security to publish a model policy by January 1, 2026, and required agencies to use only U.S.-made facial recognition technology with algorithms tested by NIST. It was sent to Senate Government Organization on March 4, 2025 and went no further.
Stop Non-Consensual Distribution of Intimate Deep Fake Media Act
West Virginia's SB 720 (2024 regular session) would have created the Stop Non-Consensual Distribution of Intimate Deep Fake Media Act (new W. Va. Code art. 61-3D), making it a crime to intentionally or knowingly distribute a deep fake of a person's face showing sexual conduct the person did not engage in, with intent to coerce, harass, intimidate or damage reputation, and without consent. Maximum prison terms would range from 90 days to 5 years. It was sent to Senate Judiciary on February 8, 2024 and went no further.
An Act to implement the recommendations of the special commission on facial recognition technology
Massachusetts' H 4359 (193rd General Court, 2023-2024) would have made it unlawful for law enforcement to use biometric surveillance technology, including facial recognition, absent express legal authorization. The registrar of motor vehicles could use facial recognition to verify identity for licenses, and State Police could run searches for limited purposes such as a judge-authorized warrant for a felony or an emergency. Reported by Judiciary and sent to House Ways and Means on February 12, 2024, it saw no further action and died with the session.
Provides relative to prohibiting surveillance-based price discrimination
Louisiana's HB471 would have made 'surveillance-based price discrimination' an unfair or deceptive trade practice, so that no person could engage in it. It defines surveillance data, behaviors, biometrics and automated decision systems, and exempts cost-justified price differences, certain equal-terms discounts and refusals based on a Fair Credit Reporting Act consumer report. It was considered in House Commerce April 22, 2026 and died. A Senate bill on the same subject, SB362, also died.
Biometric data and license plate readers-regulation.
Wyoming's HB 0181 (2026) would have barred governmental entities from using biometric data to identify or verify people, geolocation data to locate people or vehicles, and automatic license plate reader (ALPR) systems to identify vehicles, with narrow law enforcement exceptions (mostly warrant-based), a seven-day retention limit for data not tied to an investigation, and a civil action for damages or injunctive relief. Received for introduction February 11, 2026; the House did not consider it for introduction on February 13, 2026, so it died.
Video Lottery Games, Table Games And Sports Wagering--the Rhode Island Consumer Protection Gaming Act
Rhode Island S 2491 (2022), as introduced on March 1, 2022, would amend the Consumer Protection Gaming Act to bar facial recognition technology and biometric recognition programs in video-lottery terminals at pari-mutuel licensees and in online betting applications. It would also prohibit algorithmic programs that use a gaming consumer's betting history to increase wagering, and AI or automated decision systems that promote play through intermittent reinforcement. The text states no penalties and takes effect upon passage.
Relating to biometric identifiers used in the performance of artificial intelligence.
Texas SB 2490 (2025), as introduced, would have amended Business & Commerce Code Sec. 503.001 (biometric identifiers) to define artificial intelligence and add Subsection (f) exempting AI-related training, processing or storage of biometric identifiers, unless done to uniquely identify a specific individual or the identifier is later used for another and separate commercial purpose. It states no penalty amounts. No enrolled version exists, so it died June 2, 2025.
Stop Non-Consensual Distribution of Intimate Deep Fake Media Act
West Virginia's HB 5548 (2026 regular session) would have created the Stop Non-Consensual Distribution of Intimate Deep Fake Media Act (new W. Va. Code art. 61-3F), making it a crime to intentionally or knowingly distribute a deep fake of a person's face showing sexual conduct the person did not engage in, with intent to coerce, harass, intimidate or damage reputation, and without consent. Maximum prison terms would range from 90 days to 5 years. It was referred to House Judiciary on February 16, 2026 and died when the session ended March 14, 2026.
Autonomous Systems Amendments
Utah's SB 292 limits civil liability for automated driving systems (ADS). Noneconomic damages in actions over ADS-equipped vehicles are capped at $1,000,000 (not for wrongful death), with no punitive damages for level four or five ADS. People hurt by a driverless level four or five vehicle may sue its owner or dispatcher without proving negligence or defect, but recovery is capped at $100,000. Makers and developers of level four or five ADS are shielded from negligence claims and face product liability under stricter defect rules and a state-of-the-art defense. Signed March 23, 2026; effective May 6, 2026; the limits are repealed July 1, 2030.
Data Privacy Amendments
Utah's HB 450 reorganizes oversight of how state and local government entities handle personal data under the Government Data Privacy Act. It restructures the Utah Privacy Commission to include state agency, city, county and public education members, moves its support to the Utah Office of Data Privacy, makes a data privacy ombudsperson part of that office, sets a complaint process (complaints go first to the entity, then to mediation), and moves the state privacy auditor's duties to the state auditor. The act already treats facial recognition, automated decision-making and profiling as high-risk processing. It governs government, not businesses. Effective May 6, 2026.
Artificial intelligence models: large developers.
California's SB 53, the Transparency in Frontier Artificial Intelligence Act, covers developers of frontier models (foundation models trained with more than 10^26 operations). Large frontier developers (over $500 million in prior-year revenue with affiliates) must publish and follow a frontier AI framework for catastrophic risks. All frontier developers must publish transparency reports at deployment, report critical safety incidents to the Office of Emergency Services within 15 days, and not retaliate against whistleblowers. Large developers face penalties up to $1 million per violation. Signed September 29, 2025 (Chapter 138); effective January 1, 2026.
Facial recognition technology, use of match as the sole basis of probable cause or arrest, prohibited
Alabama's SB 56 (Act 2022-420) bars state and local law enforcement agencies from using facial recognition technology match results as the sole basis to establish probable cause in a criminal investigation or to make an arrest; match results may be used for those purposes only together with other lawfully obtained information and evidence. Facial recognition technology is software that, to try to identify an unknown person, generates facial biometric data (a facial template), searches a database of many people's templates linked to identifying information, and returns matches by similarity. Signed April 14, 2022; effective July 1, 2022.
SOS-FACIAL RECOGNITION INFO
Illinois' Public Act 102-0354 (SB 225) bars the Secretary of State from providing facial recognition search services, or photographs obtained in issuing driver's licenses, permits or state identification cards, to any federal, State or local law enforcement agency or other governmental entity for the purpose of enforcing federal immigration laws. The ban does not apply to requests for facial recognition searches or photographs whose purpose relates to criminal activity other than immigration violations. It amends the Illinois Identification Card Act and the Illinois Vehicle Code. Approved and effective August 13, 2021.
VIDEO INTERVIEW ACT
Illinois' Public Act 101-0260 (HB 2557) creates the Artificial Intelligence Video Interview Act. Employers that ask applicants to record video interviews and use AI analysis of them for Illinois-based positions must, before the interview, tell each applicant AI may be used to analyze it, explain how the AI works and what general types of characteristics it uses, and get the applicant's consent. Employers may not use AI to evaluate applicants who have not consented, may share videos only with those needed to evaluate the applicant, and must delete videos within 30 days of an applicant's request. Approved August 9, 2019; effective January 1, 2020.
Prohibits the use of a facial recognition system by a landlord on any residential premises.
New York's S 8223 (same as A 6363) would add Real Property Law section 235-k making it unlawful for a landlord to obtain, retain, access or use, on any residential premises, any facial recognition system or any information obtained from one. Facial recognition covers identifying people from their faces and analyzing faces to judge sentiment, state of mind or dangerousness. The Attorney General could seek an injunction and a civil penalty up to $10,000, and affected people could sue. Introduced May 23, 2025 and referred to the Senate Judiciary Committee (again January 7, 2026); it has not passed either house.
Prohibits the use of biometric surveillance technology by law enforcement; establishes the biometric surveillance regulation task force; and provides for the expiration and repeal of certain provisions
New York's A 1045 would bar police agencies, police officers, peace officers and state police members from acquiring, possessing, accessing or using any biometric surveillance system, or information derived from one, in their duties, and let a person sue for equitable or declaratory relief. Mobile fingerprint scanning, DNA index and fingerprint database comparisons are excepted. It would create a 12-member task force reporting between 2029 and 2030. Introduced January 8, 2025 and referred to the Governmental Operations Committee; it has not passed either house.
Prohibits the use of biometric identifying technology in schools for any reason other than certain specified purposes; adds fingerprint identification of teachers, administrators and students for the purpose of securely logging into a digital device for academic and administrative purpose to…
New York's A 6720-A would amend State Technology Law § 106-b so that public and nonpublic elementary and secondary schools, including charter schools, may not buy or use biometric identifying technology for any purpose, including school security, apart from listed uses. The bill would drop the current path under which the education commissioner can authorize it, and would add fingerprint logins to digital devices to the allowed uses. Introduced March 11, 2025, amended April 16, 2025 and referred to the Education Committee January 7, 2026; it has not passed either chamber.
AN ACT RELATING TO LABOR AND LABOR RELATIONS -- ARTIFICIAL INTELLIGENCE USE AND FAIR EMPLOYMENT PRACTICES
Rhode Island's H 7767 would add a chapter to Title 28 limiting how employers use electronic monitoring and automated decision systems on workers. Employers could monitor only for listed purposes, with written notice, an independent impact assessment, and human review of decisions based on monitoring data; monitoring tools using facial recognition or gait, voice analysis or emotion recognition would be barred. Introduced February 12, 2026; House Labor recommended it be held for further study April 15, 2026. It has not passed either chamber.
Requires legislative members to verify attendance on legislative session days via an identification card system and facial recognition technology.
New York's A 11119 would add Legislative Law § 5-c, requiring every member of the Assembly and Senate to verify daily attendance on session days through a biometric facial recognition system tied to an identification card in each chamber. A photograph taken when the card is used would confirm the cardholder is the elected member. Referred to the Assembly Governmental Operations Committee April 24, 2026; it has not passed either chamber.
Reducing emissions from artificial intelligence
Massachusetts' H 495 would add a new Chapter 93M to the General Laws. Search-engine operators with more than $10 million in revenue could not return AI-generated results unless the user gave affirmative consent. The state would study AI's environmental impacts, and companies that develop or power AI systems would have to report their annual environmental impacts or face penalties up to $20,000 a year. Referred to the Joint Committee on Economic Development and Emerging Technologies February 27, 2025; on March 5, 2026 it accompanied a study order (H 5178) and did not advance as its own bill.
ICE Out of Our Faces Act
The federal S. 3779 (ICE Out of Our Faces Act) would make it unlawful for any covered immigration officer (officers, employees, agents and contractors of ICE or CBP and officials deputized under INA section 287(g)) to acquire, possess, access or use in the United States any biometric surveillance system, including facial recognition, or information from one run by another entity. Data collected would have to be deleted within 30 days after enactment. Introduced February 4, 2026 and referred to the Senate Homeland Security and Governmental Affairs Committee; no further action.
CTA POLICE DEPARTMENT
Illinois's SB 4070 (104th General Assembly) would amend the Metropolitan Transit Authority Act to require the Chicago Transit Authority to set up a CTA Transit Police Department of sworn officers. It would also require a pilot of AI-based weapon-detection scanners at 5 to 10 stations and hubs and a limited facial recognition pilot. Referred to Assignments February 24, 2026.
Companion AI Protection Act
Illinois's SB 3262 (104th General Assembly) would create the Companion Artificial Intelligence Protection Act. Operators of companion AI products could not deploy products with specified features unless an adult user configures them, would face auditing and reporting requirements, and would have to notify users they are talking to a companion AI and implement safeguards including a crisis intervention protocol. Re-referred to Senate Assignments on May 22, 2026.
Biometric Surveillance Act
Illinois's HB 5521 (104th General Assembly) would create the Illinois Biometric Surveillance Act. Law enforcement agencies could not obtain, retain, possess, access, request or use a biometric identification system, including through a third party or another government agency. It would give a private right of action and Attorney General enforcement. Re-referred to the House Rules Committee on March 27, 2026.
POLICE-FACIAL RECOGNITION ACT
Illinois's SB 3564 (104th General Assembly) would create the Facial Recognition Technology in Law Enforcement Act. Law enforcement agencies using facial recognition would have to conduct compliance audits, and the technology could not be used to analyze images of people engaged in constitutionally protected activity (absent reasonable suspicion of a crime), for real or live-time identification, or solely based on beliefs, lawful activities or protected characteristics. Referred to Assignments February 5, 2026.
BIPA-IDOT TESTING VEHICLES
Illinois's HB 2593 (104th General Assembly) would amend Section 25 of the Biometric Information Privacy Act to add that nothing in the Act applies to companies registered with the Department of Transportation to conduct testing of autonomous vehicles. Re-referred to the House Rules Committee on March 21, 2025; the 104th General Assembly remains in session.
BIPA-VEHICLE SAFETY TECH
Illinois's HB 3292 (104th General Assembly) would amend Sections 10 and 25 of the Biometric Information Privacy Act to provide that nothing in the Act may be construed to apply to an entity using vehicle safety technology for a vehicle safety purpose. Last action: Rule 19(a) re-referral to the House Rules Committee on March 21, 2025, after assignment to Judiciary - Civil.
BIOMETRIC DATA-COMMERCIAL USE
Illinois's HB 2411 (100th General Assembly) would have amended Section 15 of the Biometric Information Privacy Act to bar a private entity from requiring a person or customer to provide a biometric identifier or biometric information as a condition of goods or services, except as needed for employer background checks or employee security protocols. It would not have applied to companies providing medical services, law enforcement agencies or governmental entities. It was not passed before the 100th General Assembly ended (Session Sine Die, January 8, 2019).
BIOMETRIC DATA-COMMERCIAL USE
Illinois's HB 4330 (100th General Assembly) would have amended Section 15 of the Biometric Information Privacy Act to bar a private entity from requiring a person or customer to provide a biometric identifier or biometric information as a condition of goods or services, except as needed for employer background checks or employee security protocols. It would not have applied to companies providing medical services, law enforcement agencies or governmental entities. It was not passed before the 100th General Assembly ended (Session Sine Die, January 8, 2019).
Workplace surveillance tools.
California's AB 1221 (2025-26 Regular Session) would have regulated workplace surveillance tools and employer use of worker data. Employers would have had to give affected workers 30 days' written notice before introducing a tool, and could not use tools incorporating facial, gait or emotion recognition technology, except as specified. Civil penalty $500 per violation. It was held in Assembly Appropriations May 23, 2025 and died under Art. IV, Sec. 10(c) of the Constitution on January 31, 2026.
Providing for the modernization of notarization and the county register of deeds process with respect to real estate documents for the purpose of mitigation of real estate document-related fraud, requiring the development, implementation and administration of a two-tiered authentication system for…
HB2309 aims to modernize notarization and the county register of deeds process to reduce real estate document fraud, requiring new authentication systems and allowing fraud investigations.
Artificial Intelligence Training Data Transparency Act; transparency and disclosure requirements.
Virginia's HB 2250 (2025 Regular Session) would have amended the Consumer Data Protection Act and added an Artificial Intelligence Training Data Transparency Act (new Title 59.1 chapter, §§ 59.1-607 through 59.1-611) with requirements for generative AI developers. It would also have allowed third-party opt-out of data processing and required consent to process adolescents' data. Left in committee on February 4, 2025; it failed.
AN ACT to amend Tennessee Code Annotated, Title 10; Title 24 and Title 38, relative to historical location data.
Tennessee's HB2608 (114th General Assembly), the "Protecting Everyone from Excessive Police Surveillance (PEEPS) Act," would have barred government officials, including government contractors, from accessing a database (including license plate, facial recognition, biometric or cellular location data) that reveals a person's or vehicle's location more than 24 hours earlier, except with a felony search warrant, consent, exigent circumstances or other listed cases. Companion: SB 2215. Not passed before the session ended in April 2026; last action: Taken off notice for cal in s/c Criminal Justice Subcommittee of Judiciary Committee (March 25, 2026).
Video Lottery Games, Table Games And Sports Wagering--the Rhode Island Consumer Protection Gaming Act
Rhode Island H 7222 (2022), as introduced on January 26, 2022, would amend the Consumer Protection Gaming Act to bar facial recognition technology and biometric recognition programs in video-lottery terminals at pari-mutuel licensees and in online betting applications. It would also prohibit algorithmic programs that use a gaming consumer's betting history to increase wagering, and AI or automated decision systems that promote play through intermittent reinforcement. The text states no penalties and takes effect upon passage.
Surveillance and Investigatory Technology Amendments
Utah's H.B. 606 (Rep. Ryan D. Wilcox), Surveillance and Investigatory Technology Amendments, would have limited a law enforcement agency's use of surveillance or investigatory technology, defined to include facial recognition systems, biometric surveillance information, and location tracking, with "technology" defined to include AI technology. The limits would start July 1, 2027. The enacting clause was struck and the bill filed as not passed on March 6, 2026.
An Act relative to justice, equity and accountability in law enforcement in the Commonwealth
Massachusetts' 2020 police reform law (Chapter 253 of the Acts of 2020) regulates police use of facial recognition. Under new G.L. c.6 s.220, a law enforcement agency may perform or request a facial recognition search only through a written request to the Registry of Motor Vehicles, State Police or FBI, and only with a court order, except to identify a deceased person or in an emergency. Each search must be documented and reported quarterly to the Executive Office of Public Safety and Security. Section 220 took effect July 1, 2021; a special commission was set up to study government use of facial recognition.
Ban on government social scoring with AI.
Wyoming's HB 91 (as introduced) would create W.S. 9-30-101 through 9-30-103 barring a governmental entity from using an AI system to evaluate or classify people on social behavior or personal characteristics to assign a social score that could lead to unrelated-context or disproportionate treatment or infringe rights, and from using AI to identify a person by biometric data or bulk image gathering in ways that infringe rights. A committee amendment would add law-enforcement exceptions. It would take effect July 1, 2026. The House Judiciary Committee recommended it amend and do pass 7-1, but the House did not consider it in Committee of the Whole; it died.
Representations depicting nudity and providing a penalty.
2025 Wisconsin Act 34 adds deepfake intimate images to the state's representations-depicting-nudity law (s. 942.09). A "synthetic intimate representation" is a representation generated using technological means that uses an identifiable person's face, likeness or other distinguishing characteristics to depict them intimately and is realistic enough that a reasonable person would believe it shows that person. Posting, publishing, distributing or exhibiting one with intent to coerce, harass or intimidate is a crime under s. 942.09, and making a reproduction of a private representation without consent is also covered. It took effect the day after publication (Oct. 3, 2025).
Providing for the modernization of notarization and the notary public process with respect to real estate documents for the purpose of mitigation of real estate document-related fraud, requiring the development, implementation and administration of a two-tiered authentication system for…
HB2696 aims to modernize the notarization process for real estate documents in Kansas to mitigate document-related fraud by implementing a two-tiered authentication system and requiring 3D biometric antifraud technology by December 31, 2027.
Prohibits the use of a wage-fixing algorithm in combination with personal or behavioral data to set or recommend wages or compensation
A 9638 would ban 'surveillance wages' in New York: employers could not use a wage-fixing algorithm, or its output, together with a worker's personal or behavioral data (such as financial, purchasing, browsing, biometric or location data, or profiles drawn from them) to set or recommend pay, whether the employer or a third party collects the data. Tools that use only job requirements, performance (not customer reviews), qualifications, labor market conditions or local cost of living are exempt. The Attorney General, the Labor Department and harmed workers could sue for the greater of actual damages or $3,000 per violation, tripled if willful. Pending in the Assembly Labor Committee.
Establishes the "protect our privacy (POP) act" to impose limitations on the use of drones for law enforcement purposes; prohibits the use of drones by law enforcement at concerts, protests, demonstrations, or other actions protected by the first amendment.
New York's A 972, the "protect our privacy (POP) act," would add Civil Rights Law § 52-e: law enforcement data from drones equipped with facial recognition software, or from facial recognition run on drone video or images, including private drones, could not be used in ongoing investigations or prosecutions and would have to be promptly deleted, retroactively. It would also generally bar police drone use except for search and rescue and post-disaster inspection, bar drones at protests and armed drones, and allow suits for the greater of $1,000 per violation or actual damages. Referred to Governmental Operations January 7, 2026; it has not passed either chamber.
Relation to the regulation of the use of artificial intelligence and facial recognition technology in criminal investigations
New York's A 7172-B would add subdivision 25 to Executive Law § 837, requiring the division of criminal justice services to promulgate a written protocol for law enforcement agencies using AI and facial recognition technology in criminal investigations. The protocol would cover transparency measures (records of AI outputs, subject to audit), regular independent audits of facial recognition systems with public results, and officer training. Would take effect on the 90th day after it becomes law. On the Assembly floor calendar (Cal. 396, June 3, 2026); it has not passed either chamber.
Relating to regulation of the use of artificial intelligence systems in this state; providing civil penalties.
Texas's HB 149, the Texas Responsible Artificial Intelligence Governance Act, bars developing or deploying AI intended to incite self-harm, harm to others or crime, with intent to unlawfully discriminate against a protected class (disparate impact alone is not enough), or solely to infringe U.S. constitutional rights, and making or distributing AI solely to produce or spread child pornography or unlawful sexual deep fakes. Government entities may not use AI for harmful social scoring or rights-infringing biometric ID. Agencies must tell consumers they are dealing with AI; health care providers must tell patients. AG enforcement; 60-day cure. Signed June 22, 2025; effective January 1, 2026.
Relating to the creation of artificial sexual material harmful to minors.
Texas's HB 581 extends the state's age verification law (Civil Practice and Remedies Code Chapter 129B) to AI-generated sexual material harmful to minors in which a real person is recognizable. A commercial entity whose website has a publicly accessible tool for creating it, or that offers an app for creating it, must use reasonable age verification to confirm users are 18 or older, may not keep identifying information from the check, and must ensure anyone used as a source is an adult who consented to use of their face and body. Entities whose terms ban such material and that use technical tools to limit it are exempt. Signed June 20, 2025; effective September 1, 2025.
Relating to biometric identifiers used in the performance of artificial intelligence.
Texas HB 3755 (2025), as introduced, would have amended Business & Commerce Code Sec. 503.001 (the biometric identifier law) to define artificial intelligence and to exempt AI training, processing, or storage unless done to uniquely identify a specific individual. If a biometric identifier captured for an AI commercial purpose were used for another, separate commercial purpose, the holder would become subject to the section's possession, destruction and penalty rules. It died when the regular session adjourned June 2, 2025.
Enacts the "facial recognition technology study act" to study privacy concerns and potential regulatory approaches to the development of facial recognition technology.
New York's S 3699 would establish a seven-member task force to study the proper regulatory approach to facial recognition technology (technology capable of identifying or verifying a person from a digital image or video frame). It would examine privacy concerns, other jurisdictions' regulation, potential misuse and administrative regulation methods, and report its findings to the governor and Legislature within one year of the effective date. The Senate passed it 60-2 and sent it to the Assembly March 16, 2026.
Relating to artificial intelligence mental health services.
Texas HB 1265 (2025), as introduced, would have barred anyone from providing AI mental health services in Texas unless the AI application is approved by the Health and Human Services Commission and a licensed mental health professional is available at all times. Clients would have to be told the service is AI-based and give informed consent. Violators would face disciplinary action under the applicable licensing statute. It died when the regular session adjourned June 2, 2025.
Use of facial recognition technology as part of the driver's license and Minnesota identification card application process required.
Minnesota's HF 560 would have required the commissioner of public safety to use facial recognition on every driver's license and Minnesota ID application or renewal to prevent multiple issuances and identification fraud, comparing applicants' faces with state, FBI and other law enforcement databases. A confirmed match would have blocked issuance and been referred to law enforcement. Introduced February 13, 2025 and never left committee.
To protect biometric information
Massachusetts H 63 (2023-2024) would have added a new chapter 93M to the General Laws restricting how private entities collect and process biometric information, including face geometry, with consent, a written privacy policy and a ban on monetizing the data. It did not pass: on May 13, 2024 the committee folded it into new draft H4632 (the Massachusetts Data Privacy Act), which was sent to House Ways and Means and recorded 'No further action taken' on December 31, 2024, when the session ended.
Artificial Intelligence & Biometric Technologies
Colorado's HB 24-1468 repealed and reenacted the facial recognition task force created by SB 22-113 as the Artificial Intelligence Impact Task Force. Membership grew from 15 to 26, and the focus widened from government use of facial recognition to protections for consumers and workers from AI and automated decision systems: definitions, transparency and disclosure rules, algorithmic discrimination, best practices and metrics, and facial recognition and biometric technology. It had to meet by September 1, 2024 and report by February 1, 2025, and is set to be repealed September 1, 2027. Signed June 6, 2024 (Chapter 467); effective on signature.
Imposes liability for misleading, incorrect, contradictory or harmful information to a user by a chatbot that results in financial loss or other demonstrable harm.
New York's S 5668 would add General Business Law § 390-f on chatbot liability. A proprietor whose chatbot acts in place of a human representative could not disclaim liability for materially misleading, incorrect, contradictory or harmful information causing financial loss or other demonstrable harm (no liability if cured within 30 days of notice), and would have to give clear notice that the user is talking to an AI chatbot. Companion chatbots face self-harm and minor safeguards. Committee vote March 12, 2025; committed to rules June 13, 2025; referred back January 7, 2026.
Relates to banning the use of biometric identifying technology in schools
New York's S 9643 would amend State Technology Law § 106-b so public and nonpublic elementary and secondary schools, including charter schools, are "prohibited from purchasing or utilizing biometric identifying technology for any purpose, including school security." Limited uses stay allowed: fingerprinting of prospective employees, fingerprint logins to digital devices, and identifying employees who consent in writing. Passed the Senate 38-22 on June 1, 2026 and was referred to the Assembly Education Committee; it has not passed the Assembly.
Provides that surveillance-based price discrimination is an unfair or deceptive trade practice or act. (8/1/26)
Louisiana's SB362 would have made 'surveillance-based price discrimination' an unfair or deceptive trade practice, so that no person could engage in it. The bill defines surveillance data, behaviors and biometrics, mentions automated decision systems, and exempts cost-based price differences, equal-terms discounts and credit refusals based on a Fair Credit Reporting Act report. It was considered in committee April 22, 2026 and died.
Governmental Use of Facial Recognition Technology
Utah SB 34 (2021) enacts Utah Code Title 77, Chapter 23e on government use of facial recognition technology, defined as a computer system that uses an algorithm to compare facial biometric data of an unknown person with known individuals. Only the Department of Public Safety may run facial recognition comparisons against image databases it shares or maintains, and only under listed conditions and a set request process. Employees must be trained, the public must be notified when a government entity uses facial recognition on images it takes, and the law sets which comparison records are public or protected.
An act relating to consumer data privacy and online surveillance
Vermont's H.208 (2025-2026 biennium) would have enacted a consumer data privacy and online surveillance law applying to businesses processing data of at least 25,000 consumers, or 12,500 consumers with over 25 percent of revenue from selling data. Consumers could learn whether their data is used in an AI system and opt out of profiling for automated decisions; sensitive data including biometric and neural data would be limited. It would have taken effect July 1, 2026. It was referred to House Commerce on February 12, 2025 and died.
Law enforcement: facial recognition and other biometric surveillance.
California's AB 1215 added Penal Code § 832.19, which barred law enforcement agencies and officers from installing, activating or using any biometric surveillance system, such as facial recognition, in connection with an officer camera (a body-worn camera or similar device) or its data, including by having another agency or a third party run it for them. Anyone could sue for equitable or declaratory relief. The section was repealed by its own terms on January 1, 2023, so the ban is no longer in effect. Signed October 8, 2019 (Chapter 579); effective January 1, 2020.
Fourth Amendment Restoration Act
West Virginia's HB 2431, the Fourth Amendment Restoration Act (2025 regular session), would have barred law enforcement officers, and anyone acting for law enforcement purposes, from using seven listed technologies, including facial recognition, license plate readers and surveillance drones, unless a warrant based on probable cause authorizes use against a specific person. Knowing and willful use would be a felony. It was sent to House Judiciary on February 17, 2025 and went no further.
Children and Social Media
South Carolina's S 268, 'Children and Social Media', would add Chapter 80 to Title 39. Covered online services, which may include AI-based products, would owe minors a duty of care, face limits on data, notifications and profiling, and have to explain personalized recommendation systems and report on their algorithms. The Senate approved it 43-0 on second reading April 30, 2025 and gave it third reading May 1, 2025; it was then referred to the House Judiciary Committee.
An act relating to public safety; ... regulating the use of unmanned aerial vehicles by law enforcement ... (Laws 2020, chapter 82)
Minnesota's Laws 2020, chapter 82 created Minn. Stat. 626.19 on law enforcement use of unmanned aerial vehicles (drones). Drones generally require a warrant, with listed exceptions, and under subdivision 4(b) an agency must not deploy a drone with facial recognition or other biometric-matching technology unless expressly authorized by a warrant. Agencies also may not arm drones or use them to collect data on protests without a warrant, evidence gathered in violation is inadmissible, and agencies must adopt written policies by Feb. 15, 2021. Section 626.19 took effect Aug. 1, 2020.
Artificial Intelligence Facial Recognition
Colorado's SB 22-113 sets rules for facial recognition used by state agencies, local governments and state colleges: a notice of intent and public accountability report before use, vendor bias disclosures, testing and meaningful human review for decisions with legal or similarly significant effects, training and records. Police need a warrant or another listed basis for ongoing surveillance, real-time identification or tracking. It barred schools from new facial recognition contracts until July 1, 2025; SB 25-143 (2025) removed that end date. Its task force became the AI Impact Task Force (HB 24-1468), ending September 1, 2027. Signed June 8, 2022 (Chapter 463); effective August 10, 2022.
An Act relating to harassment by the dissemination, publishing, distribution, or posting of a visual depiction showing another person in a state of full or partial nudity or engaged in a sex act that has been altered to falsely depict another person, and making penalties applicable.
Iowa's 2024 Acts chapter 1065 (HF 2240) covers sexual deepfakes under the harassment law. Iowa Code 708.7(1)(a)(5) makes it harassment to disseminate, publish, distribute or post a visual depiction of another person in full or partial nudity or engaged in a sex act without that person's consent. "Another person" now includes an individual, recognizable by face, likeness or other distinguishing features, whose image is used to create, adapt or modify a visual depiction to depict them that way. The act does not name AI but reaches fabricated images of real people. The offense is first-degree harassment (an aggravated misdemeanor), and offenders 18 or older must register as sex offenders.
An Act relating to sexual exploitation of a minor by the creation, adaptation, or modification of a visual depiction to give the appearance that an identifiable minor is engaged in a prohibited sexual act or the simulation of a prohibited sexual act, and making penalties applicable.
Iowa's 2024 Acts chapter 1015 (SF 2243) brings fabricated child sexual images into the sexual exploitation of a minor offense. Under Iowa Code 728.12(3), knowingly purchasing or possessing a visual depiction of a minor in a prohibited sexual act now includes any depiction created, adapted or modified to give the appearance that an identifiable minor is engaged in such an act or its simulation. An identifiable minor is someone who was a minor when the image was made, or whose image as a minor was used, and who is recognizable by face, likeness or other features. The minor's actual identity need not be proven. The act does not name AI but covers digitally fabricated images of real children.
Relating To Law Enforcement.
Hawaii's Senate Bill 2049 (2026) would have barred law enforcement agencies and officers from using biometric surveillance technology, meaning software that performs facial recognition or other remote biometric recognition, on any person. Exceptions would have covered reasonable suspicion of a crime, executing a judge-authorized warrant based on probable cause that an unidentified or unconfirmed person in an image committed a crime, and emergencies involving immediate danger of death or serious injury. It was referred to committees January 22, 2026 and not enacted.
An Act To Increase Privacy and Security by Regulating the Use of Facial Surveillance Systems by Departments, Public Employees and Public Officials
Maine's 2021 facial surveillance law (25 MRSA §6001) generally prohibits government departments, public employees and officials from obtaining, using or contracting for facial surveillance systems, defined as automated or semi-automated processes that identify people from facial characteristics. Limited exceptions allow searches for serious crimes with probable cause, missing or deceased persons and BMV fraud, but requests must go through the BMV or State Police, which log them. A facial match alone cannot establish probable cause, and illegally obtained data must be deleted and is inadmissible.
An act relating to governmental structures protecting the public health, safety, and welfare
Vermont's S.124 (Act 166 of 2020) is a public safety act whose Sec. 14 imposes a moratorium on facial recognition technology: until the General Assembly authorizes it by law, a law enforcement officer may not use facial recognition technology or information obtained through it, except as permitted for drones under 20 V.S.A. 4622. Facial recognition covers automated or semi-automated identification of a person from facial characteristics and analysis of a face to infer sentiment, state of mind or dangerousness. The act took effect October 1, 2020; the Governor signed it October 7, 2020. Act 17 of 2021 later allowed use in child sexual exploitation investigations.
CIVIL LAW-TECH
This follow-up to Public Act 103-0294 amends the Civil Remedies for Nonconsensual Dissemination of Private Sexual Images Act (740 ILCS 190/5, 15). It defines a "digitally altered sexual image" as visual media created or substantially altered so that it would falsely appear to a reasonable person to be an authentic depiction of an individual, and covers a person whose face appears in such an image. It adds good-faith defenses, such as reporting or investigating unlawful conduct. Effective December 8, 2023.
Provides for the registration and duties of model management companies; provides complaint procedures and penalties for violations
The Fashion Workers Act (Labor Law Article 36) includes protections against unauthorized digital replicas, defined as significant computer-generated or AI-enhanced representations of a model's face, body or voice. Model management companies and clients must get clear written consent, separate from the representation agreement, stating scope, purpose, pay and duration before creating or using a model's digital replica, and may not alter a model's replica with AI without it. Powers of attorney cannot cover digital replica use. A chapter amendment (A2249, Chapter 66 of 2025) clarifies that consent must come from the model. Effective on the 180th day after becoming law.
Relating to prosecution of certain criminal offenses prohibiting sexually explicit visual material involving children.
Texas HB 2700 (2023) brings AI-generated and AI-altered sexual images of real children within the state's child pornography and obscenity offenses. Covered material includes depictions of a child recognizable as an actual person by face, likeness or another distinguishing feature, and material in which a child's image was used in creating, adapting or modifying it, including computer-generated visual material created, adapted or modified using an artificial intelligence application or other computer software. It applies to offenses committed on or after September 1, 2023.
Prohibits collection of biometric identifier information by public or private entity under certain circumstances.
New Jersey's A3926 would bar public and private entities from collecting, retaining, converting, storing or sharing biometric identifier information unless they post clear, plain-language notice at every common entryway about their use of a biometric surveillance system. Penalties would be $5,000 for a first violation and $10,000 for later ones, with criminal grading for a pattern of violations.
Unlawful dissemination or sale of images of another; penalty.
Virginia's 2019 law closes a gap in the crime of maliciously disseminating or selling nude or partially nude images of another person with intent to coerce, harass or intimidate (Code 18.2-386.2, a Class 1 misdemeanor). 'Another person' now includes a person whose image was used in creating, adapting or modifying a videographic or still image with intent to depict an actual person who is recognizable by face, likeness or other distinguishing characteristic, so deepfake intimate images are covered. Service providers are not liable for content provided by others. Effective July 1, 2019.
Unlawful dissemination or sale of images of another; penalty.
Virginia's 2019 law closes a gap in the crime of maliciously disseminating or selling nude or partially nude images of another person with intent to coerce, harass or intimidate (Code 18.2-386.2, a Class 1 misdemeanor). 'Another person' now includes a person whose image was used in creating, adapting or modifying a videographic or still image with intent to depict an actual person who is recognizable by face, likeness or other distinguishing characteristic, so deepfake intimate images are covered. Service providers are not liable for content provided by others. Effective July 1, 2019.
Facial recognition technology; local law-enforcement agencies, etc., authorization of use.
Virginia HB 2031 (2021) prohibited local law-enforcement agencies and campus police departments from purchasing or deploying facial recognition technology unless a statute expressly authorizes it, and required any authorizing statute to keep the data under the agency's exclusive control, confidential and reachable only by warrant. Agencies already using it had to stop on July 1, 2021. Facial recognition technology is defined as an electronic system for enrolling, capturing, extracting, comparing and matching geometric facial data; airports with commercial service are exempt. SB 741 (2022) replaced the ban with an authorization framework.
Public Surveillance Prohibition Amendments
Utah SB 231 (2024) defines biometric surveillance information as analysis of surveillance information using biometric software to identify a person or their location from physical attributes, and bars a government entity from obtaining it without a warrant, subject to listed exceptions. Entities must adopt policies on the use, management and auditing of such information. The act also amends the definition of a facial recognition comparison in the 2021 facial recognition chapter so it excludes biometric surveillance information. Effective May 1, 2024.
Facial recognition technology; authorized uses.
Virginia SB 741 (2022) replaced the 2021 local police ban with a regulated framework. Local police, campus police and the State Police may use facial recognition only for listed authorized uses, with systems approved by the Division of Purchases and Supply and evaluated by NIST at 98 percent true-positive accuracy or better with minimal demographic variation. The State Police publish a model policy, agencies report annually, a match cannot by itself establish probable cause for a warrant, and misuse is a Class 3 misdemeanor. The act states its provisions expire July 1, 2026.
Law-enforcement agencies; surveillance technology reporting.
Virginia HB 1496 (2024) creates an annual inventory of police surveillance technology. Every state and local law-enforcement agency and sheriff's office must give the Department of Criminal Justice Services a list of the surveillance technologies it has procured by November 1 each year. Surveillance technology expressly includes biometric surveillance technology such as facial, voice, iris and gait recognition software and databases, and software that integrates or analyzes surveillance data, including predictive policing software. DCJS shares the lists with the State Crime Commission and the Joint Commission on Technology and Science. Effective July 1, 2024.
Prohibits the use of biometric surveillance system or biometric surveillance information in places of public accommodation; prohibits entering into any agreement that authorizes any third party to use any biometric surveillance system or biometric surveillance information; provides penalties for…
New York's S 8004 would add Civil Rights Law § 40-h making it unlawful for an owner, franchisor, franchisee or other operator of a place or provider of public accommodation to use any biometric surveillance system or its information, or let a third party do so on its behalf. Collecting biometric information would require written notice, a stated purpose and term, and a written release. Violators and those who aid or incite them would owe the aggrieved person at least the greater of $1,000 or actual damages per violation, plus attorneys' fees. Referred to Investigations and Government Operations January 7, 2026; it has not passed either chamber.
Data Privacy Amendments
Utah H.B. 444 (2025) amends the Government Data Privacy Act for state and local governmental entities. It defines "automated decision making" (decisions about a person by automated processing without human review) and says high-risk processing activities may include facial recognition technology and automated decision making. Each entity must describe its high-risk processing in an annual privacy program report, and the Utah Office of Data Privacy, which monitors high-risk processing, must help identify best practices on automated decision making and synthetic data. It applies to government, not businesses. Passed by two-thirds, it took effect when signed on March 27, 2025.
Sunset Public Utilities Commission
Colorado HB26-1326 continues the Public Utilities Commission to 2033 and changes many utility and carrier rules. Its AI-relevant provision is Section 23: a transportation network company (TNC) must run periodic checks using facial recognition software, or equally or more effective technology approved by the commission, to prevent driver impersonation, under commission rules. TNCs that mainly serve schools or government and meet at least 90% of the school-contract safety rules are exempt. Impersonating a TNC driver becomes a class 2 misdemeanor, or a class 6 felony during a felony. Signed May 29, 2026.
Generally revise laws related to privacy and facial recognition technology
Montana's SB 397 (Chapter 781 of 2023), the Facial Recognition for Government Use Act, bars state and local agencies, law enforcement, public employees and officials from using continuous facial surveillance and, with exceptions, from obtaining or using facial recognition technology or contracting vendors for it. The Department of Justice and local police may use it in criminal investigations under restrictions, including a warrant requirement, must tell defendants before trial, and must report use annually. Agencies may use facial verification only under a written use and privacy policy, with notice, vendor retention limits and human review training. People harmed may sue.
Requires the department of transportation to collect data from third-party identification verification services used by airline passengers for expedited security screening in public-use airports and submit a quarterly report to the governor, the temporary president of the senate and the speaker of…
New York's A 8209 would add Transportation Law § 14-o requiring each third-party identification verification service operating in the state (a private service using biometric data, including fingerprint and facial recognition, for expedited access to airport security checkpoints) to report quarterly to the department on passenger use, TSA identity checks, passengers lacking proper identification, security breaches and kiosks. The department would report quarterly to the Governor and Legislature. Would take effect immediately. Introduced May 5, 2025 and referred to the Transportation Committee (again January 7, 2026); it has not passed either chamber.
Requests a study of the use of facial recognition data by law enforcement
Louisiana's HR 199 is a House resolution, adopted 65-30 on June 10, 2021, that requests the House Committees on Administration of Criminal Justice and on Judiciary to jointly study law enforcement's use of facial recognition data, how it is obtained, and its use in investigations and legal proceedings, taking information from groups including the Department of Justice, police and sheriffs' associations, the ACLU and the NAACP. Their report, due February 1, 2022, was to include search, arrest and conviction statistics and recommendations on legislation to safeguard due process, privacy and civil liberties. As a resolution of one chamber, it does not change the law.
To implement the recommendations of the special commission on facial recognition technology
Massachusetts S1053 would replace G.L. c. 6, s. 220 to bar law enforcement from using facial recognition and other biometric surveillance except for State Police searches under set conditions (judge-authorized felony warrant, emergency, deceased identification, another agency's request). Reported favorably by the Judiciary Committee and referred to Senate Ways and Means September 29, 2025; it has not passed either chamber.
To provide accountability in the use of biometric recognition technology and comprehensive enforcement
Massachusetts S36 would add G.L. Chapter 110I regulating biometric recognition technology: covered entities owe duties of loyalty, care and confidentiality, may not sell biometric data, and may not install biometric recognition equipment in places open to the public. Referred to committee February 27, 2025; on May 12, 2025 it accompanied S43 (An Act to protect personal biometric data), which was referred to Senate Ways and Means.
Law enforcement agencies: facial recognition technology.
California's AB 1814 (2023-24 Regular Session) would add Penal Code section 13661 to bar a law enforcement agency or peace officer from using a facial recognition technology match as the sole basis for probable cause to arrest or search, and bar a judge from granting a warrant application based solely on a match. It passed the Assembly 70-0 but was held under submission in Senate Appropriations on August 15, 2024 and was not passed before the session ended.
SCH CD-STUDENT BIOMETRIC INFO
Illinois's SB 1239 would amend the School Code to bar school districts from buying, acquiring, using or contracting for biometric systems, including facial recognition software, on students. Districts holding student biometric information would have to destroy it within 30 days after the Act takes effect. Filed January 24, 2025; re-referred to Assignments April 11, 2025; it has not passed either house.
Establishing the Massachusetts Data Privacy Act
Massachusetts H104 would add G.L. Chapter 93M (the Massachusetts Data Privacy Act) and Chapter 93N (location data). Individuals could access, correct, delete and port covered data and opt out of profiling used for automated decisions with legal or similarly significant effects; biometric data is sensitive data. Referred to the Advanced Information Technology, the Internet and Cybersecurity Committee February 27, 2025; on November 17, 2025 it accompanied new draft H4746, which was referred to House Ways and Means that day.
Prohibits the use of biometric surveillance system or biometric surveillance information in places of public accommodation; prohibits entering into any agreement that authorizes any third party to use any biometric surveillance system or biometric surveillance information; provides penalties for…
New York's A 6211 (same as S 8004) would add Civil Rights Law § 40-h, making it unlawful for an owner, manager, employee or other agent of a place or provider of public accommodation to use a biometric surveillance system or biometric surveillance information, or to let a third party do so on its behalf. It would also require written notice and consent before collecting biometric information. Referred to the Assembly Governmental Operations Committee in February 2025 and again January 7, 2026; it has not passed either chamber.
ICE Out of Our Faces Act
The federal H.R. 7363 (ICE Out of Our Faces Act) would make it unlawful for any covered immigration officer (officers, employees, agents and contractors of ICE or CBP and officials deputized under INA section 287(g)) to acquire, possess, access or use in the United States any biometric surveillance system, including facial recognition, or information from one run by another entity. Data collected would have to be deleted within 30 days after enactment. Introduced February 4, 2026 and referred to the House Judiciary and Homeland Security committees (and the Border Security and Enforcement Subcommittee); no further action.
Requires AG to study law enforcement use of facial recognition technology and issue report with recommendations for Statewide policy.
New Jersey's A759 would require the Attorney General to study law enforcement use of facial recognition technology and report to the Governor and Legislature within six months of the bill's effective date, with recommendations for a statewide policy covering State and local law enforcement agencies.
Prohibits use of biometric surveillance system by business entity under certain circumstances.
New Jersey's S1464 would make it an unlawful practice under the Consumer Fraud Act for a business to use a biometric surveillance system (facial or other remote biometric recognition) on consumers at its premises unless it gives clear and conspicuous notice and has a lawful purpose. Businesses could not sell or profit from the data collected.
Relating To Consumer Protection.
Hawaii's SB 2036 (2026) would have added a new section to HRS chapter 481B prohibiting any person from engaging in 'surveillance pricing': offering or setting a customized price for a specific consumer or group based wholly or partly on information collected through electronic surveillance technology such as sensors, cameras, device tracking and biometric monitoring. A violation would be an unfair or deceptive practice under HRS 480-2. The Senate committee on LBT deferred it on February 11, 2026; it died.
Prohibits use of facial recognition technology on consumer except for legitimate safety purpose.
New Jersey's S3268 would make it an unlawful practice under the Consumer Fraud Act for a person selling goods or services at retail, or at a place of public accommodation, to use a biometric surveillance system (facial or other remote biometric recognition software) on a consumer, except for a legitimate safety purpose. Introduced February 2, 2026.
Prohibits collection of biometric identifier information by public or private entity under certain circumstances.
New Jersey's S 1463 would bar public and private entities in the State from collecting, retaining, converting, storing or sharing biometric identifier information gathered through biometric surveillance systems (including facial, iris, retina, voice, fingerprint or palm recognition), but would let them collect it if they post clear notice at every common entryway. Violations would carry civil penalties of $5,000 and $10,000, and a pattern of violations would be a crime. Referred to the Senate Law and Public Safety Committee January 13, 2026; it has not passed either house.
Relating To Artificial Intelligence.
Hawaii's HB 1734 (2024) would have required campaign advertisements containing an image, video or audio created wholly or partly with generative AI to include a clear and conspicuous disclosure, with format rules by media type (printed box for images, at least three seconds for audio, at least four seconds for video). Violators would face a fine under HRS 11-410. It was referred to JHA and FIN on January 24, 2024 and died when the 2024 session ended.
Relative to prohibiting certain uses of deepfakes and creating a private claim of action
New Hampshire's HB 1432 (Chapter 243 of 2024) makes fraudulent use of deepfakes a class B felony. A deepfake is video, audio or other media in which a person's face, body or voice has been digitally altered so they appear to be someone else or to say or do something they never did. Knowingly creating, distributing or presenting a deepfake of an identifiable person to embarrass, harass, entrap, defame, extort or cause financial or reputational harm is a crime, and a deepfake that leads to the person's arrest is a separate felony carrying liability for their defense costs. Victims may also sue for damages. News, satire and parody are excepted. Effective January 1, 2025.
Eyewitness Identification
Not law: died in committee. Florida's SB 1202 would have amended s. 92.70, F.S., on eyewitness identification: officers would have had to record the eyewitness's description in the offense report, use lineups with the suspect and at least five fillers, make efforts to use a lineup instead of a show-up, and record procedures on audio and video. If facial recognition technology identified a suspect, a lineup could not be held unless there was a basis independent of the facial recognition result. It died in Criminal Justice on March 13, 2026.
Artificial Intelligence Consumer Protection Amendments
Utah's SB 226 replaces the 2024 generative AI disclosure rules with Utah Code Title 13, Chapter 75. A supplier using generative AI with an individual in a consumer transaction must disclose it is AI, not a human, if the individual clearly asks. Regulated professionals must prominently disclose generative AI at the start of high-risk interactions (collecting health, financial or biometric data, or personalized financial, legal, medical or mental health advice). AI that discloses itself at the outset and throughout gets a safe harbor. Fines up to $2,500 per violation. Signed March 27, 2025; effective May 7, 2025.
STATE GOVT-GENERAL MANDATES
Illinois' Public Act 103-0101 (HB 3902), the Drones as First Responders Act, amends the Freedom from Drone Surveillance Act to let police use drones for search and rescue, infrastructure inspections, demonstrations, dispatched emergency calls and some government-hosted events. Police may not use onboard facial recognition in flight and may run drone data through facial recognition only to counter a terrorist risk found by the Homeland Security Secretary or on reasonable suspicion that swift action is needed to prevent imminent harm, escape or evidence destruction. Drones may not be armed. It revises data retention and adds Attorney General enforcement. Approved and effective June 16, 2023.
Extend Prohibition on School Facial Recognition
Colorado's SB 25-143 keeps the SB 22-113 ban on schools signing facial recognition contracts by deleting its July 1, 2025 repeal date. Contracts in effect April 18, 2025 stay allowed. New exceptions cover vendor tools used with board-approved curricula, which need opt-in consent, and safety uses: an articulable and significant threat, a missing student, or a person ordered to stay off school property. Safety systems may identify only the people involved and only while such a situation is occurring. Biometric identifiers may be kept no longer than 18 months, and aggrieved parties may seek an injunction. Signed and effective April 18, 2025 (Chapter 86).
AN ACT to amend Tennessee Code Annotated, Section 2-7-112 and Title 55, Chapter 50, relative to licenses.
Tennessee's HB 1316 (Public Chapter 297) renames the electronic driver license system the digital driver license system and limits its data use. A vendor providing the license app may not capture or retain biometric identifiers (retina or iris scans, fingerprints, voiceprints, hand or face geometry) except a photograph used solely to compare with the license photo on file, and neither the vendor nor the Department of Safety may collect geolocation data. Data from using a digital license may be kept no more than three days and not sold. Digital licenses cannot be used as voter ID. Signed April 24, 2025 (Public Chapter 297); effective on signing.
relative to the regulation of artificial intelligence technologies.
New Hampshire's HB 1725 (2026) would have created RSA chapter 359-V, "Responsible Artificial Intelligence Governance": a 7-member AI council, AI interaction disclosures, bans on AI developed with intent to unlawfully discriminate or for social scoring, limits on government biometric identification, a regulatory sandbox, and attorney general enforcement with civil penalties. The House voted it Inexpedient to Legislate on February 19, 2026, and it died.
BIPA-SECURITY PURPOSES
Illinois's HB 5635 (103rd General Assembly) would have amended the Biometric Information Privacy Act to waive certain requirements for collecting biometric identifiers or information in circumstances relating to security purposes, exclude information captured by a biometric time clock or lock that converts it to a mathematical representation, and add a one-year filing period and a 30-day cure notice. Died at Session Sine Die on January 7, 2025.
Establishes the crime of aggravated harassment by means of electronic or digital communication; provides for a private right of action for the unlawful dissemination or publication of deep fakes, which are digitized images which are altered to incorporate a person's face or their identifiable body…
New York's A 6293 would add Penal Law § 240.80, a class A misdemeanor for producing, distributing, publishing or broadcasting a "deep fake" (an altered image depicting a lewd sex act or graphic violence, published without written permission) with intent to harass, annoy, threaten or alarm. It would also extend the Civil Rights Law §§ 52-b and 52-c private rights of action to deep fakes. Would take effect immediately. Introduced March 3, 2025 and referred to the Science and Technology Committee (again January 7, 2026); it has not passed either chamber.
Prohibit Use of Personally Identifying Feature
Colorado's HB26-1049 would have made it a crime to use another person's fingerprint, voiceprint, retina or iris scan, or facial map in an advertisement, deepfake, image, video, voice recording, or other digital depiction without permission: a class 5 felony, or a class 4 felony if done to intentionally harm that person. A harmed person could sue for damages and attorney fees. The House committee postponed it indefinitely February 12, 2026; it is dead.
Establishes the "protect our privacy (POP) act" to impose limitations on the use of drones for law enforcement purposes; prohibits the use of drones by law enforcement at concerts, protests, demonstrations, or other actions protected by the first amendment.
New York's S 1096, the protect our privacy (POP) act, would add Civil Rights Law section 52-e. It would prohibit drone use by law enforcement agencies or for law enforcement purposes, with exceptions for search and rescue and examining dangerous areas after natural disasters, bar drones at concerts, protests and other First Amendment activity, and bar armed drones. Data from drones using facial recognition could not be used in investigations or prosecutions and would have to be deleted. Remedies would include suppression and a private action for the greater of $1,000 per violation or actual damages. Referred to Codes January 7, 2026; it has not passed either chamber.
Prohibiting the use of facial recognition technology in connection with driver's license photographs.
New Hampshire's HB 1329 adds RSA 263:40-b, which prohibits the department from using any facial recognition technology in connection with taking or retaining any photograph or digital image for purposes of RSA chapter 263 (drivers' licenses). Signed July 28, 2014 (Chapter 274); effective September 26, 2014, 60 days after passage.
AN ACT relating to violations of privacy.
Kentucky's SB 180 would make it unlawful, without a court-approved warrant, for state and local agencies to obtain or use facial recognition technology or information derived from it, and would set consent, retention and disclosure rules for private entities holding biometric identifiers. Violations could be enforced by private suits or the Attorney General, and facial-recognition evidence would be inadmissible in Kentucky proceedings. Introduced February 6, 2024; sent to the Senate Judiciary Committee February 8, 2024. It died when the 2024 session ended.
Consumer data protection and providing a penalty. (FE)
Wisconsin's SB 166 (as introduced March 27, 2025) would create a consumer data protection law (s. 100.80) for controllers handling the personal data of 100,000+ consumers, or 25,000+ consumers while deriving over 50 percent of revenue from selling data. Consumers could access, correct, delete and obtain their data and opt out of targeted advertising, sale and certain forms of automated processing. Controllers would owe privacy notices and data protection assessments, including for profiling. Violators would face forfeitures up to $10,000 per violation. It failed to pass pursuant to Senate Joint Resolution 1 on March 23, 2026 and did not become law.
Artificial intelligence; regulate use in health coverage decisions
Alabama's HB 515 (2025, as introduced) would have limited how health insurers use AI, algorithms or other software in utilization review. Medical necessity determinations would always have been made by a licensed physician or other competent health care professional. Insurers would have had to disclose AI use to enrollees and contracting providers, periodically review outcomes, and face civil suits for compensatory or punitive damages. Introduced April 3, 2025 and referred to the House Committee on Insurance; it died in committee when the 2025 session ended.
Synthetic digital representations and providing a penalty.
Wisconsin's SB 815 would have created s. 942.085, making it a Class A misdemeanor to create and post, publish, distribute or exhibit a deepfake (a synthetic digital representation of an individual's recognizable face, voice or likeness that looks authentic and was made without consent) with intent to coerce, harass or intimidate, and a Class I felony if done with intent to defraud, coerce or intimidate for monetary gain. Introduced January 14, 2026 and referred to committee; it failed to pass March 23, 2026.
Surveillance-based price setting prohibited.
Not law. Minnesota's HF 3408 would have added Minn. Stat. 325D.141 barring retail food stores from surveillance-based price setting, meaning customized prices based on personal information gathered through electronic surveillance technology such as cameras, device tracking, biometrics and facial recognition. Stores using facial recognition would post entrance signage, and larger stores' electronic shelf labels could change prices only once a day. It never left committee.
Prohibits the use of facial recognition and biometric information as the sole factor in determining the existence of probable cause to place in custody or arrest an individual.
New York's A 1447 would amend the Executive Law (new § 837-z) so that biometric identifying technology, including facial recognition, cannot be the sole factor in determining probable cause to place a person in custody or arrest them. By January 1, 2027, every municipal police department, sheriff's office and the State Police would have to adopt a written policy barring stops, detentions or searches solely motivated by the technology, or the Division of Criminal Justice Services would order a penalty of withheld state funds. Would take effect immediately. Referred to Governmental Operations January 7, 2026; it has not passed either chamber.
Protecting Everyone from Excessive Police Surveillance (PEEPS) Act
West Virginia's HB 4628, the Protecting Everyone from Excessive Police Surveillance (PEEPS) Act (2026 regular session), would have barred government officials from accessing databases of photos, video, license plate, facial recognition or cell site data that reveal locations more than 24 hours old unless there is a warrant, voluntary consent, a reported lost or stolen vehicle, exigent circumstances, or specified traffic, toll and parking uses. Data could be kept no more than 10 days. It was sent to House Judiciary on January 21, 2026 and died when the session ended March 14, 2026.
Prohibit surveillance-based price setting
Minnesota's SF 4199 would have prohibited retail food stores from surveillance-based price setting, meaning customized prices based on personal information gathered through electronic surveillance such as cameras, sensors, biometric data or facial recognition. It would also have required facial recognition signage and limited electronic shelf label price changes. Introduced March 9, 2026 and never left committee.
Prohibits the use of biometric identifying technology in schools for any reason other than certain specified purposes; adds fingerprint identification of teachers, administrators and students for the purpose of securely logging into a digital device for academic and administrative purpose to…
New York's S 3827-A would amend State Technology Law § 106-b so public and nonpublic elementary and secondary schools, including charter schools, are "prohibited from purchasing or utilizing biometric identifying technology for any purpose," including school security. Exceptions cover fingerprinting of prospective employees, fingerprint logins to digital devices and employees who consent in writing. Passed the Senate 38-21 on June 12, 2025 and was referred to the Assembly Education Committee; it has not passed the Assembly.
BIPA-VEHICLE SAFETY TECH
Illinois's SB 2051 (104th General Assembly) would amend Sections 10 and 25 of the Biometric Information Privacy Act to provide that nothing in the Act may be construed to apply to an entity using vehicle safety technology for a vehicle safety purpose. Filed February 6, 2025; last action: referred to the Senate Committee on Assignments that day.
Criminal Law - Mail and Package Theft (Porch Piracy Act of 2025)
Maryland's HB 210 (2025, the Porch Piracy Act of 2025, third reader) is a mail and package theft bill. It would have made taking mail or a package addressed to someone else a felony (up to 5 years), created penalties for mail theft and arrow-key offenses, and added mail theft under Criminal Law section 3-905.1 to the list of crimes in Criminal Procedure section 2-503(a)(1)(i) that police may investigate using facial recognition technology. It passed the House 137-0 and was referred to Senate Judicial Proceedings March 17, 2025; it died when the session ended.
Election Law - Influence on a Voter's Voting Decision By Use of Fraud - Prohibition
Maryland's SB 361 (2025, third reader text) would have added to the election law ban on influencing a voter's decision by force, threat or bribery a ban on doing so through fraud, with fraud including the use of synthetic media: an image, audio or video recording intentionally created or manipulated with generative AI or other digital technology to create a realistic but false image or recording. Violators would face the existing misdemeanor penalty (up to $5,000, 5 years, or both). It passed the Senate, was amended by the House, and went to conference; the Senate adopted the conference report April 7, 2025 (39-8), but the history shows no House action on it, so it died.
AN ACT RELATING TO LABOR AND LABOR RELATIONS -- ARTIFICIAL INTELLIGENCE USE AND FAIR EMPLOYMENT PRACTICES
Rhode Island SB 2499 (2026), as introduced on February 6, 2026, would add a chapter on electronic monitoring and automated decision systems in employment. It would make it unlawful for an employer to use an electronic monitoring tool to collect employee information unless stated conditions are met, bar tools that incorporate facial recognition, and require impact assessments. Employers would have to keep records for five years; penalties would be those in title 28. The text says it takes effect upon passage.
Worker data: prohibitions: artificial intelligence.
California's AB 2027 (2025-26 Regular Session) would add Labor Code provisions barring an employer from using a worker's personal information to train an artificial intelligence system to replicate, automate, or replace the worker's job, or from selling or providing that information to a third party for that purpose. Vendors serving employers would face parallel limits and contract terms. Held under submission in Assembly Appropriations on May 14, 2026; not passed before the session ended.
An Act Concerning Consumer Privacy And Protection.
Connecticut's Public Act 26-64 (SB 4) targets data-driven pricing and surveillance. Businesses that use an automated price setting device fed by personal data (other than to set a discount) and advertise the price online must show "THIS PRICE WAS INCREASED BY A PRICE SETTING DEVICE USING YOUR PERSONAL DATA" or similar. Retailers and delivery apps may not use surveillance pricing. Data privacy act controllers using facial recognition on premises for security must match only against their own database and post entrance signs. It also requires data brokers to register, bans selling precise geolocation data, and adds genetic-testing consent rules. Signed May 27, 2026; effective October 1, 2026.
Artificial Intelligence Companion Chatbots and Minors Act; established, enforcement, civil penalty.
Virginia's SB 796 (2026 Regular Session) would create the Artificial Intelligence Chatbots and Minors Act. Covered entities would have to implement reasonable systems and processes, try to notify emergency services of imminent risk and report covered incidents to the Attorney General. Passed the Senate 39-1; continued to 2027 in the House on March 2, 2026.
Chatbot Regulation
South Carolina's H 5138 would enact the Chatbot Protection Act (new Chapter 80 of Title 39). Chatbot providers would need affirmative consent to process personal data, could not use chat logs for advertising, would have to disclose that the user is talking to a chatbot, and would face civil penalties of up to $5,000 per violation. Introduced February 10, 2026 and referred to the House Labor, Commerce and Industry Committee; it has not passed either chamber.
MIND Act of 2025 Management of Individuals’ Neural Data Act of 2025
The federal S. 2925 (MIND Act of 2025) would direct the FTC to study the governance of neural data and related biometric and behavioral data, including how AI changes the risks, and report to Congress within 1 year after enactment, with $10,000,000 authorized. OSTP would then develop guidance, OMB would issue binding guidance, and federal agencies could not procure or operate neurotechnology that processes neural data inconsistently with it. Introduced September 29, 2025 and referred to the Senate Commerce Committee; no further action.
To prohibit the Federal Government from establishing or maintaining a database that contains data collected through, or facilitates, the biometric identity verification of a citizen of the United States, and for other purposes.
The federal H.R. 3693 would provide that an agency of the Federal Government "may not establish or maintain a database" that contains data collected through, or facilitates, the biometric identity verification of a citizen of the United States. It defines biometric identity verification as automated recognition of an individual based on biological or behavioral characteristics, including fingerprints, iris patterns or facial features. The one-section text has no penalties or effective date. Introduced June 3, 2025 and referred to the House Oversight and Government Reform Committee; no further action.
No Biometric Barriers to Housing Act of 2025
The federal H.R. 3060 (No Biometric Barriers to Housing Act of 2025) would, starting 1 year after enactment, bar owners of covered federally assisted rental housing from using or authorizing facial recognition, physical biometric or remote biometric recognition technology in a unit or its building or grounds for surveillance or any use that adversely affects tenants' fair access to housing. HUD must report within 1 year. Introduced April 29, 2025 and referred to the House Financial Services Committee; no further action.
Save Taxpayers’ Privacy Act
The federal H.R. 6616 (Save Taxpayers' Privacy Act) would have barred the Secretary of the Treasury from establishing or maintaining any verification process using facial recognition technology for access to an Internal Revenue Service online account or service. Introduced February 4, 2022 and referred to the House Ways and Means Committee; it died when the 117th Congress ended on January 3, 2023.
Prohibits the use of a facial recognition system by a landlord on any residential premises.
New York's A 322 (2023-2024) would have added Real Property Law § 235-j making it unlawful for any landlord to obtain, retain, access or use, on any residential premises, a facial recognition system or information obtained from one. The Attorney General could seek an injunction, restitution and a civil penalty of up to $10,000; affected people could sue for actual damages or $1,000, whichever is greater, plus attorneys' fees. Referred to the Housing Committee January 4, 2023 and again January 3, 2024; it never passed either chamber and died at the end of the 2023-2024 session.
Prohibits facial recognition technology to be used in connection with an officer camera used by both local and state police including the storage of biometric data.
New York's A 3712 would have added Executive Law §§ 837-x and 236 barring local police, peace officers and State Police from installing, activating or using facial recognition or biometric surveillance systems in connection with an officer camera or data collected by one. A person could sue the agency or officer for equitable or declaratory relief. A mobile fingerprint scanner exception applied. Would have taken effect on the ninetieth day after becoming law and expired five years later. Introduced February 7, 2023; it died at the end of the 2023-2024 session.
Prohibits the use of a facial recognition system by a landlord on any residential premises.
New York's A 6363 would add Real Property Law § 235-k making it unlawful for any landlord to obtain, retain, access or use, on residential premises, any facial recognition system or information obtained from one. The Attorney General could seek an injunction and a civil penalty of not more than $10,000; individuals could sue for actual damages or $1,000, whichever is greater, plus attorneys' fees. Would take effect on the 120th day after it becomes law. Introduced March 4, 2025 and referred to the Housing Committee (again January 7, 2026); it has not passed either chamber.
Restricts the use by an employer or an employment agency of electronic monitoring or an automated employment decision tool to screen a candidate or employee for an employment decision unless such tool has been the subject of a bias audit within the last year and the results of such audit have been…
New York's A 8328 would have added Labor Law § 203-g restricting employer use of electronic monitoring and automated employment decision tools: bias audits before use and annually, ten business days' notice to employees and candidates, human oversight, a ban on facial, gait or emotion recognition, a private right of action and civil penalties. Introduced December 13, 2023 and referred to the Labor Committee; the enacting clause was stricken January 10, 2024, and it died at the end of the 2023-2024 session.
Criminal Procedure – Facial Recognition Technology – Requirements, Procedures, and Prohibitions
Maryland's HB 338 limits police use of facial recognition technology in criminal investigations to listed serious crimes (crimes of violence, human trafficking, child abuse, hate crimes, weapon crimes, stalking and others), bans live or real-time identification, and allows searches only of license, ID and mugshot photos unless an agreement governs another database. A trained person must verify each result before use; results cannot alone establish probable cause or identity and serve as evidence only for warrants and preliminary hearings. Agencies must audit, post policies and report yearly. Signed May 16, 2024 (Chapter 809; identical to SB 182, Chapter 808); effective October 1, 2024.
Criminal Procedure - Facial Recognition Technology - Requirements, Procedures, and Prohibitions
Maryland's SB 182 limits police use of facial recognition technology in criminal investigations to listed serious crimes (crimes of violence, human trafficking, child abuse, hate crimes, weapon crimes, stalking and others), bans live or real-time identification, and allows searches only of license, ID and mugshot photos unless an agreement governs another database. A trained person must verify each result before use; results cannot alone establish probable cause or identity and serve as evidence only for warrants and preliminary hearings. Agencies must audit, post policies and report yearly. Signed May 16, 2024 (Chapter 808; identical to HB 338, Chapter 809); effective October 1, 2024.
Labor and Employment - Use of Facial Recognition Services - Prohibition
Maryland's HB 1202 bars employers from using a facial recognition service to create a facial template (the machine-interpretable pattern of facial features extracted from images) during a job applicant's interview unless the applicant consents by signing a waiver. The waiver must state in plain language the applicant's name, the interview date, that the applicant consents to facial recognition during the interview, and whether the applicant read the waiver. The act itself sets no penalty. Became law without the Governor's signature (Chapter 446, May 8, 2020); effective October 1, 2020.
Video Lottery Games, Table Games And Sports Wagering -- The Rhode Island Consumer Protection Gaming Act
Rhode Island S 146 (2023), as introduced on February 1, 2023, would amend the Consumer Protection Gaming Act to bar facial recognition technology and biometric recognition programs in video-lottery terminals at pari-mutuel licensees and in online betting applications. It would also prohibit algorithmic programs that use a gaming consumer's betting history to increase wagering, and AI or automated decision systems that promote play through intermittent reinforcement. The text states no penalties and takes effect upon passage.
An Act advancing the economic development of the commonwealth through comprehensive data privacy
Massachusetts' S 301 would add a new chapter 93M to the General Laws, the Massachusetts Information Privacy and Security Act, a comprehensive data privacy law with defined terms such as consent (which excludes dark patterns), controller, data broker and biometric information. In the captured text, a large data holder's risk assessment would also have to say whether processing relies on an algorithmic process, such as machine learning or AI, and describe its design, input data and outputs. The bill accompanied a study order on December 18, 2025 and did not advance.
LIFE with AI Act Learning Innovation and Family Empowerment with AI Act
The federal S. 3063 (LIFE with AI Act) would condition federal education funds on student-privacy rules: a simpler directory-information opt-out form, a bar on using student photos to train facial recognition without parental consent, and public ed-tech contracts with vendor privacy certifications. It would also create a "Golden Seal of Excellence in Student Data Privacy", a Privacy Technical Assistance Center, and teacher resources and research priority for AI in education. Introduced October 28, 2025 and referred to the Senate HELP Committee; no further action.
Prohibits the use of a facial recognition system by a landlord on any residential premises.
New York's S 2478 (2023-2024) would have added Real Property Law § 235-j making it unlawful for a landlord to obtain, retain, access or use on any residential premises a facial recognition system or information obtained from one. The Attorney General could seek an injunction and a civil penalty of not more than $10,000; affected people could sue for actual damages or $1,000, whichever is greater, plus attorneys' fees. Committed to Rules June 7, 2024 after Judiciary reported it; it died when the 2023-2024 session ended.
Deepfake pornography.
California's AB 621 rewrites Civil Code § 1708.86, the civil claim over sexually explicit deepfakes. A depicted person can sue anyone who creates and intentionally discloses, or intentionally discloses, digitized sexually explicit material (including images) when they know or reasonably should know the person did not consent or was a minor, and anyone who knowingly facilitates or recklessly aids or abets it. Deepfake pornography services and providers that keep them running after 30 days' notice face presumptions of liability. Statutory damages reach $50,000, or $250,000 if malicious, and prosecutors may sue. Signed October 13, 2025 (Chapter 673); effective January 1, 2026.
Prohibits the use of biometric surveillance technology by law enforcement; establishes the biometric surveillance regulation task force; and provides for the expiration and repeal of certain provisions
Not law. S 1033 would have barred New York police officers, peace officers and police agencies, including the State Police, from using biometric surveillance systems such as facial recognition, with exceptions such as lawful DNA comparison, fingerprinting and internal security systems. A 12-member task force would have studied the technology's accuracy, effectiveness and harms, especially to vulnerable groups, and recommended whether and how police could use it. The bill was recommitted and its enacting clause stricken on February 21, 2025, which ends it. The Assembly version, A 1045, has its own page.
Educ-Tech Rts/Biometric Info
Illinois's SB 3735 (104th General Assembly) would create the Student Educational Technologies Rights Act, giving students and parents rights to opt out of school-issued devices and predictive analytics and to request human review of AI-generated grades. It would bar school districts from acquiring biometric systems for students and limit operators from letting AI train on student data. Re-referred to Senate Assignments May 22, 2026.
Realigning Mobile Phone Biometrics for American Privacy Protection Act
The federal H.R. 7124 (Realigning Mobile Phone Biometrics for American Privacy Protection Act) would require the Secretary of Homeland Security, within 30 days after enactment, to develop standards and guidelines for DHS and its components that bar use of the Mobile Fortify and Mobile Identify mobile applications (and successors) except for identification at ports of entry, bar sharing them with other agencies, require their removal and remote disabling, and require destruction of images and fingerprints of U.S. citizens. Introduced January 15, 2026; referred to the House Homeland Security Committee and, January 16, to its Subcommittee on Border Security and Enforcement; no further action.
Relative to the use of artificial intelligence by state agencies.
New Hampshire's HB 1688 adds RSA chapter 5-D. State agencies may not use AI to classify people in ways that cause unlawful discrimination, use real-time remote biometric identification for public surveillance (except law enforcement with a warrant), or use deepfakes for deceptive or malicious purposes. Irreversible AI decisions need human review, generative AI material not reviewed by a human must be labeled, and users must be told when they interact with AI. Signed July 12, 2024 (Chapter 209); effective July 1, 2024.
Limit government use of AI systems
HB 178 (Chapter 427 of 2025) limits government AI use. State and local government entities and state officers may not use an AI system for cognitive behavioral manipulation, to classify people in ways that cause unlawful discrimination or disparate impact, for a malicious purpose, or to surveil public spaces except to find a missing, endangered or wanted person or as the facial surveillance law allows. AI-produced material published without review by a trained human must be labeled, and public-facing AI interfaces disclosed. Any AI recommendation or decision that could affect a person's rights must be reviewed by a responsible human who can reject or modify it. Effective October 1, 2025.
ILLINOIS PRIVACY RIGHTS ACT
Illinois's HB 5581 (103rd General Assembly) would have created the Illinois Privacy Rights Act, giving consumers rights to access, correct, delete and obtain a copy of their personal data and to opt out of targeted advertising, sale, or profiling in furtherance of solely automated decisions with legal or similarly significant effects. It would apply only to entities above specified consumer-data thresholds. Died at Session Sine Die on January 7, 2025.
Requires AG to study law enforcement use of facial recognition technology and issue report with recommendations for Statewide policy.
New Jersey's A5616 would require the Attorney General to study law enforcement use of facial recognition technology and report to the Governor and Legislature within six months of the act's effective date. The report would include recommendations for a Statewide policy. Introduced May 5, 2025. A bill of the Legislature's 2024-2025 session, which ended January 13, 2026.
Prohibits use of facial recognition technology on consumer except for legitimate safety purpose.
New Jersey's S 968 (2024-2025 session, as introduced) would make it an unlawful practice under the Consumer Fraud Act for a person selling goods or services at retail, or operating a place of public accommodation, to use a biometric surveillance system (software that performs facial recognition or other remote biometric recognition) on a consumer, except for a legitimate safety purpose. The bill's statement says violations would carry penalties up to $10,000 for a first offense and $20,000 after. Introduced January 9, 2024 and referred to the Senate Commerce Committee; it died when the 2024-2025 session ended.
Technology; artificial intelligence; state agencies; prohibited uses; permitted uses; Office of Management and Enterprise Services; effective date.
Oklahoma's HB 3545 (2026), as engrossed, would have set rules for state agency use of AI: banning cognitive behavioral manipulation, discriminatory classification, real-time remote biometric identification in public spaces (with warrant and emergency exceptions) and deceptive deepfakes, and requiring human review of high-risk AI decisions. It passed the House 96-0 on March 11, 2026 and was referred to a Senate committee April 1, 2026; it died when the session ended May 14, 2026.
Relating to: prohibiting state agencies and local governmental units from using facial recognition technology or data generated from it.
Wisconsin's AB 575 (2025-26) would have created s. 995.80 to prohibit any state agency or local governmental unit from using facial recognition technology, or data generated from it, for any purpose except identifying its own employees for employment-related purposes. It was referred to the Criminal Justice and Public Safety Committee on October 24, 2025 and failed to pass pursuant to Senate Joint Resolution 1 on March 23, 2026.
A bill for an act relating to the licensure of artificial intelligence augmented and autonomous service providers, and including penalties.
Iowa's HSB 766, a House Appropriations study bill, would create a board of autonomous medical practice to license AI augmented and autonomous service providers (AAASPs) that run clinical AI services. A license would be required for fully autonomous AI and for certain advisory and supervised AI. Providers would face patient disclosures, a duty of loyalty, insurance and bond requirements, and civil penalties up to $1,000 per violation per day. A subcommittee recommended passage March 24, 2026; it has not passed either chamber.
AN ACT to amend Tennessee Code Annotated, Title 10; Title 24 and Title 38, relative to historical location data.
Tennessee's SB2215 (114th General Assembly), the "Protecting Everyone from Excessive Police Surveillance (PEEPS) Act," would have barred government officials, including government contractors, from accessing a database (including license plate, facial recognition, biometric or cellular location data) that reveals a person's or vehicle's location more than 24 hours earlier, except with a felony search warrant, consent, exigent circumstances or other listed cases. Companion: HB 2608. Not passed before the session ended in April 2026; last action: Assigned to General Subcommittee of Senate Judiciary Committee (March 23, 2026).
Prohibits use of biometric surveillance system by business entity under certain circumstances.
New Jersey's A3929 would make it an unlawful practice under the Consumer Fraud Act for a business entity to use a biometric surveillance system, meaning facial or other remote biometric recognition software, on a consumer at its physical premises unless it gives clear notice and uses it for a lawful purpose. Businesses could not sell, share or profit from the information. This describes the bill as introduced (pre-filed text); later amendments, if any, are not reflected.
Concerning the use of facial recognition services.
Washington's Chapter 257, Laws of 2020 (ESSB 6280) governs state and local government use of facial recognition services (chapter 43.386 RCW). Before use, an agency must give notice to its legislative authority and publish an accountability report after public comment and community meetings. Decisions with legal or similarly significant effects require meaningful human review; services must be tested in operational conditions and vendors must allow independent accuracy and bias testing. Ongoing surveillance, real-time identification and persistent tracking need a warrant, exigent circumstances or a court order. The governor vetoed section 10 (a task force). Effective July 1, 2021.
Relates to transparency and safety requirements for developers of artificial intelligence models
New York's S 8828 (Chapter 96 of 2026) is the chapter amendment to the RAISE Act (Chapter 699 of 2025). It repealed and replaced General Business Law Article 44-B and set the effective date at January 1, 2027. Developers of frontier models (over 10^26 training operations) must publish transparency reports when deploying and report critical safety incidents to a Department of Financial Services office within 72 hours. Those with over $500 million in revenue must also publish and follow a frontier AI framework, report internal-use risk assessments, file disclosure statements and pay assessments, and face Attorney General penalties up to $1 million, then $3 million. Signed March 27, 2026.
Directs the commissioner of education to conduct a study on the use of biometric identifying technology; prohibits the use of biometric identifying technology in schools until July 1, 2022 or until the commissioner authorizes such purchase or utilization, whichever occurs later.
New York's A 6787-D barred public and nonpublic elementary and secondary schools, including charter schools, from buying or using biometric identifying technology until July 1, 2022 or until the Commissioner of Education authorized it after a public report, whichever was later. As signed it added Education Law § 2-e; Chapter 2 of 2021 moved it to State Technology Law § 106-b, had the Office of Information Technology Services write the report, and allowed employee fingerprinting and consenting-employee uses. In September 2023 the Commissioner banned facial recognition in schools and left other biometrics to local decision. Signed December 22, 2020 (Chapter 349); effective immediately.
Prohibits the use of biometric surveillance technology by law enforcement; establishes the biometric surveillance regulation task force; and provides for the expiration and repeal of certain provisions
New York's S 5609 (same as A 1045) would add Executive Law §§ 837-y and 236 to bar police agencies, police officers, peace officers and the state police from acquiring, possessing, accessing, installing, activating or using biometric surveillance systems (such as facial recognition) or information derived from them. A 12-member task force would study whether to allow police use. Reported from the Senate Internet and Technology Committee and committed to Codes February 25, 2026; it has not passed either chamber.
Relating To Traffic Safety.
Hawaii's HB 1231 (Act 212 of 2025) bars photo red light imaging detector systems and automated speed enforcement systems from using or being equipped with facial recognition software or biometric identification technology. Automated license plate readers and non-biometric technology used to verify vehicle identity or registration or to produce photographic evidence of a violation are exempt. It also requires each county to impose a $5 motor vehicle registration surcharge for the safe routes to school program by December 31, 2025, and revises the mailing rules for speed camera citations. Became Act 212 June 25, 2025; effective on approval.
Prohibits the use of facial recognition and biometric information as the sole factor in determining the existence of probable cause to place in custody or arrest an individual.
New York's A 519 (2023-2024) would have amended the Executive Law (new § 837-y) so that biometric identifying technology, including facial recognition, could not be the sole factor in determining probable cause to place a person in custody or arrest them. By January 1, 2025 every municipal police department, sheriff's office and the State Police would have had to adopt a written policy barring stops, detentions or searches solely motivated by such technology. Referred to Governmental Operations January 9, 2023 and January 3, 2024; it never passed and died at the end of the 2023-2024 session.
Enacts the "facial recognition technology study act" to study privacy concerns and potential regulatory approaches to the development of facial recognition technology.
New York's A 2642 (the "facial recognition technology study act") would have created a seven-member task force to study the proper regulatory approach to facial recognition technology: privacy concerns, regulation by other jurisdictions, misuse, and the best administrative methods. It would report to the governor and legislature within one year of the act's effective date. Introduced January 26, 2023 and referred to the Governmental Operations Committee (again January 3, 2024); it died at the end of the 2023-2024 session.
Use of Surveillance Technology by Law Enforcement
Colorado's SB26-071, the Surveillance Accountability and Freedom Ensured (SAFE) Act, would have set rules for law enforcement surveillance technology, including facial recognition systems, which could be used only after a warrant or in exigent circumstances with an imminent public-safety threat. The requirements would apply from July 1, 2027. The Senate Judiciary Committee postponed it indefinitely 6-1 on May 6, 2026; it is dead.
Imposes liability for misleading, incorrect, contradictory or harmful information to a user by a chatbot that results in financial loss or other demonstrable harm.
New York's A 10494 would have added General Business Law § 390-f barring a chatbot proprietor (an entity with more than twenty employees) whose chatbot serves as an alternative to a human representative from disclaiming liability when the chatbot gives “materially misleading, incorrect, contradictory or harmful information” causing financial loss or other demonstrable harm, unless it cured the harm within thirty days of notice. Clear notice that users face an AI chatbot was also required. Referred to Consumer Affairs and Protection May 29, 2024; it died at the end of the 2023-2024 session.
Requires the division of criminal justice services to formulate a protocol for the regulation of the use of artificial intelligence and facial recognition technology in criminal investigations; restricts the use of artificial intelligence-generated outputs in court.
New York's A 10625 would have amended Executive Law § 837 to require a standardized written protocol for police use of AI and facial recognition technology in criminal investigations, and added Criminal Procedure Law § 60.77 making AI-generated outputs, including facial recognition results, inadmissible as evidence in criminal or civil proceedings. Referred to the Codes Committee June 20, 2024; it died at the end of the 2023-2024 session.
Prohibits the use of biometric surveillance technology by law enforcement; establishes the biometric surveillance regulation task force; provides for the expiration and repeal of certain provisions.
New York's S 1609 (2023-2024) would have added Executive Law sections 837-x and 236 prohibiting police agencies, officers, peace officers and State Police members from acquiring, possessing, accessing or using a biometric surveillance system, or information derived from one. Exceptions covered mobile fingerprint scanning, the State DNA index and the statewide fingerprint system. It also created a Task Force on the Regulation of Biometric Surveillance. Reported and committed to Codes May 7, 2024, it died when the 2023-2024 session ended.
Prohibits the use of biometric identifying technology in schools for any reason other than specified purposes.
New York's S 7944 (2023-2024) would have amended State Technology Law § 106-b to prohibit public and nonpublic elementary and secondary schools, including charter schools, from purchasing or using biometric identifying technology for any purpose, replacing the earlier temporary bar. Schools could still use it for fingerprint identification of prospective employees as education law requires and to identify employees who consent in writing. Referred to Internet and Technology January 4, 2024, reported and committed to Education May 7, 2024; it died when the 2023-2024 session ended.
Provides relative to unlawful conduct involving images of another person created by artificial intelligence (REF SEE FISC NOTE GF EX)
Louisiana's HB 119 (Act 782), the Ivy Daniels Act, makes it a crime to possess an AI-created video or image of a person under 17 who is nude or has intimate areas exposed, when the possessor knows or has reason to know they are not authorized to have it: up to five years, at least one without parole, probation or suspension. Unlawful dissemination or sale of AI-created images of another now carries up to one year, a fine up to $1,000, or both, or up to five years if the person depicted is under 17. Educators who victimize students may face an additional two years. Public schools must inform students in grade 6 and up and their parents yearly. Signed June 9, 2026; effective August 1, 2026.
LABOR: Provides relative to the use of automated decision systems with respect to employment decisions (OR INCREASE GF EX See Note)
Louisiana's HB 421 would have regulated employers' use of automated decision systems in employment decisions: written notice to workers at least 30 days before first use, bans on facial, gait and emotion recognition, no sole reliance on an automated system for discipline, termination or deactivation, human review, and worker appeals. Louisiana Works could cite violators ($500 civil penalty) and workers could sue. It was referred to committee March 9, 2026 and died.
Directs the director of the office of information technology services to conduct a study on the use of biometric identifying technology; prohibits the use of biometric identifying technology in schools until July 1, 2022 or until the commissioner of education authorizes such purchase or…
This 2021 chapter amendment re-enacted New York's moratorium on biometric identifying technology, including facial recognition, in schools as State Technology Law 106-b. Schools, including charter schools, could not buy or use it until July 1, 2022 or Commissioner of Education authorization, whichever is later, and only after a state IT office study. After that report (August 2023), the Commissioner in September 2023 barred schools from using facial recognition and let them decide locally on other biometric technology.
To implement the recommendations of the special commission on facial recognition technology
Massachusetts H1946 would replace G.L. c. 6, s. 220 to bar law enforcement from using facial recognition and other biometric surveillance except for State Police searches under set conditions (judge-authorized felony warrant, emergency, deceased identification). Referred to the Judiciary Committee February 27, 2025; on October 23, 2025 it accompanied new draft H4640, which was reported favorably and referred to House Ways and Means.
Addressing artificial intelligence, student discipline, and surveillance in public schools.
Washington's SB 5956 (1st substitute, 2026 session) would have limited AI, automated decision systems (ADS) and surveillance technology in public school discipline. An ADS could not have been the sole or determinative basis for a discipline decision, districts could not have used ADS risk scores or watchlists predicting misconduct or violence, and biometric data could not have been used to infer emotions or other sensitive traits. It passed the Senate 35-13 on February 10, 2026 but was returned to Senate Rules on March 12 and died at adjournment.
To promote transparency of facial recognition and driver's license photos
Massachusetts S1731 would add G.L. c. 90, s. 8N requiring the Registry of Motor Vehicles to post notices at licensing offices, give applicants written information and publish website information on how officers use and access targeted face recognition on driver's license and ID photos in criminal investigations. It did not advance as its own bill: on December 4, 2025 it accompanied study order S2798.
CHATBOT RESPONSE LIABILITY ACT
Illinois's SB 3368 (104th General Assembly) would create the Chatbot Response Liability Act. A chatbot proprietor could not disclaim liability when its chatbot gives materially misleading, incorrect, contradictory or harmful information resulting in financial loss, other demonstrable harm or bodily harm to the user or a third party, would have to give clear notice that users are talking to AI, and would face companion chatbot rules including parental consent for minors. Re-referred to Assignments May 22, 2026.
Relating To Artificial Intelligence.
Hawaii's HB 2137 (Act 247 of 2026) adds a new HRS chapter making it unlawful to knowingly publish a realistic digital imitation (a highly realistic AI-generated depiction, audio or video of a real person's voice, face or likeness in a work they did not perform in) without the person's express written consent if it is used in an advertisement, causes harm, or is used for fraud, defamation, harassment or other crimes. Parody, satire, commentary, news and documentaries are exempt. The person or their estate (up to 10 years after death) may sue for an injunction, up to $25,000 per advertisement or actual damages, punitive damages if malice is proven, and fees. Act 247; effective July 14, 2026.
Requires retailers to post warning signs of the tracking and collecting of customers biometric data through electronic devices; provides for civil penalties.
New York's S 2539-C would add General Business Law § 390-f. A retailer that tracks customers through a cell phone, store-installed camera or other electronic device would have to conspicuously post a plain-language warning sign at each entrance, and a retailer that collects biometric information would have to post a sign describing what is collected and how it is used. Selling, leasing, trading or sharing biometric information for value would be unlawful. Civil penalties are up to $100 for a first violation. Passed the Senate May 12, 2026 (55-5); on June 1, 2026 the Assembly substituted it for A1558-C and put it on its third-reading calendar. No Assembly vote is shown; not yet law.
Establishes the crime of aggravated harassment by means of electronic or digital communication; provides for a private right of action for the unlawful dissemination or publication of deep fakes, which are digitized images which are altered to incorporate a person's face or their identifiable body…
New York's S 6278 would add Penal Law § 240.80, making it a class A misdemeanor, with intent to harass, annoy, threaten or alarm, to produce, distribute, publish or broadcast a deep fake: an altered digital image that puts a person's face or body part into a pornographic or lewd sex act or graphic violence without the person's explicit written permission. It would also amend Civil Rights Law §§ 52-b and 52-c to allow lawsuits over unlawful deep fakes. Referred to Codes January 7, 2026; it has not passed either chamber.
An act relating to restricting electronic monitoring of employees and the use of employment-related automated decision systems
Vermont's H.262 (2025-2026 biennium) would have limited employers' electronic monitoring of employees and use of automated decision systems (ADS) in employment decisions (new 21 V.S.A. sec. 495q). Employers would have had to give 15 days' notice before monitoring and could use an ADS only with human corroboration, an impact assessment and notice, never relying on its output alone. Facial, gait, voice and emotion recognition would be banned. It was referred to House General and Housing on February 19, 2025 and died.
Facial Recognition Act of 2025
The federal H.R. 4695 (Facial Recognition Act of 2025) would let officers use facial recognition with a reference photo database only under a court order lasting no more than 7 days, or narrow emergency exceptions. It would ban face surveillance and use for immigration enforcement, bar a match as the sole basis for probable cause, require NIST accuracy testing and audits, exclude evidence from violations and allow suits for the greater of profits or $50,000 per violation. Introduced July 23, 2025 and referred to the House Judiciary and Science, Space, and Technology committees; no further action.
To implement the recommendations of the special commission on facial recognition technology
Massachusetts H4640, a new draft of H1946, would replace G.L. c. 6, s. 220 to bar law enforcement from using facial recognition and other biometric surveillance except for State Police searches under set conditions (registrar identity checks, judge-authorized felony warrant, emergency, deceased identification, another agency's request). Reported favorably by the Judiciary Committee and referred to House Ways and Means October 23, 2025; it has not passed either chamber.
Law Enforcement - Use of Facial Recognition Technology - Images Captured in Dwelling Interior
Maryland's HB 756 (2026, first reader text) would have added an exception to Criminal Procedure section 2-503 letting law enforcement use facial recognition technology on still or video images captured by a camera inside a dwelling to investigate arson, burglary and trespass offenses. It had a House Judiciary hearing set for February 24, 2026 and died when the 2026 session ended.
Enacts the "facial recognition technology study act" to study privacy concerns and potential regulatory approaches to the development of facial recognition technology.
New York's A 8788, the "facial recognition technology study act," would create a seven-member task force (two appointed by the governor, two by the senate temporary president, two by the assembly speaker, one by the director of the office of information technology services) to study the proper regulatory approach to facial recognition technology, including privacy concerns and misuse, and report to the governor and legislature within one year of the effective date. It regulates no one. Would take effect immediately. Referred to Governmental Operations June 5, 2025 (and January 7, 2026); it has not passed either chamber.
To prohibit the Federal Government from using facial recognition technology as a means of identity verification, and for other purposes.
The federal H.R. 3782 would provide that an agency of the Federal Government "may not use facial recognition technology as a means of identity verification." It defines the technology as a contemporary security system that automatically identifies and verifies the identity of an individual from a digital image or video frame. The one-section text has no exceptions, penalties or effective date. Introduced June 5, 2025 and referred to the House Oversight and Government Reform Committee; no further action.
Acquisition and use of facial recognition technology by government entities prohibited.
Minnesota's HF 3146 would have barred state and local government entities, law enforcement agencies and officials from obtaining, retaining, accessing or using face surveillance systems or their information, or contracting with private entities to do so. Evidence from violations would have been inadmissible, and people could sue for damages of at least $1,000 or $100 per violation, whichever is greater, plus injunctions. Introduced April 7, 2025 and referred to Public Safety Finance and Policy and it never left committee.
To provide accountability in the use of biometric recognition technology and comprehensive enforcement
Massachusetts H96 would add G.L. Chapter 110I regulating biometric recognition technology: covered entities that collect or process biometric data owe duties of loyalty, care and confidentiality, may not sell it, and may not install biometric recognition equipment in places open to the public. Referred to the Advanced Information Technology, the Internet and Cybersecurity Committee February 27, 2025; on November 17, 2025 it accompanied new draft H4746, which was referred to House Ways and Means that day.
Fourth Amendment Restoration Act
West Virginia's HB 4682, the Fourth Amendment Restoration Act (2026 regular session), would have barred law enforcement officers, and anyone acting for law enforcement purposes, from using seven listed technologies, including facial recognition, license plate readers and surveillance drones, unless a warrant based on probable cause authorizes use against a specific person. Knowing and willful use would be a felony. It was sent to House Judiciary on January 21, 2026 and died when the session ended March 14, 2026.
A bill for an act relating to private entity requirements concerning biometric data, and providing civil penalties.
Iowa's SSB 3085 would create Code chapter 554J requiring private entities holding biometric data (such as facial geometry, fingerprints or voice) to have a public retention policy, give written notice before collecting, never sell it, and protect it. The Department of Inspections, Appeals, and Licensing would enforce with civil penalties of $1,000, $5,000 and $10,000; no private right of action. Senate subcommittee recommended passage February 4, 2026.
An act relating to use of facial recognition technology by law enforcement in cases involving sexual exploitation of children
Vermont's H.195 (Act 17 of 2021) makes a narrow exception to the 2020 moratorium on police facial recognition (Act 166 of 2020, Sec. 14). Law enforcement may use facial recognition technology during a criminal investigation into sexual exploitation of children under 13 V.S.A. chapter 64, but only to search for images, including video, of a victim, potential victim or identified suspect within electronic media legally seized in that investigation. The act took effect on passage; the Governor signed it May 4, 2021.
State-by-State Regulation of Facial Recognition
Artificial intelligence regulation is advancing at the state level. This page lists the 199 published bills we track on Facial Recognition. State attorneys general, privacy regulators, and legislatures are developing a patchwork of laws that impose different obligations on businesses deploying AI systems related to this topic. Compliance teams and legal counsel must track both enacted laws and the pipeline of pending bills that could shift requirements at any time.
Obligations differ from bill to bill. Depending on the law, they can include consumer disclosure obligations, prohibition on specific high-risk uses, mandatory algorithmic impact assessments, bias audits, rights to explanation, and human override requirements. Penalties for non-compliance vary by state — use our Penalty Tracker to review enforcement provisions. For upcoming effective dates, see the Deadlines page.
To understand how Facial Recognition laws intersect with specific industries, browse our Healthcare, Employment, Insurance, and Financial Services industry trackers. Compare how different state laws approach this topic using our Bill Comparator.