Virginia's Facial Recognition Rules for Local Police Expired on July 1, 2026

Virginia's Facial Recognition Rules for Local Police Expired on July 1, 2026

Virginia's detailed, regulated-use framework for local and campus police facial recognition technology (FRT), the one built around a state-police model policy, a 98% NIST accuracy floor, and annual public reporting, expired on its own terms on July 1, 2026. Under Va. Code sections 15.2-1723.2 and 23.1-815.1, local and campus police agencies are now back under Virginia's original 2021 rule: they may not purchase or deploy facial recognition technology unless a separate statute expressly authorizes it, and no such authorizing statute has been found.

Information last verified on August 14, 2026. This is a developing story; we update it as the record changes.

Status: The 2022 regulated-use framework for local and campus police expired July 1, 2026. Local and campus police are currently under the 2021 purchase-and-deployment ban. The status of Va. Code section 52-4.5 (State Police) after the same sunset date is unresolved; no successor text has been posted.

Jurisdiction scope: This story covers Virginia state, local, and campus law enforcement use of facial recognition technology under Va. Code sections 15.2-1723.2, 23.1-815.1, and 52-4.5. It does not cover private business or employer use of facial recognition, which Virginia regulates separately under the Virginia Consumer Data Protection Act's biometric-data provisions.

What Happened

In 2022, the Virginia General Assembly passed 2022 Va. Acts c. 737, which built a detailed, regulated-use framework on top of Virginia's 2021 ban on local and campus police buying or deploying facial recognition technology. That 2022 act let local law-enforcement agencies and campus police departments use FRT for a defined list of "authorized uses," so long as they adopted a State Police model policy (or their own policy that met or exceeded it), used only algorithms clearing a 98% NIST accuracy threshold, and filed an annual public report. The same act created Va. Code section 52-4.5, giving the Department of State Police its own version of that same authority.

The catch, easy to miss without reading the act's own enactment clauses, is that this framework was never permanent. Clause 3 of 2022 Va. Acts c. 737 states plainly: "That the provisions of this act shall expire on July 1, 2026." That sunset applied to all three sections the act touched, sections 15.2-1723.2, 23.1-815.1, and 52-4.5 alike.

July 1, 2026 has now passed. The live Code of Virginia site (law.lis.virginia.gov) confirms the change directly: it now displays section 15.2-1723.2 and section 23.1-815.1 under the header "(Effective July 1, 2026)," and the operative text under that header is not the regulated-use framework. It is Virginia's original 2021 language:

"No local law-enforcement agency shall purchase or deploy facial recognition technology unless such purchase or deployment of facial recognition technology is expressly authorized by statute. For purposes of this section, a statute that does not refer to facial recognition technology shall not be construed to provide express authorization."

Section 23.1-815.1 imposes the identical rule on campus police departments. In effect, absent a new law naming facial recognition technology specifically, local and campus police in Virginia are back under a functional purchase-and-deployment ban, the same rule that governed them before the 2022 act's temporary carve-out took effect.

Section 52-4.5, the State Police's authorized-use statute, is a separate question. As of this writing, the official Code of Virginia site shows only the pre-sunset "(Effective until July 1, 2026)" version of that section, with no post-sunset replacement text posted anywhere in Title 52, Chapter 1. That does not confirm the State Police's regulated-use authority continues uninterrupted; it means the public record does not yet show what, if anything, replaced it. This story will update once a successor version is published or the General Assembly acts.

What the Law Actually Says

The reverted rule for local and campus police. Va. Code section 15.2-1723.2 (local police) and section 23.1-815.1 (campus police) now read as a ban with one narrow escape hatch: an agency may not purchase or deploy facial recognition technology unless a different statute expressly authorizes it, and that authorizing statute must specifically mention facial recognition technology. A general grant of investigative authority does not count. No such authorizing statute has been identified.

What carries over regardless. Even if a future statute authorizes FRT purchase or deployment, the reverted text requires that any such technology stay under the agency's exclusive control, that resulting data be kept confidential and not disseminated or resold, and that data only be accessed through a criminal search warrant or an administrative or inspection warrant. Those baseline data-control rules survived the sunset; they were not part of what expired.

What did not carry over. The detailed rules that governed FRT use from 2022 to mid-2026, the State Police model policy requirement, the 98% NIST accuracy floor, the annual April 1 public reporting duty, the bar on using a match alone for probable cause, and the Class 3 and Class 1 misdemeanor penalties for misuse, applied only while the now-expired framework was in effect. The current reverted ban text does not include a comparable penalty provision of its own.

State Police status. Section 52-4.5 authorized the Department of State Police to use FRT under the same kind of model-policy, accuracy-floor, and reporting structure. It carried the identical "provisions of this act shall expire on July 1, 2026" sunset from 2022 Va. Acts c. 737. Unlike sections 15.2-1723.2 and 23.1-815.1, the official Code of Virginia site has not posted any post-sunset version of section 52-4.5, current or reverted. Readers should treat its status as unresolved until the Code is updated or the General Assembly clarifies it, not as continuing under the 2022 framework by default.

This reverted framework sits alongside Virginia's separate, business-facing biometric privacy rules. The Virginia Consumer Data Protection Act classifies biometric identifiers as sensitive data requiring opt-in consent from private businesses, a framework enforced by the Attorney General rather than tied to the police-specific statutes discussed here. It also runs parallel to Virginia's general surveillance camera laws, which govern how cameras themselves may be placed and operated, and to the state's recording-the-police rules, which cover a citizen's right to film officers in public, a distinct question from what technology police can point back at the public.

Analysis: Why This Matters

The following is analysis from the Recording Law Editorial Team. Virginia's 2022 to 2026 experiment shows how a sunset clause can quietly undo a regulatory framework if nobody moves to renew it. The General Assembly built in real safeguards, an independent accuracy benchmark, mandatory public reporting, a bar on FRT-alone probable cause, but tied the entire package to a four-year expiration date rather than making it permanent. When that date arrived without a legislative replacement, Virginia did not end up in a permanent middle ground; it snapped back to the stricter 2021 default.

That default is significant because of the anti-circumvention clause built into the reverted text. Virginia lawmakers did not leave a gap that agencies or courts could read broadly. The statute says directly that a law which does not mention facial recognition technology cannot be read to authorize it, closing off the argument that some other general policing statute might quietly fill the void.

The unresolved status of section 52-4.5 is worth watching separately. A framework that expires for local and campus police but leaves State Police authority publicly undocumented creates exactly the kind of ambiguity that invites a legal challenge or a legislative fix. Readers should not assume State Police FRT use is either confirmed-lawful or confirmed-banned based on this story alone; it means the public record has not caught up.

How This Affects You

If you live, work, or attend a public college in Virginia, this reversion means local and campus police currently may not purchase or deploy facial recognition technology against you unless a specific statute authorizes it, something that has not been identified as of this writing. That is a stronger protection than the 2022 to 2026 regulated-use period offered, not a weaker one. It does not change your separate right to record the police yourself, which is governed by Virginia's one-party consent recording law. If you encounter a local or campus agency that appears to be using facial recognition technology now, that use would need to trace back to a statute that specifically authorizes it. This is general information, not an assessment of any specific department's compliance.

This is general legal information, not legal advice. It covers Virginia and reflects sources verified on August 14, 2026. Laws change and this story is developing; consult a lawyer licensed in your jurisdiction about your specific situation.

Related articles

• Virginia Recording Laws: Recording the Police
• Virginia Biometric Privacy Laws
• Virginia Surveillance Camera Laws
• Virginia Data Privacy Laws (VCDPA)
• Surveillance Camera Laws by State

Last updated: 2026-08-14. This is a developing story; details verified as of 2026-08-14.