Facial Recognition Laws: Police Use & State Rules (2026)

Facial recognition technology (FRT) lets police and government agencies compare a photo or video frame against a database of identified faces to generate an investigative lead. No federal statute governs when they can do this. Instead, a patchwork of state statutes, city ordinances, and court rulings decides what is allowed, and that patchwork has moved in both directions in the last five years.

Information last verified on August 14, 2026. This article has not yet been reviewed by a licensed lawyer.

Jurisdiction scope: This article covers government and law-enforcement use of facial recognition technology in the United States: the federal legal gap, how police use FRT in investigations, state and city restrictions, and the court cases shaping the rules. It does not cover private businesses scanning customer faces for marketing or loss prevention, which is a separate body of state consumer-privacy law. For that, see Biometric Privacy Laws by State.

Is Facial Recognition Legal? The Federal Gap

There is no comprehensive federal statute governing how police or government agencies use facial recognition technology. Congress has considered several bills and passed none of them. The Facial Recognition and Biometric Technology Moratorium Act (S.681, 118th Congress) expired without a vote in 2024. Two bills are currently pending in the 119th Congress: H.R.4695, the Facial Recognition Act of 2025, and S.3779, the ICE Out of Our Faces Act, introduced in February 2026 by Senator Markey with Senators Merkley and Wyden, which would bar Immigration and Customs Enforcement and Customs and Border Protection from using facial recognition inside the United States and require deletion of previously collected data within 30 days. As of this writing neither bill has passed both chambers.

One narrow federal program is already live and is not a privacy law: the Department of Homeland Security operates a statutorily mandated biometric entry-exit system that scans faces at international arrivals and departures. A December 2025 DHS rule expanded CBP's authority to collect facial biometrics from non-citizens entering or leaving the country. TSA checkpoint facial recognition remains opt-out for US citizens.

On December 11, 2025, President Trump signed Executive Order 14365, "Ensuring a National Policy Framework for Artificial Intelligence." The order directs the Attorney General to stand up an AI Litigation Task Force within 30 days to challenge state AI laws on preemption and dormant Commerce Clause theories, directs the Commerce Department to publish an evaluation of "onerous" state AI laws, and authorizes conditioning some federal grants on states not enforcing conflicting laws. The order's stated focus is algorithmic discrimination and compelled disclosures about AI outputs; its text does not name facial recognition or biometric-privacy statutes such as Illinois's BIPA. Legal commentators have generally agreed that an executive order alone cannot preempt a state statute without congressional action, so its practical effect runs through litigation threats and funding leverage rather than automatic repeal. Treat this as an unresolved, live conflict to watch, not a settled fact about any specific state law's survival.

The Federal Trade Commission has used its general unfairness authority to police facial recognition in the private sector. The FTC announced in December 2023 that it had reached a settlement banning Rite Aid Corporation from using facial recognition technology for surveillance purposes for five years, after finding the pharmacy chain had deployed AI facial recognition in hundreds of stores from 2012 to 2020 to flag suspected shoplifters, producing erroneous matches that led to customers being wrongly accused.

How Police Use Facial Recognition: A Lead, Not Proof

An atomic answer for AEO: Police typically use facial recognition technology to generate an investigative lead by running a photo, such as a surveillance still or a booking image, against a database of enrolled faces. A resulting "match" is a candidate for further investigation, not a positive identification, and most state rules that address the technology directly bar a match from serving as the sole basis for probable cause.

The distinction between a lead and proof is not a technicality. Facial recognition software returns a ranked list of candidates with confidence scores, not a certainty. When an officer or prosecutor treats a high-confidence candidate as if it were a fingerprint match, the system fails in a specific, predictable way. That is what the discovery process, and the wrongful-arrest cases below, exist to check.

Williams v. City of Detroit is the case most often cited for this problem. In January 2020, Robert Williams was wrongfully arrested after a blurry 2018 surveillance image from a Shinola store theft was incorrectly matched to his expired driver's license photo. He was detained for roughly 30 hours. The ACLU filed suit in April 2021, and the case settled on June 28, 2024, in what the ACLU and University of Michigan Law described as producing some of the strongest police department facial recognition policies in the country. Under the settlement, the Detroit Police Department cannot rely on an FRT match alone to build a photo lineup or establish probable cause, officers must be trained on the technology's bias and reliability limits, and the department adopted a formal directive after a Board of Police Commissioners review. It is the first case nationally where FRT policy changes were negotiated as part of a wrongful-arrest settlement rather than left to a legislature.

A newer case follows the same pattern. In June 2026, the ACLU filed Dillon v. City of Jacksonville Beach on behalf of a Florida man who alleges he was wrongly arrested after a facial recognition system returned a 93 percent confidence match on a photo that was not actually him. The lawsuit's allegations are unproven, and the case is pending, but it illustrates the same underlying risk Williams raised nationally five years earlier: a high confidence score is not the same thing as a correct identification, and an officer who treats it as proof rather than a lead can build a warrant affidavit on a foundation the technology itself was never designed to support.

When a Match Goes to Court: The Discovery Fight

Once a facial recognition lead becomes part of a criminal case, a separate legal question arises: what does the defense get to see about how that lead was generated? On June 24, 2026, the New Jersey Supreme Court answered that question in State v. Miles, ruling that criminal defendants are entitled in discovery to the facial recognition software's name, its published error rates, the original probe photo used for the search, and the other candidate matches the system returned alongside the defendant's photo. The court did not require the government to turn over the software's underlying source code, drawing a line between what a defendant needs to test the identification against and what a vendor can keep as a trade secret.

That ruling matters beyond New Jersey because it addresses a gap most state FRT statutes do not: even where a state requires a warrant or a human review step before a search, it says little about what a defendant is entitled to know once that search becomes evidence in their case. A defense lawyer who cannot learn a system's error rate, or see the other candidates it returned, cannot meaningfully challenge whether a match was reliable.

State Rules for Police and Government Use of Facial Recognition

A handful of states have passed statutes specifically governing when and how a government agency can use facial recognition technology. The rules below reflect the source cited for each state; where a detail could not be independently confirmed, it is described as reported rather than stated as settled fact.

Virginia is the state most likely to be described incorrectly right now, because its rules just changed and the change ran the opposite direction from how it has been widely reported. Virginia banned local and campus law-enforcement use of facial recognition outright in 2021 (2021 Sp. Sess. I, c. 537): no local or campus police agency may purchase or deploy FRT unless a separate statute expressly authorizes it, and a statute that does not mention facial recognition does not count as authorization. In 2022, c. 737 layered a temporary, detailed authorized-use regime on top of that ban for the Virginia State Police (new Va. Code § 52-4.5) and, for local and campus police, amended § 15.2-1723.2 and § 23.1-815.1 to permit FRT for 14 enumerated purposes under guardrails: a publicly posted policy, an annual usage report due April 1, a requirement that any algorithm score at least 98 percent true positive accuracy on a NIST Face Recognition Vendor Test, and a bar on using a match alone to establish probable cause. The 2022 act itself said so in its closing line: "the provisions of this act shall expire on July 1, 2026."

That is what happened. Virginia's local and campus police rules changed on that date, but the detailed regime did not newly take effect then, it expired then. As of this writing, the Code of Virginia's official text of §§ 15.2-1723.2 and 23.1-815.1 has reverted to the original 2021 ban language: no local or campus police agency may purchase or deploy facial recognition technology unless a different statute expressly authorizes it, and this research did not find such an authorizing statute currently on the books. Any FRT a local or campus department does use under an authorizing statute must stay under that agency's exclusive control, with data kept confidential and accessible only by warrant. The Department of State Police's § 52-4.5 authority carried the identical July 1, 2026 sunset, and the official Code of Virginia site shows no successor provision in its place; whether and how state police FRT use is currently authorized is unresolved as of this writing and should be confirmed directly with the Virginia State Police or the General Assembly before relying on it.

Massachusetts limits facial recognition searches under M.G.L. c. 6, § 220, part of the state's 2020 police reform law effective July 1, 2021. A law enforcement agency may perform a facial recognition search only to execute a court order based on specific and articulable facts supporting an ongoing criminal investigation or a substantial risk of harm, or without an order to identify a deceased person or address an imminent emergency. Agencies must document each search and report quarterly to the state's Executive Office of Public Safety and Security.

Maine has, by reputation among privacy advocates, the strictest state framework. A 2021 law (LD 1585, enacted as PL 2021, c. 394) bars state, county, and municipal departments, employees, and officials from using, possessing, or contracting for facial recognition technology, with narrow exceptions where there is probable cause an unidentified person in an image committed a serious crime, or to identify a missing or deceased person. An individual who believes the law was violated can seek injunctive or declaratory relief, and a violating public employee faces discipline up to termination. The law is codified at 25 M.R.S. § 6001, titled "Facial surveillance," in Title 25, Part 14 (Surveillance), Chapter 701; the official statute page carries the note "PL 2021, c. 394, §1 (NEW)," the same public law enacted from LD 1585.

Vermont imposed a moratorium on law-enforcement facial recognition use through S.124 (2020), enacted as 2020 Acts and Resolves No. 166, Sec. 14. The moratorium is freestanding session law rather than a codified Vermont Statutes section. Sec. 14 provides that until law-enforcement use of the technology "is authorized by an enactment of the General Assembly," an officer "shall not use facial recognition technology or information acquired through the use of facial recognition technology unless the use would be permitted with respect to drones under 20 V.S.A. § 4622." That cross-referenced section, 20 V.S.A. § 4622, is titled "Law enforcement use of drones," and its only facial-recognition language is a narrow bar at subsection (d)(2) on running facial recognition or other biometric matching against drone-collected data about any person, home, or area other than the target of the surveillance. Section 4622 is the carve-out the moratorium points to, not the moratorium itself.

The General Assembly has used that escape hatch once. 2021 Acts and Resolves No. 17 (H.195), signed May 4, 2021 and effective on passage, authorizes law enforcement to use facial recognition "during a criminal investigation into sexual exploitation of children under 13 V.S.A. chapter 64." The authorization is tightly bounded: police must already hold an image of a person they believe to be a victim, potential victim, or identified suspect, and the search must be "solely confined to locating images, including videos, of that individual within electronic media legally seized by law enforcement in relation to the specific investigation." That is the only enacted authorization found, so every other law-enforcement use remains under the 2020 moratorium.

Montana enacted SB 397 in July 2023, codified at Mont. Code Ann. Title 44, Chapter 15 (§§ 44-15-104, -105, -106, and -108). Section 44-15-104 bans "continuous facial surveillance," meaning ongoing monitoring of public places or third-party image sets matched against a prepopulated watchlist, outright. Outside that ban, a law enforcement agency generally needs a warrant to run a facial recognition search, with an exception for an imminent threat to safety, and a match alone cannot establish probable cause. The law also requires meaningful human review of any identification before it is acted on.

Utah centralizes facial recognition authority under Title 77, Chapter 23e of the Utah Code, restricting comparisons against state-maintained or state-shared image databases to the Department of Public Safety, a narrower model than most states that let any agency run its own searches. Permitted purposes include felony investigations, violent crimes, and identifying deceased, incapacitated, or at-risk individuals. A 2024 amendment added a warrant requirement on top of the existing serious-crime limitation.

Connecticut took a different approach entirely in 2026, and it is worth being precise about what its new law does and does not do. Public Act 26-64, signed by Governor Lamont on May 27, 2026, amends the Connecticut Data Privacy Act to require businesses using facial recognition technology on their premises to post clearly legible signage at every public entrance, with a QR code or link to the business's facial-recognition policy. That signage duty begins October 1, 2026, with Attorney General enforcement starting February 1, 2027. This is a private-business notice requirement, not a restriction on police use of the technology, and should not be read as Connecticut regulating law-enforcement FRT the way Virginia or Massachusetts do.

New Jersey has no confirmed statewide statute or Attorney General directive governing general police use of facial recognition. What is confirmed is narrower: in January 2020, then-Attorney General Gurbir Grewal directed New Jersey police departments to stop using the Clearview AI app specifically. The AG's office solicited public comment toward a possible broader statewide FRT policy in February 2022, but no evidence was found that a final statewide directive was ever issued. Treat any claim of a general New Jersey police FRT statute as unconfirmed.

Which States and Cities Restrict Facial Recognition? A Restriction Tracker

The table below is illustrative, not a complete 50-state or nationwide-city survey; it lists the jurisdictions where this article's research could confirm a specific instrument and its current status. City ordinances on this topic move quickly and sometimes reverse, so treat "status" as the most recent confirmed information rather than a permanent fact, and verify directly with the jurisdiction before relying on any row for a specific decision.

Watch out: A city or state that "banned" facial recognition in 2019 or 2020 is not necessarily still banning it today, and the reverse is just as true: a regulated-use framework can lapse back into a ban. New Orleans reversed its ban in 2022, Baltimore's private-sector ban lapsed on its own sunset clause the same year without a replacement, and Virginia's detailed 2022 authorization framework for local and campus police carried a July 1, 2026 sunset clause that expired rather than newly took effect, reverting those agencies to a statutory ban. Confirm current status before relying on a jurisdiction's older reputation, or on press coverage of a law with a built-in expiration date.

Private Companies, Consumer Devices, and Biometric Privacy Law

Everything above concerns government and police use of facial recognition. A separate, older body of state law covers private businesses collecting biometric data, including faceprints, for commercial purposes, most prominently Illinois's Biometric Information Privacy Act (BIPA), Texas's Capture or Use of Biometric Identifier Act (CUBI), and Washington's RCW 19.375. That consumer-privacy layer is covered in full in this site's Biometric Privacy Laws by State guide and its BIPA hub; it is not duplicated here. Three recent controversies show how the government and commercial layers intersect.

Clearview AI, the facial recognition company that scrapes billions of images from the public internet to build its search database, tried to resolve a nationwide BIPA class action in an unusual way, and the attempt has since unraveled. The settlement, reached in June 2024, would have given the plaintiff class a 23 percent equity stake in Clearview AI, valued at roughly $51.75 million based on a January 2024 company valuation, rather than a cash payment. A federal district judge granted final approval on March 20, 2025 over the objection of a coalition of 22 state attorneys general and the District of Columbia, who argued the equity stake was speculative relief. Objecting class members appealed that approval, and in mid-July 2026, the Seventh Circuit Court of Appeals vacated it and sent the case back to the district court, holding that the settlement's unequal share allocation across state-based subclasses (Illinois class members received 10 shares, several other states 5, everyone else 1) created a structural conflict of interest among the class representatives under Federal Rule of Civil Procedure 23. As of this writing the settlement has been set aside, the litigation is active again, and there is no new settlement or trial date.

Amazon's Ring is the subject of a June 2026 class action, Sigwalt v. Amazon.com, alleging its "Familiar Faces" feature scans the faceprints of non-users, people who never signed up for Ring, without their consent. The complaint itself notes that Ring withholds the Familiar Faces feature in Illinois, Texas, and Portland, Oregon specifically because of those jurisdictions' stricter biometric laws, which is itself a useful illustration of how a state biometric statute changes a national product's default behavior rather than only creating a lawsuit risk after the fact. A near-identical pair of proposed class actions followed against a competing product in Google's Nest doorbell: Fennessy v. Google and Trevino v. Google, both filed in the Northern District of California in the summer of 2026, allege Nest's "Familiar Face Detection" scans bystanders who never bought or set up the device, and again describe Illinois as the one place Google disables the feature by default.

Madison Square Garden used facial recognition beginning in June 2021 to identify and deny entry to attorneys at more than 90 law firms that had active litigation against MSG's subsidiaries, using photos scraped from those firms' own websites. New York Attorney General Letitia James opened an inquiry in January 2023, questioning whether the practice violated state civil rights protections against retaliation. According to later reporting, an appellate court allowed the underlying exclusion policy to remain in place on the specific claims tested so far, meaning the policy was not struck down at that stage. A newer and legally distinct controversy followed in June 2026, when proposed class actions accused MSG Entertainment of a facial-recognition data breach exposing entry records; those negligence claims remain unproven and are a data-security question separate from the entry-ban policy itself.

Your Rights: Practical Questions

Can police run my photo through facial recognition? It depends entirely on where you are. In Maine and Vermont, government use is banned outright with narrow exceptions; Virginia's local and campus police reverted to a similar ban on July 1, 2026 when their 2022 authorization framework's sunset clause expired. In Massachusetts, Montana, and Utah, police can use FRT but only within statutory limits, generally a warrant or court order, an accuracy floor, or a serious-crime threshold. In most states, there is no FRT-specific statute at all, which means the legal basis for a search is whatever the agency's internal policy says, not a law a resident can point to.

Can stores or businesses scan my face? That is a different legal question from anything on this page. States including Illinois, Texas, Washington, Colorado, and Maryland, along with cities such as New York and Portland, place notice or consent requirements on private businesses collecting biometric data. See Biometric Privacy Laws by State for how that works state by state, since the rules for a retailer's camera are governed by consumer-privacy statutes, not the police-use rules described above.

What should I do if I believe I was wrongly arrested because of a facial recognition match? This is general information, not legal advice for your situation. Both Williams v. City of Detroit and the pending Dillon v. City of Jacksonville Beach case proceeded through a civil rights lawsuit after the underlying criminal matter, with counsel from the ACLU. A person in that position typically needs to document the arrest and any facial recognition evidence referenced in the police report or warrant affidavit, and consult a lawyer licensed in their state promptly, since civil rights claims carry filing deadlines that vary by jurisdiction.

Related Resources

• Automated License Plate Reader (ALPR) Laws covers the closely related vehicle-tracking technology many of the same police departments also use.
• Surveillance Camera Laws by State covers the general legal framework for security and public cameras.
• Biometric Privacy Laws by State covers private-sector collection of biometric data, including BIPA, CUBI, and similar state statutes.
• Illinois BIPA: Do I Have a Claim? covers how to evaluate a potential claim under Illinois's biometric statute.
• Oregon Police Bodycam Laws covers a state that separately restricts facial recognition on bodycam footage.
• Amazon Ring Sued Over "Familiar Faces" Facial Recognition, Google Nest Doorbell Facial Recognition Lawsuits, NJ Supreme Court Sets Facial-Recognition Discovery Floor, Virginia Police Facial Recognition Rules, Connecticut Requires Facial-Recognition Signs, Florida Man Sues Police Over Facial Recognition Arrest, and Madison Square Garden Faces Class Actions Over a Facial-Recognition Data Breach cover the current cases and laws referenced throughout this article.

---

Last updated: 2026-08-14.

Frequently Asked Questions

Is facial recognition legal for police to use?

It depends on the state. Maine and Vermont bar nearly all government use with narrow exceptions. Virginia, Massachusetts, Montana, and Utah allow it under specific statutory limits such as a warrant or accuracy floor. Most other states have no facial-recognition-specific statute, so use is governed by agency policy rather than a law.

Can a facial recognition match alone lead to my arrest?

In states with a statute addressing this, generally no. Virginia and Montana both bar a facial recognition match from serving as the sole basis for probable cause in a warrant. Robert Williams' 2020 wrongful arrest in Detroit, based on a mismatched surveillance image, is the case most often cited for why that limit exists.

Is there a federal law regulating police facial recognition?

No. No comprehensive federal statute governs government or police use of facial recognition technology. Two bills, H.R.4695 and S.3779, are pending in Congress as of August 2026, but neither has passed both chambers.

Which states have banned police use of facial recognition?

Maine and Vermont have the closest to an outright ban. Maine's exceptions cover serious crimes and identifying missing or deceased persons; Vermont's 2020 moratorium has one enacted legislative carve-out, for child sexual exploitation investigations under 13 V.S.A. chapter 64. Virginia's local and campus police reverted to a similar ban on July 1, 2026, when the 2022 law authorizing their use expired on its own built-in sunset clause. Several cities, including San Francisco, Oakland, and Portland, separately ban government use at the local level, though city ordinances can and do change.

Did any city reverse its facial recognition ban?

Yes. New Orleans banned police use of facial recognition in 2020 and reversed that ban in 2022, now permitting police to use FRT to investigate roughly 46 enumerated serious crimes without a judicial approval or notice requirement. Virginia's statewide framework also moved from a total 2021 ban to a regulated-use system after a 2022 repeal.

Does Executive Order 14365 eliminate state facial recognition laws?

Not automatically. The December 2025 order directs federal litigation against certain state AI laws and authorizes conditioning some federal funding on states not enforcing them, but its text does not name facial recognition or biometric statutes specifically, and legal commentators generally agree an executive order alone cannot preempt a state law without congressional action.

Can stores use facial recognition to identify me as a shoplifter?

Whether a store can do this, and what notice or consent it owes you, is governed by state consumer-privacy law, not the police-use rules on this page. The FTC banned Rite Aid from using facial recognition for surveillance for five years in a December 2023 settlement after finding the chain's system produced erroneous shoplifting matches. See Biometric Privacy Laws by State for the state-by-state consumer rules.

What is Clearview AI and is it legal?

Clearview AI is a facial recognition company that built its search database by scraping billions of images from the public internet, then sells search access to law enforcement and other customers. It reached a nationwide Illinois BIPA class action settlement in 2024 giving the class a 23 percent equity stake rather than cash, and a court approved that settlement in March 2025 over a coalition of state attorneys general's objection. The Seventh Circuit vacated that approval in mid-July 2026 over a defect in how the settlement treated different state subclasses, so the case is back in active litigation and there is no final settlement as of this writing.

What information am I entitled to if I am charged based on a facial recognition match?

In New Jersey, the state Supreme Court ruled in June 2026 (State v. Miles) that a criminal defendant is entitled to the facial recognition software's name, its published error rates, the original probe photo, and the other candidate matches the system returned, though not the software's underlying source code. Other states' discovery rules vary; consult a lawyer licensed in your state.

Does Virginia allow police to use facial recognition now?

Not currently for local or campus police. Virginia's detailed 2022 authorization framework (a public policy, annual reporting, a 98 percent accuracy standard) was written with a built-in expiration date of July 1, 2026, and it expired on that date rather than newly taking effect. Va. Code §§ 15.2-1723.2 and 23.1-815.1 have reverted to their original 2021 text: no local or campus police agency may purchase or deploy facial recognition technology unless a separate statute expressly authorizes it, and no such statute was found to currently exist. The status of the State Police's authority under § 52-4.5, which had the same sunset clause, is unresolved as of this writing; confirm current status directly with the Virginia General Assembly before relying on it.