A recent essay on Substack opens with a scene most city dwellers will recognize: you pass a dozen cameras before you even reach work, and your face may be scanned, tagged, and logged without a flash or any notice. The piece frames this as a quiet trade of liberty for control. For readers of a privacy site, the practical question is narrower: what do facial recognition privacy laws actually restrict, and which tools help?

The short answer is that the law is a patchwork, and a VPN is not part of the solution for this particular problem.

How Facial Recognition Tracks You Without Consent

Facial recognition works by turning an image of your face into a numerical template, then comparing it against other templates. Legal commentators note that both the facial image and the numerical code assigned to a face can count as personal information under privacy law.

What makes the technology different from many other biometric systems, according to the ACLU, is that it can be used for general surveillance when combined with public video cameras. A fingerprint scanner requires you to press a finger to glass. A camera network requires nothing from you. You do not opt in, and you often cannot tell whether a given camera is running recognition software or simply recording.

That is the core consent problem. In public spaces, there is rarely a moment where anyone asks, and rarely a sign explaining what happens to the data afterward.

Which Facial Recognition Privacy Laws Restrict Surveillance

There is no single global rule. What exists depends heavily on where you are.

United States. Analysts have long pointed out that there is no federal law regulating the collection of biometric data, including facial recognition data. Instead, protection comes from a mix of state laws and local rules. Facial recognition laws are generally treated as a subset of biometric privacy law. Illinois is the best-known example: its approach says a private entity may not obtain a person's biometric identifier without first informing the subject that it is being collected or stored. Some laws go further and require explicit consent before biometric data is collected, including data gathered through facial recognition. The stakes can be high. One social media feature alleged to have scanned facial geometry without consent led to a $650 million settlement.

The brief for this article also points to bans in some US states and cities. These tend to focus on government use, so a ban in one city may not cover private retailers, landlords, or employers. Check the specific scope of any rule that applies to you.

European Union. The EU AI Act is the major regional framework that restricts certain facial recognition uses. Its rules are tiered and contain conditions and exceptions, so reading a headline summary is not the same as knowing what applies to a specific camera. If you live in the EU, look at your national data protection authority's guidance for how the rules are applied locally.

Two caveats are worth keeping in mind. Laws in this area change quickly, and some widely cited commentary is several years old. Also, a law restricting a practice does not mean the practice has stopped. Enforcement, exceptions, and who is covered all matter.

Why a VPN Can't Hide Your Face

A VPN encrypts the traffic between your device and a VPN server, and it masks your IP address from the sites you visit. That is useful for protecting your browsing from local network snoops and for limiting what websites learn about your location.

It does nothing about a camera pointed at your face on a street, in a shop, or at a transit gate. That camera is not reading your internet traffic. It is capturing light. No encryption tunnel sits between your face and the lens.

There is a narrower overlap worth understanding. If a service asks you to upload a selfie or ID photo for verification, the image travels over the network, and a VPN can protect it in transit. It cannot control what the company does with your face once it arrives. Digital identity systems that rely on certificates and cryptographic keys, such as public key infrastructure (PKI), verify who you are without needing a scan of your face at all, which is a useful distinction when evaluating whether a biometric check is truly necessary.

What This Means For You

Facial recognition privacy laws are strongest where a legislature has acted and where regulators enforce the rules. If you live in a place with a biometric consent law, you may have the right to be told when your face data is collected and, in some cases, to take legal action when it is misused. If you live somewhere without one, your protections may be thin.

It also means you should separate two kinds of privacy: what you do online, and what is recorded about your physical presence. Different tools and different laws cover each one.

Practical Steps and Legal Tools That Do Protect You

  • Learn the rules where you live. Search for your state, city, or national data protection authority's guidance on biometric data. Note whether the rules cover private businesses, government agencies, or both.
  • Read notices and ask questions. If a business or employer collects face data, ask what is stored, how long, and who receives it. In places with consent requirements, they may owe you a clear answer.
  • Decline optional face scans. When a face unlock, photo tagging, or selfie verification is optional, consider whether an alternative like a passcode works for you.
  • Review app and platform settings. Turn off face-matching or tagging features you do not use.
  • Use your legal rights. Where access or deletion rights exist, you can request what a company holds about you.
  • Support clear rules. Public comment periods and local council meetings are where many camera policies are set.

The Bottom Line

Cameras that scan faces in public are a legal and civic issue, not a network security one. Understanding facial recognition privacy laws where you live is the most useful first step, because it tells you what rights you can actually exercise. Keep using a VPN for what it does well, protecting your network traffic, but do not expect it to shield your face. Look up your local biometric rules this week, and adjust the optional settings you control today.