Your face is a form of identification you cannot reset like a password. Yet in the United States, the rules governing who can scan it, store it, and match it depend heavily on where you live. A recent guide from FC AI walks through where facial recognition is used, how state biometric laws such as Illinois BIPA work, and what the FTC has done. This post turns that material into a practical look at facial recognition laws and US rights, and what you can realistically do about your own face data.
Where facial recognition is used in the US
Facial recognition systems analyze images of human faces to identify people, as the ACLU describes them. The technology shows up in several places: law enforcement investigations, retail and commercial settings, and on online platforms where photos and videos are uploaded.
That range matters because different rules apply to each. Government use, private business use, and platform use are not governed the same way. One recent essay we covered, a dozen cameras before work, describes how an ordinary commute can involve your face being scanned, tagged, and logged without you noticing anything at all.
There is also no single national rulebook for private-sector use. That gap is why state laws carry so much weight.
Facial recognition laws US rights: what BIPA and other state laws let you do
Illinois' Biometric Information Privacy Act (BIPA) is the best-known state biometric law. In general terms, laws like it restrict how private companies can collect and use biometric data. Businesses that gather this information must inform consumers and justify what they are doing, according to legal commentary on the topic.
Illinois is not alone. Reporting on the topic notes that Texas also has a law against using the technology to identify people without informed consent. Washington passed House Bill 1493 in 2017, which at the time made it only the third state to regulate the collection and use of biometric data.
The practical takeaway is that your rights vary by state. In a state with a biometric law, you may have a right to be told before your face data is collected and to expect limits on how it is used. In a state without one, you may have to rely on a company's own policies, general consumer protection rules, or action by the FTC, which the FC AI guide also covers.
For a deeper comparison of how these frameworks differ, our explainer on how face matching works under BIPA, GDPR and the EU AI Act breaks down the technology and the legal approaches side by side.
How to opt out or request deletion of your face data
You have more options than you might expect, even if some take a little effort.
- Check privacy settings on platforms. Many services that handle photos include settings related to face recognition or tagging. Review them and turn off anything you did not knowingly choose.
- Read the notice. If a business collects biometric data in a state with a biometric law, it is generally expected to tell you. If you see a notice or consent form, read what is being collected and why before agreeing.
- Send a written request. Contact the company's privacy team and ask what face data they hold, whether they will delete it, and how long they keep it. Keep a copy of your request and any reply.
- Decline where you can. Where a service offers a non-biometric alternative, such as a different way to verify your identity, choose it.
- Know your state. If you live in Illinois, Texas, or Washington, your rights may be stronger than those in states without biometric laws. Look up your state's rules before you write to a company.
No request is guaranteed to succeed, and rights differ by state and by who holds the data. But asking creates a record and tells companies that people are paying attention.
What a VPN can and cannot do against face scanning
This is where expectations need to be realistic. A VPN encrypts your internet traffic and masks your IP address from the sites you visit. That can limit some forms of online tracking, such as linking your activity to your network location.
It does not stop a camera from scanning your face on a street, in a store, or at a transit hub. Those systems never touch your VPN connection. It also does not help if you log in to a platform and upload photos. Once an image is on an account you control, the platform can analyze it regardless of your IP address.
In short, a VPN addresses network-level privacy. Facial recognition is mostly an identity and consent problem, which is why laws and settings matter more here than tools alone.
What This Means For You
The rules protecting your face data depend on your state, the type of organization collecting it, and the choices you make on the services you use. Federal lawmakers are also paying attention: coverage of the reintroduced federal facial recognition ban bill shows how the debate over government use is still developing. A related proposal would bar federal agencies from using automated license plate readers, reflecting broader concern about automated surveillance.
None of these proposals changes your situation today. What you can control right now is your own settings, your consent, and the requests you make.
Actionable takeaways
- Find out whether your state has a biometric privacy law, and what it requires of businesses.
- Audit the face-related settings on the apps and platforms you use.
- Send deletion or opt-out requests to companies that may hold your face data, and save the correspondence.
- Use a VPN for what it does well, but do not count on it to stop face scans in public or on accounts you are logged into.
- Keep reading: start with our face matching explainer and the federal ban bill coverage for more legal context.
Understanding facial recognition laws and your US rights is the first step. Checking your state's protections and submitting a request this week is the second.
