Facial recognition
Also known as: Face verification · Facial biometrics · Face match · BIPA
Technology that compares the features of a face against one or more reference images to confirm or establish a person's identity.
Legal basis
Illinois BIPA, 740 ILCS 14/15
Two different uses share the name. In verification (1:1), the system confirms that the face in front of the camera matches the photo on a driver's license or passport — the selfie step in remote onboarding. In identification (1:N), it searches a database for a face to find out who it is. Without liveness detection, a printed photo, a screen or a deepfake can pass the match.
There is no federal biometric privacy statute; the rules are state-level. Illinois's BIPA requires written notice and a written release before collecting a face geometry, a published retention and destruction policy, and gives individuals a private right of action with liquidated damages of $1,000 per negligent and $5,000 per intentional or reckless violation — since a 2024 amendment, counted once per person and collection method rather than per scan. Texas's CUBI requires notice and consent for commercial capture and destruction within a year of the purpose expiring, enforced by the attorney general at up to $25,000 per violation.
The FTC treats careless deployment as an unfair practice: in 2023 it banned Rite Aid from using facial recognition for surveillance for five years after the system falsely flagged customers. For onboarding, the lesson is the same — consent, purpose limits and a match that is never the only signal.
Frequently asked questions
Is facial recognition legal in the US?
Yes, but several states regulate it. Illinois requires written notice and consent before collecting biometric identifiers and lets individuals sue for violations; Texas requires notice and consent and is enforced by the attorney general; other states have their own rules. The FTC can also act against unfair use.
What is BIPA?
The Illinois Biometric Information Privacy Act. It requires private entities to give written notice and obtain a written release before collecting biometric identifiers such as face geometry, to publish a retention policy, and it allows individuals to sue for 1,000 dollars per negligent or 5,000 dollars per intentional or reckless violation.