Biometric & facial-recognition limits

A private entity collects, captures, purchases, receives through trade, otherwise obtains, stores, discloses, or profits from a retina or iris scan, fingerprint, voiceprint, or scan of hand or face geometry — or information derived from one and used to identify an individual — concerning an Illinois individual. Photographs, writing samples, written signatures, demographic data, physical descriptions, health-care-setting and HIPAA data, and Genetic Information Privacy Act materials are excluded by 740 ILCS 14/10; financial institutions subject to Title V of the Gramm-Leach-Bliley Act, Private Detective Act licensees, and State or local government contractors are excluded by 740 ILCS 14/25.

Law · In Force

Employers using facial recognition services to create facial templates during Maryland job interviews.

Law · In Force

Capture of a biometric identifier of an individual for a commercial purpose in Texas, or possession of one so captured. “Biometric identifier” is defined at Tex. Bus. & Com. Code § 503.001(a)(2) as a retina or iris scan, fingerprint, voiceprint, or record of hand or face geometry — a closed list that does not reach derived “biometric information” or behavioural patterns, and “commercial purpose” is undefined. Since January 1, 2026 § 503.001(e)(2) excludes developing, training, evaluating, disseminating or otherwise offering AI models or systems unless a system is used or deployed for the purpose of uniquely identifying a specific individual, and § 503.001(e)(1) and (e)(3) exclude financial-institution voiceprint data and enumerated security, fraud and abuse-investigation purposes.

Law · In Force

AI industry activities and deployments in Shanghai municipality.

Regulation · In Force

Processing and protection of personal data in Uzbekistan regardless of means used, including information technologies; extraterritorial application to operators processing Uzbek personal data.

Law · In Force

Any entity engaged in commerce in or affecting US commerce that uses AI in ways that may mislead consumers or cause substantial unjustified injury.

Law · In Force

Owns or licenses computerized data including private information of a New York resident.

Statute · In Force