Biometric & facial-recognition limits

A private entity collects, captures, purchases, receives through trade, otherwise obtains, stores, discloses, or profits from a retina or iris scan, fingerprint, voiceprint, or scan of hand or face geometry — or information derived from one and used to identify an individual — concerning an Illinois individual. Photographs, writing samples, written signatures, demographic data, physical descriptions, health-care-setting and HIPAA data, and Genetic Information Privacy Act materials are excluded by 740 ILCS 14/10; financial institutions subject to Title V of the Gramm-Leach-Bliley Act, Private Detective Act licensees, and State or local government contractors are excluded by 740 ILCS 14/25.

Law · In Force

Law · Pending

Controllers that conduct business in Colorado or deliver commercial products or services deliberately targeted to Colorado residents and meet the § 6-1-1304(1) thresholds; the thresholds do not apply to a controller processing any amount of biometric identifiers or biometric data.

Law · In Force

Employers using facial recognition services to create facial templates during Maryland job interviews.

Law · In Force

A legal entity that conducts business in Washington, or produces or provides products or services targeted to consumers in Washington, and that alone or jointly determines the purpose and means of collecting, processing, sharing or selling consumer health data (RCW 19.373.010(23)) — including where the health status is inferred from data that is not itself health data (RCW 19.373.010(8)(b)(xiii)). RCW 19.373.070 and RCW 19.373.080 reach any person. Government agencies, tribal nations and contracted service providers processing on behalf of a government agency are outside both definitions.

Law · In Force

Capture of a biometric identifier of an individual for a commercial purpose in Texas, or possession of one so captured. “Biometric identifier” is defined at Tex. Bus. & Com. Code § 503.001(a)(2) as a retina or iris scan, fingerprint, voiceprint, or record of hand or face geometry — a closed list that does not reach derived “biometric information” or behavioural patterns, and “commercial purpose” is undefined. Since January 1, 2026 § 503.001(e)(2) excludes developing, training, evaluating, disseminating or otherwise offering AI models or systems unless a system is used or deployed for the purpose of uniquely identifying a specific individual, and § 503.001(e)(1) and (e)(3) exclude financial-institution voiceprint data and enumerated security, fraud and abuse-investigation purposes.

Law · In Force

Applies to a person who promotes, advertises or conducts business in Texas, produces a product or service used by Texas residents, or develops or deploys an artificial intelligence system in Texas (sec. 551.002). There is no revenue, headcount, data-volume or consumer-count threshold anywhere in the Act. Three duties are narrower than the Act: sec. 552.051(b) binds a governmental agency, and secs. 552.053 and 552.054(b) bind a governmental entity as sec. 552.001(3) defines it. One is narrower the other way: sec. 552.051(f) binds the provider of a health care service or treatment.

Law · In Force

Controllers and processors conducting business in Texas or targeting Texas residents, excluding small-business and certain entity exemptions.

Law · In Force

Section 2(1): any person who processes, and any person who has control over or authorises the processing of, personal data in respect of commercial transactions. Section 2(2) additionally reaches a person established outside Malaysia who uses equipment in Malaysia for processing otherwise than for transit, who must nominate a representative established in Malaysia under s. 2(3). Section 3 excludes the Federal and State Governments; s. 45 exempts personal, family and household processing and several further classes. No revenue, headcount or record-count threshold. Registration under Division 2 of Part II applies only to classes of data controller specified by Ministerial order under s. 14(1).

Law · In Force

AI industry activities and deployments in Shanghai municipality.

Regulation · In Force

A data controller or data processor located in Thailand, whatever the location of the processing; or a controller or processor located outside Thailand that offers goods or services to data subjects in Thailand, whether or not payment is made, or that monitors their behaviour taking place in Thailand (s. 5).

Law · In Force

Processing and protection of personal data in Uzbekistan regardless of means used, including information technologies; extraterritorial application to operators processing Uzbek personal data.

Law · In Force

Processing of personal data by a person ordinarily resident or with a place of business in Bahrain, or by any person using means located in Bahrain for more than the mere transit of data.

Law · In Force

Collection, processing, transmission, storage or use of the personal data of a natural person, carried out in Chad by a natural person, by the State, by a local authority, or by a public- or private-law legal person (art. 2).

Law · In Force

Collection, processing, transmission, storage or use of personal data by a natural person, by the State, by decentralised administrative entities or by legal persons of public or private law; processing implemented by a controller on the territory of the Republic of the Congo or in any place where the law of that country applies; or processing implemented by a controller, established in Congo or not, which has recourse to means of processing situated on Congolese territory, excluding means used only for transit (art. 2).

Law · In Force

Processing of personal data by state administration or local self-government bodies, state or community institutions or organisations, or legal or natural persons, within the scope of art. 1(1).

Law · In Force

Any entity engaged in commerce in or affecting US commerce that uses AI in ways that may mislead consumers or cause substantial unjustified injury.

Law · In Force

Processing of personal data of individuals in Türkiye or by controllers established in Türkiye.

Law · In Force

Owns or licenses computerized data including private information of a New York resident.

Statute · In Force