What the Spread of Facial Recognition Means for Everyday Privacy

Since October 1, 2026, Connecticut businesses covered by the state's data privacy law that use facial recognition for security must post a sign at each public entrance, with a link or QR code to their facial recognition policy, under Public Act 26-64. Shoppers there will at least see a sign when their faces are being matched; in most states, no law requires a sign at the door. Your protection depends on whether you are at an airport, which state you are in, and whether you opted in.

Key takeaways

At TSA checkpoints the face photo is optional for every traveler, and TSA says declining costs no time or place in line.
US citizens can opt out of CBP's face photos at entry and departure. Under a rule in effect since December 26, 2025, noncitizens, including green card holders, may be required to be photographed.
Illinois has the strongest state law for stores and venues: written consent first, no security exemption, and a right to sue for $1,000 to $5,000 per violation. Texas, Colorado and Washington exempt many security and anti-fraud uses from their consent rules.
False matches are the main everyday risk; NIST found false positive rates 10 to 100 times higher for some groups in many algorithms.
Clearview AI's 2025 class settlement was vacated on appeal in July 2026, so no settlement is in force; the case is back before the trial court.

What it means for you

Flying within the US: you can ask the TSA officer for a standard ID check instead of the photo.
Flying abroad: US citizens can ask the airline agent or CBP officer for a manual check. Noncitizens generally cannot opt out.
Shopping: signs are required in Connecticut and New York City; Portland, Oregon, and Erie County, New York, ban stores' use. Elsewhere, there may be no notice at all.
Concerts and games: face-entry lanes are opt-in, but guests walking through with an enrolled fan are scanned too; watchlist use may be undisclosed.
Living in Illinois, Texas, Colorado, Washington, California or Connecticut: you have specific consent, deletion or notice rights, compared in the state table. Outside Illinois, store security systems are often exempt from consent.
If your photos are public online: face search engines may have indexed them; opt-out steps are at the end.
Renters in buildings with face entry: in Illinois, a landlord's system falls under the state's written-consent rule. Elsewhere, ask management for a fob or code instead.

Airports: when you can say no

Two federal agencies scan faces at airports. TSA does one-to-one matching, comparing a live photo with your ID photo. CBP matches you against a gallery of photos of travelers expected on your flight.

Where	Who runs it	Can you decline?	What happens to the photo
TSA checkpoint (CAT-2 scanner)	TSA	Yes, any traveler	Not stored after a positive match, except in limited testing
TSA PreCheck Touchless ID	TSA with airlines	It is opt-in	Uses the passport details you upload to your airline profile
International boarding and arrival	CBP	US citizens yes; noncitizens generally no	US citizens: deleted within 12 hours. Others: up to 14 days in CBP's cloud; some records kept up to 75 years

According to TSA's facial comparison fact sheet, CAT-2 units are deployed at approximately 350 airports. Travelers can decline the photo "without recourse" and get a manual check, and TSA says the technology is not used for surveillance or law enforcement. Signs at the podium should say the photo is optional. Touchless ID requires current PreCheck status and a participating airline.

Congress has not made the TSA opt-out law. The Traveler Privacy Protection Act of 2025 (S. 1691) would make the TSA photo opt-in for most travelers, with affirmative consent before each use; PreCheck and other trusted-traveler members would get an opt-out instead. It was referred to the Senate Commerce Committee on May 8, 2025, with no later action listed as of October 2026, so the right to decline remains TSA policy, not statute.

At international gates, CBP's final rule published October 27, 2025 took effect December 26, 2025. It lets DHS require all noncitizens to be photographed at entry and exit, including those under 14 and over 79 who used to be exempt. It also removes the pilot-program and port limits, so capture can extend to land ports and seaports. US citizens may still opt out by telling the airline or vessel boarding agent or a CBP officer, who then checks the passport manually; the retention figures in the table come from the same rule.

Stores, stadiums and buildings

Retail face recognition usually means one-to-many matching: cameras compare every shopper against a list of people the store has flagged. The FTC banned Rite Aid from using facial recognition for surveillance for five years on December 19, 2023. The agency said the system, used in hundreds of stores from 2012 to 2020, produced thousands of false matches that led employees to follow, search or publicly accuse customers, disproportionately people of color.

No federal law requires stores to disclose face scanning, though the FTC's May 18, 2023 biometric policy statement warns that covert or unexpected collection may be an unfair practice. Local rules fill some gaps:

Connecticut: covered businesses using face recognition for security must match only against their own database and post entrance signs linking to their policy.
New York City: since July 9, 2021, Local Law 3 has required covered businesses that collect biometric identifiers to post a notice at customer entrances, and it bans selling that data.
Portland, Oregon: City Code chapter 34.10 bars private entities from using face recognition in places of public accommodation. Injured people can sue for the greater of $1,000 per day of violation or actual damages.
Erie County, New York: a law signed May 26, 2026 bars commercial establishments from collecting, storing or selling customer biometric data.

Arenas and ballparks

MLB's opt-in Go-Ahead Entry lanes let fans 18 or older enroll a selfie in the MLB Ballpark app. MLB's FAQ notes that everyone in an enrolled fan's group is scanned in the lane, so guests who object need their tickets forwarded to use a standard gate. Watchlists are different: in January 2023, New York's attorney general questioned MSG Entertainment over reports that it used facial recognition to deny entry to lawyers whose firms were suing the company.

Face-entry apartment buildings

None of the state laws reviewed here targets residential face entry specifically. Illinois' law covers any "private entity," landlords included, so written consent is required there. Elsewhere, ask in writing for a non-biometric option, how long face templates are kept, and whether the vendor can reuse them.

Your rights depend on your state

State laws decide whether a business needs your consent and whether you can make it delete your face data. The main rules as of October 2026:

State	Core rule	Who enforces
Illinois (BIPA)	Written notice and a signed release before collection; destroy data when the purpose ends or within 3 years of last interaction; no selling	You can sue: $1,000 (negligent) or $5,000 (intentional or reckless) per violation, or actual damages if higher
Texas (CUBI)	Inform and get consent before capture for a commercial purpose; no selling, with narrow exceptions; destroy within a year after the purpose ends. Since January 1, 2026, does not apply to AI systems deployed against security incidents, fraud or illegal activity	Attorney general only, up to $25,000 per violation
Colorado (HB24-1130)	Since July 1, 2025, for any business holding biometric data: notice and consent before collecting, no selling, deletion no later than 24 months after your last interaction, and, from larger businesses, disclosure of what was collected	Attorney general and district attorneys; no private lawsuits
Washington (My Health My Data)	Biometric data counts as consumer health data, so it needs consent (unless necessary for a service you asked for) and you can demand deletion	Attorney general and private lawsuits
California (CCPA)	For larger for-profit businesses (annual gross revenue of $26.625 million or more, as adjusted from January 1, 2025; or buying, selling or sharing data of 100,000+ California residents or households; or half of revenue from selling or sharing such data): biometric data used to identify you is "sensitive personal information"; you can limit its use and request deletion, and businesses must reply within 45 days	Attorney general and the California Privacy Protection Agency; private suits only for certain data breaches
Connecticut	Signs and own-database matching for security uses, from October 1, 2026	Attorney general

The consent rules have a large gap for shoppers. Outside Illinois, each of these laws exempts uses meant to prevent or respond to security incidents, fraud or illegal activity: Texas in §503.001(e), Colorado through the existing exceptions of its privacy act that HB24-1130 keeps, and Washington in RCW 19.373.100, where the business must show the exemption applies. A store's anti-theft watchlist may therefore run without your consent. Connecticut's new sign and own-database rule is the condition attached to that same kind of exemption.

Two recent changes matter. In Illinois, a 2024 amendment effective August 2, 2024 made repeated scans of the same person by the same method a single violation with one recovery, instead of one per scan. In Texas, an amendment effective January 1, 2026 says a photo of you being online does not by itself count as notice or consent, unless you made that image public yourself.

The Texas attorney general announced a $1.4 billion settlement with Meta on July 30, 2024 over facial recognition in photo tagging. On May 9, 2025, it announced a $1.375 billion settlement in principle with Google covering location, incognito search and biometric claims. Meta pays the state over five years; both were state enforcement actions, not class actions that pay individual Texans.

If your photos are online

Clearview AI built its database by scraping public photos. A 2022 settlement with the ACLU permanently bars it from selling database access to most private businesses nationwide. A separate class settlement offering a 23% equity stake was approved in March 2025, but the Seventh Circuit vacated that approval on July 13, 2026 because no separate representative spoke for the nationwide class, whose members got the smallest share, and sent the case back to the trial court.

Why false matches are the risk

A false match is when the system decides two different people are the same person. In one-to-one checks like TSA's, an officer is standing there. In one-to-many searches, every face that walks in is compared with every face on a list, so the chances add up.

NIST's 2019 demographic study tested 189 algorithms from 99 developers. In one-to-one matching, false positives for Asian and African American faces were often 10 to 100 times higher than for white faces, depending on the algorithm. In one-to-many searches, false positives were higher for African American women. Results varied widely by algorithm, and NIST's current demographics page says such gaps can come from a group being underrepresented in training images.

Chance of a false alert per visit = 1 − (1 − f)^N  ≈  N × f
f = false match rate for one comparison
N = number of faces on the watchlist

Illustrative example: a store has 1,000 faces on its watchlist and an algorithm with a false match rate of 1 in 1,000,000 per comparison. Each visit carries about a 0.1% chance of a false alert, which works out to about 5 false alerts a day across 5,000 shoppers. If that rate is 10 times worse for one group (the low end of the range NIST found in one-to-one tests), the chance per visit rises to about 1%. For a weekly shopper, the chance of at least one false alert in a year goes from about 5% to about 41%. Real systems tune thresholds and add human review, so these numbers show the scaling, not any store's actual rate.

Frequently asked questions

Is unlocking my phone with my face the same thing?

Not in the way that matters for privacy. Apple says Face ID data is encrypted, stays on the device and is never backed up to iCloud or made available to apps or to Apple. It is a one-to-one check against a template you created, not a search against other people's faces.

Does a "facial recognition in use" sign mean I agreed?

Not under every law. Illinois requires a written release signed by the person before collection, so a sign at the door is not enough there. Connecticut's and New York City's signs are notice rules, not consent forms, and in Texas, Colorado and Washington a security system may not need your consent at all.

Can a neighbor's doorbell camera recognize me?

It can if the owner turns the feature on. Ring's Familiar Faces adds faces its camera detects to the owner's library so they can be named in alerts; unnamed profiles are deleted after 30 days without a match. Ring says the feature is not available in Illinois, Texas or Portland, Oregon, because of local laws, and it tells owners that some laws require visitors' explicit consent.

Are children photographed at airport checkpoints?

TSA's fact sheet says travelers under 18 are not photographed at its checkpoints. CBP's rule works differently for noncitizens: since December 26, 2025, children under 14 who were previously exempt may be photographed at entry and exit.

Can police search my face in Clearview AI?

Possibly. The Seventh Circuit noted in its July 2026 opinion that, since the 2022 ACLU settlement, Clearview's customers have included only federal and state government agencies and their contractors. That settlement permanently bars access for most private businesses nationwide and, for five years, for any state or local government agency or private entity in Illinois, police included.

How to limit your face data

At TSA: before stepping up to the camera, tell the officer you want a standard ID check.
At international gates: if you are a US citizen, tell the boarding agent or CBP officer you are opting out of the photo and show your passport.
Opt-in programs (Touchless ID, ballpark lanes): skip enrollment you do not need, or check the app's privacy settings to withdraw.
In stores: in Connecticut, scan the entrance sign's QR code to read the policy and the attorney general's contact details.
Send a deletion request if you live in California, Colorado, Connecticut, Washington or another state with a comprehensive consumer privacy law. Exceptions apply, including for security and fraud prevention. Californians can also ask a business to limit use of sensitive personal information.
Clearview AI: use the privacy request page. As of October 2026, it offers forms only to residents of 13 states: California, Colorado, Connecticut, Delaware, Illinois, Iowa, Kentucky, Minnesota, Montana, Nebraska, New Hampshire, Utah and Virginia.
PimEyes: its opt-out form asks for a clear face photo and an ID scan with personal details blacked out. It blocks your results in PimEyes searches but does not remove photos from the sites where they were posted.

This is general information, not legal advice; for a dispute with a business, your state attorney general's consumer protection office is the usual first contact. In Washington, the attorney general's My Health My Data page explains how the deletion right works.