Biometrics, facial or emotion recognition
Identifying or verifying people by physical or behavioral traits, biometric categorization and emotion recognition. It is the most restricted use: bans in the EU and Peru, written consent in several US states and sensitive data across Latin America.
Examples
- Facial recognition for access control
- Selfie identity verification (KYC)
- In-store customer emotion detection
- Voiceprint authentication
By country
We only list countries where an obligation in force or adopted mentions this use case.
How rules treat it, by jurisdiction
| Jurisdiction | Level | Date | Note |
|---|---|---|---|
| European Union | Prohibited practice | February 2, 2025 | Banned: untargeted facial scraping, categorization by sensitive traits, emotion recognition at work and in education, and real-time remote identification by law enforcement except in narrow cases. |
| European Union | High risk | December 2, 2027 | Remote biometric identification and emotion recognition outside banned settings (Annex III(1)); one-to-one verification is excluded. |
| European Union | Transparency | August 2, 2026 | Inform people exposed to emotion recognition or biometric categorization (Art. 50(3)). |
| Spain | Data protection | — | Biometric data used for identification is a special category (GDPR Art. 9); the AEPD requires an impact assessment and is very restrictive. |
| Peru | Prohibited practice | January 22, 2026 | Misuse: mass surveillance without legal basis, inference of sensitive data and real-time remote biometric identification in public spaces. |
| Ecuador | Data protection | — | Sensitive data: impact assessment required for large-scale processing (Data Protection Law Art. 42). |
| Colombia | Data protection | — | Sensitive data: explicit, optional authorization. |
| Mexico | Data protection | — | Sensitive data: express written consent. |
| Chile | Data protection | December 1, 2026 | Law 21,719: biometric data is sensitive. |
| Argentina | Data protection | — | Sensitive data under Law 25,326 and AAIP criteria. |
| Brazil | Data protection | — | Sensitive data under the LGPD; bill PL 2338 would treat emotion recognition at work and in education as excessive risk. |
| United States (federal) | Sector rules | — | The FTC's Rite Aid order (2023) sets testing, oversight and prior assessment for facial recognition. |
| Illinois | Data protection | — | BIPA: public retention policy, written consent and ban on sale; private right of action. |
| Texas | Data protection | — | CUBI: consent to capture biometric identifiers; TRAIGA (2026) clarifies its application to AI. |
| Colorado | Data protection | July 1, 2025 | The Colorado Privacy Act expanded biometric data duties, including for employees. |
| Washington | Data protection | — | Biometric identifiers law and the My Health My Data Act. |
| New York (incl. NYC) | Data protection | — | NYC requires signage in businesses that collect biometric data and bans selling it. |
Common base documents
- Prohibited AI Practices Checklist
Checklist · USD 19 · Available to buy
- Data Protection Impact Assessment (DPIA) for AI
Assessment template · USD 59 · Available to buy
- Algorithmic Impact Assessment (AIA)
Assessment template · USD 59 · Available to buy
- AI Security Baseline
Standard · USD 39 · Available to buy
- Human Oversight Procedure for AI Systems
Procedure · USD 39 · Available to buy
Depending on your situation
- If applied to customers or the public
- If applied to workers
- If the system comes from a vendor