Biometrics, facial or emotion recognition in United States (federal): related rules

Identifying or verifying people by physical or behavioral traits, biometric categorization and emotion recognition. It is the most restricted use: bans in the EU and Peru, written consent in several US states and sensitive data across Latin America.

Risk classification

Jurisdiction	Level	Date	Note
United States (federal)	Sector rules	—	The FTC's Rite Aid order (2023) sets testing, oversight and prior assessment for facial recognition.
Illinois	Data protection	—	BIPA: public retention policy, written consent and ban on sale; private right of action.
Texas	Data protection	—	CUBI: consent to capture biometric identifiers; TRAIGA (2026) clarifies its application to AI.
Colorado	Data protection	July 1, 2025	The Colorado Privacy Act expanded biometric data duties, including for employees.
Washington	Data protection	—	Biometric identifiers law and the My Health My Data Act.
New York (incl. NYC)	Data protection	—	NYC requires signage in businesses that collect biometric data and bans selling it.

Obligations related to this use case

Risk assessment before using ADMT or other high-risk processing

CCPA ADMT and risk assessments11 CCR §§ 7150, 7151, 7152, 7155In force

Applies from January 1, 2026

When it relates: Applies to CCPA-covered businesses (revenue threshold, 100,000 residents or 50% of revenue from selling data) that use ADMT for significant decisions, infer traits of employees, applicants or students through systematic observation, process sensitive data, or train ADMT or facial recognition. Training models on your own data is not enough by itself. For processing that began before 2026 the deadline is December 31, 2027.
What the rule provides: Conduct and document the assessment before starting the processing.
Describe the specific purpose, data, concrete benefits, negative impacts and safeguards; involve the staff who take part.
Have it approved by a person with authority over the processing.
Review it at least every three years and update it within 45 days of a material change.
Keep it while the processing continues or for five years after completion, whichever is later.
For processing that already existed before January 1, 2026, the deadline is December 31, 2027.
Typical evidence: Signed, versioned risk assessment
List of contributors and approver
Related base documents: Data Protection Impact Assessment (DPIA) for AI
Supporting documents: Algorithmic Impact Assessment (AIA)
AI System Inventory
AI Document Control and Versioning Procedure
Verification: Verified in the official source on November 2, 2026Checked against the approved text published by CalPrivacy (§§ 7150 and 7155).

Submit assessment information to the agency with a signed attestation

CCPA ADMT and risk assessments11 CCR § 7157Adopted, applies later

Applies from April 1, 2028

When it relates: Applies to businesses that conducted risk assessments in 2026 or 2027.
What the rule provides: Submit the required information on 2026 and 2027 assessments by April 1, 2028, and every April 1 after that.
Include an attestation signed by an executive under penalty of perjury.
Provide the full assessment within 30 days if the agency or Attorney General requests it.
Typical evidence: Submitted form and confirmation
Signed attestation
Related base documents: Impact Assessment Summary Register
Supporting documents: Data Protection Impact Assessment (DPIA) for AI
AI Governance Executive Dashboard
Verification: Verified in the official source on November 2, 2026Checked against the approved text (§ 7157(a)(1)).

Public biometric retention and destruction policy

Illinois BIPA740 ILCS 14/15(a), (e)In force

Already applicable

When it relates: Applies to anyone holding biometric data of people in Illinois.
What the rule provides: Publish a policy with retention and destruction schedules.
Destroy the data when the purpose is fulfilled or three years after the last interaction, whichever comes first.
Protect them at least as well as other confidential data.
Typical evidence: Published policy and destruction records
Related base documents: Public Biometric Data Retention and Destruction Policy
Supporting documents: Data Governance Guidelines for AI
AI Security Baseline
Verification: Pending confirmation in the official source (last checked: November 4, 2026)ilga.gov refused the connection on Nov 4, 2026, so the official text is still unchecked. The public policy, the three-year limit and the standard of care still have to be confirmed in 740 ILCS 14/15(a) and (e); content based on general knowledge of the law.