The world has split into three camps on facial recognition: those who ban it, those who embrace it, and those still writing the rules. The EU prohibits real-time biometric surveillance. China requires consent (and ignores it for "national security"). The US is a patchwork of state laws. The UK has no law at all. Most of the world has nothing.
Your privacy depends on your passport. Here's how every major region handles the technology that can identify you in a crowd.
The Global Landscape at a Glance
1
Region with comprehensive ban (EU)
15
US states with some restrictions
0
UK laws governing police use
49
African countries with at least one biometric system
The Three Camps
The Banners
European Union, Real-time ban since February 2025
US Cities, San Francisco, Boston, Portland, others
US States, Montana, Utah (warrant required)
The Builders
China, 1.4 billion faces in database
UK, Expanding to 43 police forces
Russia, Moscow's 200,000 cameras
The Waiters
Canada, No federal AI law (Bill C-27 died)
Australia, 1988 Privacy Act for 2025 tech
Most of Africa/Latin America, Using it without rules
Region by Region
European Union: The Gold Standard
The EU AI Act, effective February 2, 2025, prohibits real-time facial recognition in public spaces with narrow exceptions. [1]
What's Banned
- Real-time biometric identification in public spaces
- Scraping faces from internet/CCTV to build databases
- Biometric categorization by race, religion, politics, sexuality
- Emotion recognition in workplaces and schools
Exceptions
- Searching for victims of trafficking or abduction
- Preventing imminent terrorist attacks
- Locating serious crime suspects (requires judicial authorization)
Penalties
€35 million or 7% of global revenue, whichever is higher.
Enforcement Reality
Clearview AI owes €100+ million in European fines. They've paid nothing. Criminal charges were filed in October 2025. [2]
Verdict: Strongest law on paper. Enforcement against foreign companies remains difficult.
United Kingdom: No Law, No Limits
The UK has no legislation governing police facial recognition. Zero. Police have scanned 7+ million faces in 2025 under guidance documents and common law interpretations. [3]
Current State
- No specific facial recognition law
- Court ruled police use "unlawful" in 2020 (Bridges v South Wales Police)
- Police continued anyway
- Government consultation launched December 2025 to expand access
What's Coming
All 43 police forces getting access. National face database using passport/driving license photos. Emotion detection, gait recognition, voice analysis under consideration.
Oversight
Multiple bodies (ICO, Biometrics Commissioner, Surveillance Camera Commissioner). None have stopped expansion.
Verdict: Post-Brexit Britain chose surveillance over the EU model. No restrictions, no consent, no vote.
United States: State-by-State Chaos
No federal facial recognition law exists. 15 states have some restrictions. 16+ cities have bans. [4]
Strongest Protections
- Montana & Utah: Warrant required before use
- Colorado, Maryland, Maine, Virginia, Washington, Montana, Alabama: "Sole basis" prohibition (can't arrest based only on facial recognition)
- Illinois BIPA: Commercial use requires consent; produced $650M Facebook settlement, $1.4B Google/Meta Texas settlements
City Bans
- San Francisco (2019), First US city to ban
- Boston, Oakland, Portland, Pittsburgh, Santa Cruz
Problems
- Police in ban cities asked other agencies to run searches [5]
- Some bans reversed (New Orleans, Virginia partial)
- 100% of known wrongful arrests were Black individuals
Verdict: Protection depends on zip code. Illinois residents have billion-dollar settlements. Most Americans have nothing.
China: Surveillance State with Rules
China operates the world's largest facial recognition network. It also issued regulations in March 2025. [6]
The Rules (Effective June 2025)
- Consent required for commercial facial recognition
- Banned in hotel rooms, bathrooms, changing rooms
- Mandatory encryption of biometric data
- Personal information protection impact assessments required
- Organizations must justify "necessity" of use
The Reality
- Government claims 1.4 billion faces searchable "in seconds"
- Extensive exceptions for "national security and public safety"
- Social credit scoring continues
- Minority surveillance in Xinjiang documented
Verdict: Commercial rules exist on paper. State surveillance remains unlimited. American companies provide the technology.
Canada: Regulatory Limbo
Canada has no federal AI legislation. Bill C-27 (which included the Artificial Intelligence and Data Act) died when Parliament dissolved in January 2025. [7]
What Exists
- Federal Privacy Commissioner found Clearview AI violated PIPEDA (2021)
- Provincial authorities (BC, Alberta, Quebec) issued binding orders
- Courts upheld BC's order against Clearview in December 2024
What's Missing
- Federal enforcement powers (Privacy Commissioner cannot issue fines under PIPEDA)
- National AI legislation
- Consistent provincial approach
2025 Complications
Alberta court found sections of provincial privacy law unconstitutional in May 2025, potentially legitimizing data scraping. [7]
Verdict: Provincial authorities fight, federal government does nothing, courts send mixed signals.
Australia: 1988 Law for 2025 Tech
Australia's Privacy Act dates to 1988. Maximum penalty if enforced: AUD$2.22 million. Couch cushion money for tech giants. [8]
Current State
- No facial recognition-specific legislation
- Found Clearview AI violated privacy in 2021, no fine issued
- Working on national frameworks
- Relies on outdated sectoral laws
State-Level
- Victoria Police use facial recognition
- Queensland trialed it for COVID compliance
- Limited oversight or reporting requirements
Verdict: Reviewing, considering, drafting guidance, while police deploy the technology.
Japan: Light Touch, Heavy Use
Japan takes a voluntary, industry-led approach. [9]
Legal Framework
- Personal Information Protection Code recognizes facial features as biometric data
- Requires consent in theory
- Practice: cameras in large areas where consent is impossible
- Police access to data with no specific requirements
Approach
Light-touch, voluntary AI governance to encourage innovation. No specific facial recognition restrictions.
Verdict: Consent required on paper, ignored in practice. Industry self-regulation.
South Korea: Comprehensive Law Coming
South Korea became the second jurisdiction after the EU to pass comprehensive AI legislation. [9]
AI Basic Act
- Passed 2025, effective January 2026
- One-year preparation period
- Details still emerging
Current Protections
- Personal Information Protection Act (PIPA) requires consent
- Privacy watchdog warned against public facial recognition deployments
Verdict: Waiting to see how the new law is implemented. Currently relies on PIPA.
India: No Rules, Heavy Use
State police forces across India deploy facial recognition with private companies. No national framework exists. [10]
Reality
- Extensive police deployments
- Private company partnerships
- Predictive policing tools in use
- No specific facial recognition legislation
What's Coming
India is building foundations for national frameworks but currently relies on fragmented sectoral and privacy laws.
Verdict: Technology deployed first, rules (maybe) later.
Latin America: Widespread Use, Weak Rules
Most Latin American countries have data protection laws. Most also have active facial recognition without adequate safeguards. [11]
Brazil
- No general facial recognition law
- Widespread police use
- 2019 report: 90% of people arrested via facial recognition (non-violent crimes) were Black
- Civil society campaign #SaiDaMinhaCara ("Get Off My Face") pushing for bans
- AI bill (No. 2338/2023) under debate
Argentina
- Buenos Aires approved facial recognition law October 2020
- Already using invasive systems since 2019 (before law passed)
Regional Pattern
Countries recognize biometric data as sensitive. They deploy facial recognition anyway. Transparency minimal. Racial bias documented.
Verdict: Laws on paper, surveillance in practice. Brazilian civil society most organized in pushing back.
Africa: 49 Countries, Minimal Regulation
Forty-nine African countries have at least one biometric system. Foreign technology firms dominate the ecosystem. [12]
Kenya
- Huduma Namba national ID includes facial data
- High Court halted rollout in 2021, required data impact assessment
- 2024 report found state surveillance "breaches citizens' right to privacy"
South Africa
- Facial recognition piloted for social grants, banking
- Booming private security industry uses CCTV, license plate recognition, data-sharing
- Limited regulatory oversight
- Studies show high error rates identifying people of colour
Uganda
- Reports of using facial recognition to track opposition politicians
- Minimal transparency
Regional Challenges
- Chinese state entities and foreign companies dominate infrastructure
- Most countries lack specific biometric regulation
- Data breaches common
- Low digital literacy
- Technology prone to "function creep" into political surveillance
Verdict: Infrastructure built, regulations absent, potential for misuse high.
The Global Pattern
| Regulation Approach | Regions/Countries | Effect |
|---|---|---|
| Comprehensive ban | EU, US cities (San Francisco, etc.) | Technology restricted or disabled |
| Partial restrictions | US states, Canada provinces | Some protections, inconsistent |
| Rules on paper only | China, Brazil, much of Latin America | Laws exist, enforcement absent |
| No specific law | UK, India, most of Africa, Australia | Technology deployed without limits |
| Building frameworks | South Korea, Canada federal, Australia | Waiting while cameras multiply |
The Racial Bias Problem Is Global
Facial recognition fails differently across races. This is documented worldwide:
- USA: 100% of known wrongful arrests were Black individuals
- UK: 80% of Met Police wrongful flags targeted Black people
- Brazil: 90% of facial recognition arrests (non-violent crimes) were Black people
- South Africa: Studies show "high error rate in accurately identifying people of colour"
The technology works worse on darker skin. Deploying it without bias testing exports discrimination at scale.
Who's Actually Paying Fines?
Enforcement remains the weak point globally:
| Company | Region | Fine | Paid? |
|---|---|---|---|
| Clearview AI | EU (multiple) | €100M+ | No |
| Clearview AI | UK | £7.5M | Appealing |
| Meta/Facebook | Illinois (BIPA) | $650M | Yes |
| Texas (CUBI) | $1.375B | Yes | |
| Meta | Texas (CUBI) | $1.4B | Yes |
Pattern: Companies pay when they have assets to seize (Illinois, Texas). Foreign companies with no local presence ignore fines (Clearview vs. EU).
What Actually Works
Laws That Produce Results
- Private right of action: Individuals can sue (Illinois BIPA)
- Statutory damages: Set amounts per violation, not just actual damages
- Assets in jurisdiction: Companies must have something to seize
- Clear prohibitions: Not just guidance or recommendations
Laws That Don't
- Guidance documents: UK's "Authorised Professional Practice"
- No enforcement mechanism: Canada's federal Privacy Commissioner
- Fines against foreign companies: EU vs. Clearview AI
- Self-regulation: Japan's voluntary approach
What You Can Do
Know Your Local Law
Protection varies by location. Find out what actually applies where you live.
Support Organizations
• noyb (Europe)
• EFF (US)
• Big Brother Watch (UK)
• Privacy International (Global)
Physical Countermeasures
Masks, sunglasses, hats. Physical coverage remains the most reliable protection regardless of jurisdiction.
Political Pressure
Laws change when voters demand it. The EU ban exists because citizens organized. Contact legislators.
The Bottom Line
The world hasn't agreed on facial recognition. The EU banned it. The UK expands it. The US fights state by state. China has rules it selectively enforces. Most of the world has nothing.
Your privacy depends on where you stand. A tourist in Paris has EU protections. Walk to London, those protections disappear. Fly to Illinois, billion-dollar settlements protect you. Land in neighboring Indiana, you're on your own.
The technology is the same everywhere. The laws aren't. That's the fight.
References
- EU AI Act - Article 5: Prohibited AI Practices
- The Register - Clearview AI faces criminal heat for ignoring EU data fines
- Big Brother Watch - UK Government's plan to "ramp up facial recognition"
- TechPolicy.Press - Status of State Laws on Facial Recognition Surveillance
- Washington Post - Police in Austin, San Francisco skirt facial recognition ban
- China Briefing - China's Facial Recognition Regulations 2025
- Slaw - In the Absence of Federal AI Laws, Privacy Regulators Lead the Way
- GT Law - Facial Recognition and AI in Australia
- Xenoss - APAC AI regulations 2025
- Air University - Emerging Laws and Norms for AI Facial Recognition
- Chatham House - Regulating facial recognition in Latin America
- ISS Africa - Future of facial recognition technology in Africa
- Privacy International - Challenge against Clearview AI in Europe