TL;DR: The Congressional Research Service published report R48935 on May 1, documenting a straightforward problem: CBP is expanding facial recognition to every non-citizen traveler at air, land, and sea ports of entry. ICE is using it to support deportation operations. The facial recognition market is projected to hit $30.5 billion by 2034. And Congress has zero comprehensive federal laws governing how the technology is used, who gets scanned, how long data is retained, or what recourse people have when the system gets it wrong. Four bills sit in committee. None are moving.
What the CRS Found
Congressional Research Service reports aren't advocacy documents. They're dry, nonpartisan summaries written for lawmakers who need to understand something before voting on it. That makes R48935 ("Facial Recognition Technology: Definitions, Applications, and Policy Considerations for Congress") worth reading carefully [1][2].
The report maps how facial recognition has expanded across federal agencies:
- CBP operates the Traveler Verification Service (TVS) for biometric entry and exit processing at airports, seaports, and land crossings. A December 2025 DHS final rule expanded the program to cover all noncitizens entering and exiting the United States [1][2].
- ICE uses facial recognition for detention and removal operations. The agency deployed an app called Mobile Fortify, a one-to-many identification tool that scans a face with a smartphone, then sends it to CBP's TVS database for matching [1][3].
- TSA verifies traveler identities at airport security checkpoints.
- FBI runs the Next Generation Identification–Interstate Photo System, a combined criminal and civil photo database.
That's at least four agencies running parallel facial recognition programs with different policies, different retention periods, and different oversight mechanisms. Or, more accurately, with inconsistent oversight and fragmented policies [1].
Your Face, Their Timeline
The data retention numbers alone tell you how unserious the oversight is:
- U.S. citizens: CBP may retain photos for up to 12 hours [1].
- Noncitizens: CBP retains photos for up to 75 years via enrollment in the DHS Biometric Identity Management System [1].
- ICE: Retains each photograph for 15 years [1].
There's a word for a system that stores biometric data on noncitizens for 75 years with no comprehensive legal framework governing its use. Several words, actually, but "unregulated mass biometric surveillance" covers it.
The Opt-Out That Isn't
CBP technically allows travelers to request an opt-out from facial recognition at ports of entry. The CRS report notes that travelers "are included in biometric data collection efforts or use unless they explicitly request to opt out" [1].
ICE doesn't bother with the pretense. The agency is not required to provide individuals with any opportunity to opt in or opt out of biometric data collection [1]. If ICE points a phone at your face, your face goes into the system. No consent required.
In practice, CBP's opt-out is a formality. Most travelers don't know it exists. Those who do know face the implicit pressure of asking a federal officer for an exception at a border crossing. The CRS report doesn't editorialize on this, but the structural incentives are obvious.
DHS Wants One Giant Face Database
Here's where it gets worse. DHS has plans to consolidate biometric platforms across CBP, ICE, USCIS, and TSA into a single centralized matching engine [2]. Four agencies' separate databases, with different retention policies and access controls, merged into one system.
In February 2025, DHS quietly removed its internal facial recognition directive from its website [2]. The document that outlined the rules for how the department uses the technology simply disappeared. No replacement was published.
When an agency removes its own rulebook from public view while simultaneously expanding the program the rulebook governed, that's not a bureaucratic oversight. That's a choice.
The Accuracy Problem Nobody Wants to Quantify
The CRS report distinguishes between two types of facial recognition:
- One-to-one matching: Verifying that you are who you claim to be (unlocking a phone, matching a boarding pass). Lower error rates.
- One-to-many matching: Identifying an unknown person by searching a database of millions of faces. Higher error rates, higher civil liberties stakes [1].
One-to-many is what ICE uses with Mobile Fortify. It's also the type with documented higher error rates for women, older adults, and people with darker skin [1]. The NIST Face Recognition Vendor Test has shown these disparities for years. The technology keeps deploying anyway.
ICE and CBP knew their facial recognition app couldn't reliably do what DHS claimed it could, and deployed it anyway [3]. A February 2026 Techdirt investigation found internal documents showing the agencies were aware of the accuracy limitations before rollout.
A $30 Billion Industry With No Federal Rules
The global facial recognition market was valued at $10.13 billion in 2026. It's projected to reach $30.52 billion by 2034, a compound annual growth rate of 14.8% [4]. That's not speculative technology. That's a maturing industry with massive government contracts driving growth.
The companies building these systems, and the agencies buying them, are operating in a regulatory vacuum that Congress created through inaction. No comprehensive federal law governs:
- When facial recognition can be used
- Who can be scanned without consent
- How long biometric data is retained
- What accuracy standards must be met
- What recourse exists for misidentification
- Whether data can be shared between agencies or with foreign governments
Four Bills. Zero Movement.
The CRS report identifies four bills currently before Congress that address facial recognition in some form: accuracy testing requirements, general prohibitions, traveler privacy protections, and ICE surveillance restrictions [1].
The most aggressive is the ICE Out of Our Faces Act, introduced February 5, 2026 by Senators Markey, Merkley, and Wyden, along with Representative Jayapal. It would ban ICE and CBP from acquiring or using facial recognition and other biometric identification systems entirely. The bill would also require deletion of all previously collected biometric data [5][6].
The bill is endorsed by EFF, EPIC, ACLU, Fight for the Future, Access Now, and Human Rights First [5]. It has co-sponsors including Senators Alsobrooks and Sanders.
It's sitting in committee. Like every other facial recognition bill introduced in the last five years.
Meanwhile, ICE and CBP agents have scanned public faces and compared them against a database of 1.2 billion images, often without the subject's knowledge or consent [5].
What This Means
The CRS report isn't an exposé. It's a status update. And the status is: the federal government is deploying facial recognition technology at scale, across multiple agencies, with plans to consolidate everything into one system, while operating under a patchwork of internal directives that can be (and have been) deleted without notice.
The people being scanned have no meaningful consent mechanism. The data is stored for decades. The technology has documented bias. And the industry selling it is growing at nearly 15% annually.
Congress has the information. The CRS wrote them a report. Four bills exist. The question isn't whether lawmakers understand the problem. It's whether they'll act before the surveillance infrastructure becomes too entrenched to dismantle.
Based on the last five years of inaction, don't hold your breath.
Sources
- Congressional Research Service: Facial Recognition Technology: Definitions, Applications, and Policy Considerations for Congress (R48935)
- Legis1: Federal Facial Recognition Expands Without Legal Framework
- Techdirt: ICE, CBP Knew Facial Recognition App Couldn't Do What DHS Says It Could, Deployed It Anyway
- Fortune Business Insights: Facial Recognition Market Size, Share & Growth Report 2034
- Senator Markey: ICE Out of Our Faces Act Press Release
- EPIC: Endorses New Bill to Ban ICE and CBP from Using Facial Recognition Technology