Last updated: November 13, 2026. What changed: Added the Sigwalt v. Amazon class action over Ring's Familiar Faces and Amazon's motion to dismiss it, Amazon's April 2026 UK launch of the feature, the AI Omnibus that entered into force on July 27, 2026 and did not list the Article 5 biometric ban among its changes, and the biometric bills Democrats reintroduced after the November 3 elections.
TL;DR: February 2nd, 2025: EU's AI Act bans facial recognition in public spaces.[1] Violators face €35 million fines.[1][2] Meanwhile, Amazon launches Ring face scanning in December across America (except Illinois/Texas).[4] UK installs permanent face cameras in Croydon. China scans 1.4 billion faces "in seconds."[10] Canada and Australia? Still writing the rules while the tech runs wild.
Update (November 13, 2026)
What changed: Amazon's doorbell face scanning is now in court, the European Union rewrote its AI Act and left the Article 5 biometric ban off its list of changes, and Washington finally has biometric bills with sponsors.
On June 1, 2026, Virginia resident Charles Sigwalt sued Amazon and Ring in the Western District of Washington over the Familiar Faces feature.[11] A first amended complaint followed on June 8.[11] Amazon and Ring have moved to dismiss the case, and Judge Kymberly Evanson has not ruled yet.[11] The plaintiffs' opposition is due October 30 and Amazon's reply is due by November 30.[11] Amazon's motion argues that the plaintiffs have not plausibly alleged that the company collected their biometric data.[11] It also attacks the broader premise of the suit: that consumer-protection and other state laws can create private biometric privacy claims that lawmakers in Washington, Virginia, and California have not authorized.[11] Ring's own defense is geographic, pointing out that Familiar Faces is unavailable in Illinois, Texas, and Portland because of legislation in those three places.[11] The plaintiffs are not leaning on Illinois's Biometric Information Privacy Act, which carries a private right of action, and are instead pleading intrusion upon seclusion, negligence, and unjust enrichment.[11] That echoes a 2022 case from the same federal district, where a judge let a similar biometric claim survive dismissal.[11]
Amazon also shipped the feature into Britain. On April 16, 2026 the company began rolling out Familiar Faces to Ring 2K, 4K, and select HD device owners in the UK.[12] It is off by default and limited to UK Pro and Pro Intelligence subscribers.[12] Users build a directory of up to 50 named face profiles, unnamed faces are deleted after 30 days, and Amazon says face data is encrypted and never shared with anyone else.[12] The country that bolted permanent face cameras to street furniture in Croydon is now the one carrying Amazon's doorbell face scanning.
Europe did not budge. The AI Omnibus entered into force across the EU on July 27, 2026.[13] It pushed high-risk obligations under Annex III out to December 2, 2027, and high-risk AI embedded in physical products out to August 2, 2028.[13] It also added a prohibition on AI systems producing non-consensual sexually explicit and intimate content or child sexual abuse material.[13] The Omnibus changed deadlines and added a ban on nudification apps, but the Article 5 prohibition on real-time remote biometric identification in publicly accessible spaces is not on its list of changes.[13] That prohibition still comes into force on February 2, 2025.[2]
Washington, meanwhile, finally has a biometric bill with a roster of sponsors. After the November 3 elections gave Democrats the House and Senate, Senator Ed Markey, Senator Jeff Merkley, and Representatives Pramila Jayapal, Rashida Tlaib, and Ayanna Pressley reintroduced the Facial Recognition and Biometric Technology Moratorium Act in September, which would bar federal use of facial recognition and other biometric surveillance without congressional authorization.[14] The identity vendor ID.me is now in the crosshairs too. Treasury decided on October 28 to require ID.me for TreasuryDirect. On October 29, Senator Ron Wyden and Senator Elizabeth Warren wrote to Treasury and the IRS to ask how the government relies on the private identity provider. Wyden and Warren asked whether the private identity provider could retain biometric information or conduct one-to-many facial matching.[14] Legislation that remains unenacted when the 119th Congress ends expires and has to be introduced again in the 120th, with new bill numbers.[14]
Europe: €35 Million Says No
February 2nd, 2025, the EU's AI Act went live. Real-time facial recognition in public spaces? Banned. Scraping faces from the internet? Banned. Emotion detection at work? Banned. The fine: €35 million or 7% of global revenue, whichever hurts more.[1][2]
Ring works in Germany, UK, Ireland, and Austria. But watch what features they disable. The EU classifies facial recognition as "special category data" under GDPR Article 9. Translation: You need explicit consent from everyone scanned. Good luck getting that from your delivery driver.[1][3]
Smart doorbell owners in Europe must already configure "privacy zones" to avoid recording neighbors. Must post visible signs. Must complete Data Protection Impact Assessments for commercial use. The EU didn't wait for companies to self-regulate. They regulated.[3]
The kicker: Police can't use real-time face scanning on crowds even with the AI Act's law enforcement exceptions. Requires judicial authorization and fundamental rights assessments.[2]
America: State-by-State Chaos
Amazon's December rollout of Ring's "Familiar Faces" is a legal experiment. They're launching everywhere except Illinois, Texas, and Portland. Why those three? Because they have biometric laws with teeth.[4]
Illinois's Biometric Information Privacy Act (BIPA) cost Facebook $650 million. Texas extracted $1.375 billion from Google for Nest cameras. Meta paid Texas another $1.4 billion. Portland straight-up banned private sector facial recognition.[4]
The other 47 states? Amazon's betting they won't enforce their laws. They're probably right. Most states have privacy laws on the books, but without private rights of action or statutory damages, they're paper tigers.[4]
Senator Markey called Ring's face scanning "a serious threat to the public's privacy." Amazon's response? Launch it anyway, make it opt-out by default, and remind users to "comply with applicable laws."[4][5] Classic American approach: innovate first, litigate later.
UK: Full Speed Ahead
The UK went the opposite direction. Metropolitan Police installs permanent facial recognition cameras in Croydon, South London, summer 2025. Not temporary deployments. Permanent street furniture.
UK cops now use facial recognition on their smartphones. Point, scan, identify. No warrant needed. No oversight required. The UK has no specific legislation regulating facial recognition – just vague data protection guidelines everyone ignores.
Ring operates freely in the UK. No feature restrictions announced. The Information Commissioner's Office issued "guidance" but no hard rules.[8] Meanwhile, the UK quietly builds China-style surveillance infrastructure with American corporate partners.
The contrast with the EU is stark. While Brussels bans the tech, London mounts it on lampposts. Brexit meant freedom from EU privacy laws. Turns out that freedom cuts both ways.
China: The End Goal
China's Communist Party claims its system scans 1.4 billion faces "in seconds."[10] They're not hiding it. They're bragging about it. Social credit scores, minority tracking in Xinjiang, protest identification – it's all connected.[10]
China introduced "rules" on facial recognition in 2025. But read the fine print: Wide exceptions for "national security and public safety." Which in China means everything the government wants to do.[10]
Here's what should terrify you: American companies provide the tech. Chinese firms perfect the implementation. UK adopts the methods. The surveillance state isn't imported – it's franchised.[10]
Ring's infrastructure could enable China-style tracking. The "search party" feature that finds lost dogs? Same tech finds people. The difference between democracy and authoritarianism becomes just a software update.[10]
Canada and Australia: Writing Rules While Tech Runs Wild
Canada updated its privacy guidance August 11, 2025. Requirements: meaningful consent, privacy impact assessments, alternatives to biometric authentication.[6] Sounds good on paper. But Bill C-27, which would've created real AI oversight, died when Parliament prorogued. Quebec's the only province with actual biometric legislation.[6]
The Privacy Commissioner warns against "no-go zones" like mass surveillance. But warnings aren't laws. Clearview AI still operates despite privacy violations. Ring faces no restrictions. Canadian privacy law is all bark, no bite.[6][9]
Australia's even further behind. Still running on the Privacy Act of 1988. Yes, 1988. They found Clearview AI violated privacy in 2021 but haven't issued a fine. Maximum penalty if they do? AUD$2.22 million. That's couch cushion money for Amazon.[7]
Both countries are "reviewing" and "considering" and "drafting guidance" while facial recognition deploys nationwide. By the time they pass laws, the infrastructure will be so embedded, regulation becomes decoration.[6][7]
The Global Surveillance Divide
We're watching the world split into surveillance camps:
The Banners
EU: €35 million fines, judicial oversight required, public space bans[1][2]
Portland: Total private sector ban[4]
Illinois/Texas: Billion-dollar settlements[4]
What This Means for You
Your privacy depends on your zip code. Live in Illinois? Protected. Live in Idaho? Scanned. Travel to London? Tracked. Visit Brussels? Safe.[1][4][8]
Ring's December launch is a test case. If Americans don't revolt, expect face scanning in every doorbell by 2026. If lawsuits fly and settlements hit billions, watch Amazon suddenly discover "technical limitations" in expanding the feature.
The EU proved regulation works. Companies disable features rather than pay fines.[1] But it requires political will America lacks and enforcement Australia can't afford.[7]
Here's the brutal truth: We're five years from ubiquitous facial recognition or comprehensive bans. No middle ground. Either your face becomes a tracking number, or governments protect your biometric autonomy. The choice gets made now.
Protect Yourself Based on Location
If You're in America
• Move to Illinois, Texas, or Portland (seriously)
• Support state biometric laws with private rights of action
• Document every Ring camera you pass
• Join class actions when they launch
• Pressure local government for city-level bans
If You're in Europe
• Report GDPR violations to data protection authorities
• Demand privacy impact assessments from businesses
• Know your Article 9 rights
• Support maintaining strong AI Act enforcement
• Watch for law enforcement exception creep
If You're Elsewhere
• Assume you're being scanned
• Wear hats and sunglasses
• Support privacy organizations
• Demand legislation before infrastructure embeds
• Learn from EU's example – regulation works
References
- Biometric Update - EU ban on 'unacceptable' AI comes into force
- EU Artificial Intelligence Act - Article 5: Prohibited AI Practices
- EDRi - How to fight Biometric Mass Surveillance after the AI Act
- EFF - The Legal Case Against Ring's Face Recognition Feature
- Senator Markey Demands Amazon Abandon Facial Recognition Plan
- Privacy Commissioner of Canada Publishes Guidance on Biometrics
- Facial Recognition and AI in Australia - Do We Need More Rules?
- UK ICO - Smart Doorbells Commercial Use Guidance
- BC Court Requires Clearview AI to Comply with Privacy Laws
- CDT - EU AI Act Must Reject Chinese-Style Surveillance
- Biometric Update - Amazon and Ring seek dismissal of Familiar Faces biometric privacy lawsuit (September 22, 2026)
- About Amazon - Introducing Familiar Faces: A New Way to See Who's at Your Front Door (April 16, 2026)
- European Commission, Digital Strategy - AI Omnibus enters into force (July 27, 2026)
- Biometric Update - US Democrats prepare to scrutinize federal biometric surveillance (November 2026)