Privacy Bills Keep Dying the Same Way

A crime makes headlines. Politicians point to surveillance tech that helped. The bill banning that tech quietly disappears. It happened in Illinois. It’s happening everywhere.

State of Surveillance Editorial Team

Security surveillance cameras mounted on a pole against a cloudy sky

TL;DR:

  • The bill: Illinois HB 5521, the Biometric Surveillance Act, would have banned police from using facial recognition tools statewide, the strongest such ban in the country. It died without a committee vote on March 27, 2026. Backers confirmed on May 18 they won’t revive it this session. [1][2]
  • What killed it: On the same day HB 5521 missed its committee deadline, police announced they’d used facial recognition to identify the suspect in the murder of Loyola University freshman Sheridan Gorman. The bill had only four House sponsors. [1][3]
  • The pattern: This isn’t unique to Illinois. A high-profile crime creates a political moment where surveillance tech looks essential. The privacy bill dies. Austin’s surveillance oversight efforts faced the same dynamic. So did federal reform attempts after mass shootings.
  • The irony: Illinois passed BIPA in 2008, the toughest biometric privacy law in the country. But BIPA only covers private companies. Government use of the same technology? Completely unregulated. [1][4]
  • The scorecard: Only Vermont and Maine have enacted near-total bans on police facial recognition. Everyone else is still fighting, and mostly losing.

How Illinois Lost Its Own Bill

Rep. Kelly Cassidy, a Chicago Democrat, introduced HB 5521 on February 6, 2026. The bill was straightforward: ban Illinois law enforcement from using or accessing facial recognition databases. Fingerprinting and crime-scene forensics would continue. The target was specifically the algorithmic identification systems that let police run a face through a database and get a match. [1][2]

The bill had backing from the ACLU of Illinois. It had four House sponsors. It did not have momentum.

Opposition was immediate. The Illinois Association of Chiefs of Police, the Illinois Sheriffs’ Association, and individual police departments filed witness slips against it. Rep. Patrick Sheehan, a Republican from Homer Glen, put it bluntly: “Imagine having to tell a victim’s family the technology that could have identified the suspect was taken off the table by lawmakers.” [1]

Then, on March 19, 18-year-old Sheridan Gorman was shot and killed near Loyola Beach in Rogers Park, in Cassidy’s own district. A man in black jumped out from behind a lighthouse and opened fire on a group of students. Gorman died at the scene. [3][5]

Eight days later, on March 27, police announced they’d identified the suspect (Jose Medina) using U.S. Customs and Border Protection’s facial recognition system to match surveillance footage. That same day, HB 5521 missed its committee deadline and was sent to the House Rules Committee. Dead on arrival. [1][3]

On May 18, NPR Illinois reported that backers aren’t even trying to revive the bill this session. It’ll have to wait at least another year. [1]

The Playbook That Keeps Working

Here’s how a privacy bill dies in America:

  1. A lawmaker introduces legislation to restrict surveillance technology
  2. Law enforcement groups oppose it immediately
  3. A violent crime happens, one where the technology played a role in solving it
  4. The crime dominates headlines. Critics of the bill point to it as proof the technology is necessary
  5. The bill quietly fails. Supporters say they’ll try again next session

It’s not a conspiracy. It’s a structural problem. Violent crimes are constant enough that any bill restricting police tools will, at some point during its legislative journey, collide with a case where those tools helped catch someone. The timing doesn’t have to be coordinated. It just has to overlap.

Ed Yohnka of the ACLU of Illinois told NPR Illinois that advocates are “wary of debates happening in the wake of major news events, which can emphasize the technology’s role in investigations over its risks.” His hope: “that there is actually a balanced discussion.” [1]

That balanced discussion never seems to arrive.

Austin Fought the Same Battle

In Austin, Texas, the TRUST Act (Transparent and Responsible Use of Surveillance Technology) faced its own version of this dynamic. The bill was first scheduled for the city council’s August 28, 2025 meeting. It got pulled two days before amid public pushback. [6]

The pushback came from residents who wanted more surveillance, not less. Austin Parks and Recreation had been piloting surveillance cameras in public areas through a contract with LiveView Technologies. When the TRUST Act threatened to add oversight requirements, critics framed it as soft on crime. [6]

Austin’s council eventually passed the TRUST Act in May 2026, but only after shelving the camera expansion program and narrowing the ordinance to focus on procurement oversight rather than outright bans. The result is transparency requirements, not restrictions. [7]

That’s the best-case scenario: a watered-down version passes. Illinois didn’t even get that.

Only Two States Have Done It

Vermont and Maine are the only states with near-total bans on police facial recognition. Everyone else is somewhere between “trying” and “not bothering.”

Vermont enacted a moratorium in 2020 as part of a police reform package. It prohibits facial recognition in almost all situations, with a narrow exception for child sexual exploitation cases. [8]

Maine passed what the ACLU called “the strongest statewide facial recognition regulations in the country.” Government agencies, including police, can only use facial recognition for limited purposes: investigating serious crimes, identifying deceased or missing persons. Even then, they need a warrant, probable cause, or a court order. [9]

Both states passed their laws during the 2020-2021 police reform wave, when the political window was wide open. That window has narrowed considerably.

The states making progress now are settling for regulation, not bans. Virginia’s facial recognition law takes effect July 1. It requires warrants, audits, and annual reporting, but doesn’t prohibit the technology. Maryland passed rules requiring police to tell defendants when facial recognition was used against them. New York’s Senate passed a study commission, not even a regulation, just a task force to think about one. [10]

The Illinois Irony

Illinois passed the Biometric Information Privacy Act in 2008. BIPA is the most aggressive biometric privacy law in the country. It requires companies to get your written, informed consent before collecting fingerprints, faceprints, iris scans, or voiceprints. It has generated billions in settlements: $650 million from Facebook, $228 million from TikTok, and lawsuits keep coming. [4]

But BIPA only covers private companies. Government agencies are exempt.

That means Illinois has the strictest rules in the country for how Disney or Google can use your face, and zero rules for how Chicago police can use it. Chicago PD has access to roughly 30,000 public and private surveillance cameras, one of the most extensive integrated systems in the nation. They can run faces through federal databases with no warrant, no audit trail, and no obligation to tell you. [1]

HB 5521 was supposed to close that gap. Instead, the gap is wider than ever.

The Risk That Doesn’t Make Headlines

When facial recognition catches a murder suspect, it’s front-page news. When it puts the wrong person in jail, the story barely registers.

The ACLU has documented at least 13 known wrongful arrests caused by facial recognition misidentification, with five occurring in 2025 alone. The actual number is almost certainly higher, since defendants often don’t know the technology was used against them. [11]

Angela Lipps, a Tennessee grandmother, spent five months in jail after Clearview AI flagged her as a bank fraud suspect in North Dakota, a state she’d never visited. She lost her home, her car, and her dog before charges were dropped on Christmas Eve 2025. [11][12]

Matthew Kugler, a Northwestern University law professor, told NPR Illinois the technology is “a lead” when used well, and “overly trusting” when used badly. [1] The problem is there’s no mechanism to ensure police departments use it well. No warrant requirements, no audits, no reporting mandates. At least not in Illinois.

Jeramie Scott of the Electronic Privacy Information Center put it differently: the technology “is a crutch to try to identify crime after” it happens, not a tool that prevents crime. [1]

Where This Goes

HB 5521 is dead for this session. Cassidy or another sponsor could reintroduce it in 2027, but the same dynamics will apply: law enforcement will oppose it, and the next high-profile case using facial recognition will arrive right on schedule.

The states making actual progress have stopped trying to ban the technology outright. Instead, they’re building guardrails:

  • Virginia (July 2026): Warrant requirements, annual audits, public reporting
  • Maryland: Mandatory disclosure to defendants when facial recognition was used
  • New York: Study commission to recommend regulations (S3699 passed the Senate)

Whether guardrails are enough is a separate question. Disclosure requirements are meaningless if police departments ignore them. Audit mandates are theater without enforcement. And study commissions have a way of studying things indefinitely while the technology they’re studying becomes more entrenched.

But at least those bills pass. Total bans, so far, cannot survive the news cycle.

What You Can Do

  • Track your state’s legislation: EPIC maintains a state facial recognition policy tracker that shows where bills stand in every state
  • Contact your state legislators: If you’re in Illinois, tell your representative to support the reintroduction of HB 5521 or a similar bill next session. If you’re in New York, push for S1422, the Biometric Privacy Act sitting in committee
  • Support organizations doing this work: The ACLU of Illinois, the Electronic Privacy Information Center (EPIC), and the Electronic Frontier Foundation (EFF) all advocate for facial recognition restrictions
  • Know your rights: In most states, police don’t have to tell you facial recognition was used in your case. If you’re facing charges, ask your attorney to file discovery requests specifically about surveillance technology

Sources

  1. NPR Illinois: Stalled surveillance bill highlights tension between privacy and public safety (May 18, 2026)
  2. LegiScan: Illinois HB 5521 Bill Text
  3. WTTW Chicago: Man Charged in Fatal Shooting of Loyola Freshman Sheridan Gorman (March 27, 2026)
  4. ACLU of Illinois: Biometric Information Privacy Act (BIPA)
  5. CBS News: Parents of slain Loyola student Sheridan Gorman call for accountability
  6. Community Impact: Austin council considers surveillance tech policies (February 3, 2026)
  7. Community Impact: Austin adopts stricter oversight of city surveillance technology use (May 1, 2026)
  8. Clarip: Vermont Enacts a Moratorium on Facial Recognition Technology by Law Enforcement
  9. ACLU: Maine Enacts Strongest Statewide Facial Recognition Regulations in the Country
  10. TechPolicy.Press: Status of State Laws on Facial Recognition Surveillance
  11. ACLU: More than a Dozen Wrongful Arrests Due to Police Reliance on Facial Recognition Technology
  12. State of Surveillance: A Grandmother Lost Five Months, Her Home, Her Car, and Her Dog to a Facial Recognition Error