The States Race to Regulate Facial Recognition: New York and Virginia

The United States Capitol building dome against a blue sky — Photo via Unsplash

TL;DR: Congress can't agree on whether to regulate facial recognition at the federal level. So the states are doing it themselves, in wildly different ways. New York's Senate passed the Facial Recognition Technology Study Act (S3699) to create a task force studying the tech before regulating it. Virginia's facial recognition law takes effect July 1, requiring warrants, audits, and annual reporting for any police department that uses it. Alabama just became the 21st state with a comprehensive privacy law covering biometric data. Maryland passed the strongest police facial recognition rules in the country, including a requirement to tell defendants when the tech was used against them. And NYC is debating bans on landlords and businesses scanning tenants' and customers' faces. Meanwhile, 16+ cities have banned police use entirely, and none of them have had a wrongful facial recognition arrest.

Congress Won't Do It, So the States Will

The federal government has introduced facial recognition bills. They go nowhere. Senator Ed Markey's ICE Out of Our Faces Act, introduced in February 2026, would ban ICE and CBP from using facial recognition entirely. It has bipartisan support from privacy groups. It hasn't received a vote ^[1].

The Facial Recognition Act of 2025 (H.R. 4695) sits in committee. The Government Surveillance Reform Act sits in committee. Every meaningful federal facial recognition bill introduced since 2019 has died without a floor vote ^[2].

That vacuum created an opening. Twenty-one states now have comprehensive privacy laws. At least five require police to notify defendants when facial recognition was used in their case. Sixteen-plus cities have banned the technology for police use entirely ^[3]. The patchwork is messy, uneven, and growing fast.

New York: Study First, Regulate Later

The New York State Senate passed S3699, the Facial Recognition Technology Study Act, sponsored by Senator James Sanders Jr. The bill creates a task force to study how facial recognition is deployed across New York (public and private sector) and recommend a regulatory framework within one year ^[4].

The task force will review existing deployments, identify risks including privacy concerns and disproportionate impacts on communities of color, examine what other states and cities have done, and produce recommendations for New York lawmakers ^[5].

Sanders framed it as a "thoughtful, informed approach" that sits between outright bans and the current reality of zero oversight ^[5]. Critics might call it a stall tactic. But New York's track record suggests it's a precursor, not a substitute. Governor Cuomo signed legislation in 2020 suspending facial recognition in schools. The state has momentum.

The bill now goes to the Assembly, where companion bill A8788 awaits ^[4].

NYC: Ban the Scan

While the state studies, New York City is acting. Two bills advanced through City Council hearings in March 2026 ^[6]:

Int 0213-2026 would ban businesses and public accommodations from using facial recognition in surveillance cameras. Violations create a private right of action, meaning you can sue.
Int 0428-2026 would ban landlords from installing biometric entrance systems that identify tenants or guests. Councilmember Pierina Ana Sanchez, the sponsor, pointed out that your face shouldn't be the price of entering your own apartment.

Councilmember Shahana Hanif put it simply during hearings: "You cannot cancel your face" ^[6]. Together, these bills would make NYC one of the most restrictive jurisdictions in America for private-sector facial recognition.

The Ban the Scan campaign, backed by the Surveillance Technology Oversight Project (S.T.O.P.), Amnesty International, and the EFF, has been pushing these bills since 2024 ^[7].

Virginia: The July 1 Deadline

Virginia's facial recognition law updates take effect July 1, 2026. They're the most detailed police-specific regulations any state has passed ^[8].

Here's what changes:

No real-time tracking. Police can't use facial recognition to follow an identified person through public spaces in real time.
No live-feed databases. Agencies can't create image databases from live video for facial recognition purposes.
Policy or get out. Every department using facial recognition must publicly post its policy and update it annually. If the state police model policy doesn't fit, departments have 90 days to create their own, and it must meet or exceed the state standard.
Full audit trails. Agencies must keep a complete history of every query, including the total number of searches, the number that produced candidate lists, and demographic data on whose faces were queried.
Annual public reports. Chiefs of police must publish an annual report by April 1 detailing their department's facial recognition use ^[8].

Campus police face similar restrictions. They can't buy or deploy facial recognition unless a statute specifically authorizes it ^[8].

Virginia's approach: don't ban it, but make departments prove they're using it responsibly. Whether that's enough depends on whether transparency requirements actually change behavior. The 13 wrongful arrests documented so far suggest police departments aren't great at self-regulation.

Maryland: Tell the Defendant

Maryland's facial recognition law, which the Security Industry Association called "the nation's strongest regulations for law enforcement use," took effect in October 2024 and continues to set the standard ^[9].

The key provision: prosecutors must tell defendants that facial recognition was used in the investigation that led to their charges. During discovery, defense attorneys get the name of the system used, the databases searched, and the results that triggered further investigation ^[9].

This matters because police routinely hide facial recognition use. In the Randal Quran Reid case, Louisiana officers listed their Clearview AI match as a "credible source" on the arrest warrant. Reid spent six days in jail for crimes in a state he'd never visited ^[10]. Maryland's law makes that kind of concealment illegal.

Maryland also requires a training program for officers using facial recognition, administered by the Department of Public Safety and Correctional Services, with a deadline of June 2026 ^[9].

Four other states (Colorado, Montana, New Jersey, and Washington) now require similar defendant notification, building on Maryland's model ^[3].

Alabama: The 21st State

Alabama's legislature passed HB 351, the Alabama Personal Data Protection Act, on April 7, 2026. If the governor signs it, Alabama becomes the 21st state with a comprehensive privacy law ^[11].

The law covers businesses that control or process data for 25,000+ Alabama residents, or that get 25% or more of revenue from selling personal data. Biometric data, including facial recognition templates, is classified as sensitive data requiring explicit consent before processing ^[11].

Consumer rights include: confirming whether your data is being processed, correcting inaccuracies, deleting data, getting a portable copy, and opting out of targeted advertising or data sales. Enforcement is attorney general-only, with no private right of action ^[11].

The law takes effect May 1, 2027, if signed. It's not a facial recognition ban. But it puts biometric data in the "sensitive" category that requires affirmative consent, which is more than most states do.

The Cities That Said No

While states regulate, cities ban. At least 16 U.S. cities have prohibited police use of facial recognition ^[3]:

San Francisco was first, in May 2019. The city that hosts the tech industry's biggest companies decided its own police shouldn't use one of their products.
Boston followed in June 2020.
Portland, Oregon went further than anyone, banning both public and private sector use. Residents can collect up to $1,000 if police scan their face in violation.
Milwaukee became the latest, voluntarily banning all police facial recognition in February 2026 after public outcry ^[12].

Other cities with active bans include Springfield, MA; Jackson, MS; and Pittsburgh, PA.

Here's the thing nobody arguing against bans wants to acknowledge: no wrongful facial recognition arrest has been reported in a city with an active ban ^[10]. The technology can't wrongly identify you if it's not running.

The Loophole Problem

Bans have a loophole. A Washington Post investigation in May 2024 found that police in cities with facial recognition bans (including Austin and San Francisco) were asking other agencies to run searches on their behalf ^[13]. Your city banned it, so the local PD calls the county sheriff's office, which didn't.

This is exactly why state-level legislation matters. City bans are easy to circumvent with a phone call across jurisdictional lines. State laws aren't.

Maryland's disclosure requirement, Virginia's audit trails, and New York's upcoming framework all address something city bans can't: the department two towns over that has no rules at all.

The 2026 Scorecard

Where things stand as of April 2026:

21 states with comprehensive privacy laws (including biometric data protections) ^[11]
5 states requiring defendant notification when facial recognition is used: Colorado, Maryland, Montana, New Jersey, Washington ^[3]
16+ cities with outright police facial recognition bans ^[3]
3 states with dedicated biometric privacy laws with private right of action: Illinois (BIPA), Washington, Texas ^[14]
1 state (Virginia) with detailed police facial recognition audit requirements taking effect July 1 ^[8]
0 federal laws specifically regulating facial recognition ^[2]

What You Can Do

Check Your State

Look up whether your state has a comprehensive privacy law covering biometric data. The IAPP maintains a state privacy legislation tracker that's regularly updated. If your state has a law, know your rights under it.

Push for Defendant Notification

Only five states require police to tell you when facial recognition was used in your case. If your state isn't one of them, contact your state representative and ask them to introduce a bill modeled on Maryland's disclosure requirement. Defense attorneys can't challenge evidence they don't know exists.

Support Local Bans

City-level bans work. Milwaukee proved in February 2026 that public pressure still moves the needle. Contact your city council, show up to meetings, and cite the documented wrongful arrest cases.

Watch for Loopholes

If your city or state has restrictions, find out whether local police are sending facial recognition requests to other jurisdictions. File a public records request asking about inter-agency facial recognition queries. The Washington Post found this happening in San Francisco and Austin. It could be happening where you live.

21 Down, 29 to Go

The states aren't waiting for Congress. They can't afford to. While federal legislators argue about whether facial recognition even needs regulation, state capitols are writing the rules that actually govern how the technology is used on their residents.

The quality varies wildly. Alabama's law won't take effect until 2027. New York is still studying. Virginia has detailed rules but hasn't tested enforcement yet. And 29 states still have no comprehensive privacy law at all.

But the direction is clear. Every year, more states pass laws. More cities pass bans. More prosecutors are required to disclose facial recognition use. The federal government isn't driving this. Angry residents at city council meetings are. State legislators watching grandmother after grandmother get arrested by algorithms that can't tell Black faces apart are.

Twenty-one states down. Twenty-nine to go. And Congress still hasn't passed a single facial recognition law.

References

Published: April 11, 2026