Illinois Facial Recognition Law: What the Paper Trail Requires

Here's something that might stop you mid-scroll: right now, 44 states have passed at least one law governing how AI works inside their borders. That's not a distant policy debate. That's 44 different sets of rules that a single facial comparison result, one score, one match, might have to survive before it ever helps close a case.

Most people assume facial recognition is a simple yes-or-no machine. You feed it two photos, it spits out a match percentage, and either the faces are the same or they aren't. Done. Case closed. But there's an entire hidden layer underneath that number, a layer that's getting more complicated by the month, and if you're hiring an investigator, reviewing evidence, or just trying to understand your own rights, it's worth knowing what that layer actually looks like.

The Score Is the Easy Part

When a facial comparison tool analyzes two images, it's doing something genuinely remarkable. It maps dozens of spatial relationships across a face, the distance between your pupils, the angle of your jawline, the proportions of your nose relative to your forehead, and converts all of that into a mathematical representation. Then it compares those representations and produces a similarity score. A high score means the geometry lines up closely. A low score means it doesn't.

That process takes fractions of a second. It's the part technology has gotten very good at.

But the score is almost the least complicated thing about it now. The complicated part? Proving that everything surrounding that score was handled correctly, and "correctly" now depends entirely on which state you're in. This article is part of a series, start with Why Fake Faces Look More Real Than Genuine Photos.

White House officials have publicly described this situation as a "growing patchwork of 50 different state regulatory regimes," according to Seeking Alpha. That phrase, "patchwork", is doing a lot of work. It sounds abstract until you realize what it means for a real investigation crossing state lines.

What Detroit Actually Changed

Let's get concrete, because this is where it clicks.

How Law Enforcement Uses Face Recognition Under These Rules

Law enforcement agencies that rely on face recognition tools are increasingly bound by rules that go well beyond the software itself. Detroit police now operate under rules, stemming from legal settlements around wrongful arrest cases tied to facial recognition, that require any facial recognition match to be corroborated by additional evidence before a person is even placed in a photo lineup. Not just flagged. Corroborated. Furthermore, according to TechPolicy.Press, defendants must be told when facial recognition was used in their case, and the specific photo used in any lineup cannot be the same image the algorithm returned, a different photo of the suspect must be used instead.

Read that again slowly. The result of the algorithm cannot directly become the evidence. It's a lead, not a conclusion.

Now imagine an investigator who ran the same comparison under a different state's rules, somewhere with no equivalent requirements. Same algorithm. Same two photos. Same confidence score. But zero documentation of corroboration, no defendant notification trail, no record of which image went into the lineup. Whose results hold up better under scrutiny? The answer has nothing to do with the technology. It has everything to do with the paper trail.

"Police cannot use facial recognition systems without receiving training on the risks and dangers of the technology, and defendants must be informed when facial recognition was used and given details on the nature of its use." Reporting on Detroit police settlement requirements, TechPolicy.Press

The Illinois Problem, And Why It Ripples Outward

Illinois' Biometric Privacy Law and What Counts as an Identifier

Illinois has something called BIPA, the Biometric Information Privacy Act. Biometric data, by the way, just means the body-based stuff that's uniquely yours: your face geometry, your fingerprints, your voice pattern. Illinois' biometric privacy law treats each of these as a biometric identifier, and once that identifier is tied to you, the Illinois Biometric Information Privacy Act (BIPA) says that before any private entity collects that information from you, they must notify you in writing, get your informed consent, maintain a written policy about how long they'll keep it and when they'll delete it, and they cannot profit from it without explicit permission. As detailed by Cambridge University Press in its overview of U.S. facial recognition law, these aren't soft guidelines. They're hard legal requirements with real penalties attached. Previously in this series: How Deepfake Videos Are Evaluated Source Geometry Frame Cons.

Here's why that matters beyond Illinois state lines. If your investigation involves any images of people who were photographed or enrolled in Illinois, or if evidence could ever be examined by an Illinois court, BIPA's requirements may follow that evidence. You'd need to show that whoever collected the original images did so lawfully, with proper consent and documented retention policies, exactly the kind of paper trail the Illinois General Assembly had in mind when it wrote biometric information protections into state law.

Think of it this way. A facial comparison result is like a prescription. The medication is identical regardless of which pharmacy fills it, but the label, the warning documentation, the storage requirements, and the records you're legally required to keep all differ depending on which state's rules apply. The "medicine" (the match score) may be exactly right. But if the label (the documentation) is missing or wrong, the whole thing becomes unreliable, and potentially unusable.

The Misconception That Gets People Into Trouble

Here's where most people, including experienced investigators, get tripped up. They assume that proving technical accuracy is the same as having usable evidence. If the algorithm returned a 94% similarity score, that feels like a fact. And in a narrow technical sense, it is, the math checked out.

But a match score doesn't tell you whether the source images were collected with proper authorization under Illinois facial recognition law or any comparable state statute. It doesn't tell you whether the person depicted ever consented to having their face analyzed. It doesn't confirm whether the method used is accepted under the specific jurisdiction where the case will be heard. And it absolutely doesn't prove that someone was trained, as many states now require, on the limitations of the technology before they ran the comparison.

It's genuinely easy to get this wrong, by the way. For decades, expert testimony about technical results carried enormous weight in court, and it still does. The instinct to trust a precise-looking number is deep and reasonable. But what's changed is that courts and regulators are increasingly asking not just "what did the algorithm find?" but "how was this done, and can you prove it was done correctly?" Those are very different questions. The first is about technology. The second is about process, and process is now where cases get won or lost.

The Hidden Layer That Now Runs Alongside Every Comparison

At CaraComp, this is the gap we think about constantly, not just whether a facial comparison produces an accurate result, but whether the entire trail around that result is something you can stand behind. Source image documentation. Method transparency. Jurisdiction-specific compliance. Clear communication of what a match does and doesn't prove. Up next: The Most Real Face Youll See Today Was Never Born.

Washington State, for example, now operates under SB 6280, which requires state agencies using facial recognition to conduct accountability reports and allows independent testing for accuracy and bias, with results that must be made public. That's a documentation requirement baked directly into the law. The tool isn't the point. The accountability trail around the tool is the point.

What this means practically: if you are hiring an investigator who uses facial comparison technology, the right question isn't "what algorithm do they use?" The right question is "can they show me where the source images came from, explain which method was applied and why, tell me what the result does and does not prove, and demonstrate they followed the rules that apply to my specific situation?" If they hand you a percentage and a name without being able to answer those questions, you don't have evidence. You have a starting point dressed up as a conclusion.

So here's the question worth sitting with. If two investigators hand you the exact same facial comparison result, same score, same photos, same case, but only one of them can clearly show you where the images came from, which method was used, what the result proves and what it doesn't, and how the whole thing was handled under the rules that apply to your state: whose report would you trust?

The answer is obvious. And it has nothing to do with the algorithm at all.

Illinois facial recognition law is worth understanding in more detail because it has become the template other states measure themselves against. When people talk about facial recognition oversight in the United States, they are very often talking, whether they realize it or not, about Illinois' biometric privacy law and how it has shaped the conversation nationally. The Illinois Biometric Information Privacy Act (BIPA) was one of the earliest state statutes to treat biometric information as something that needed real legal protection, not just a technical byproduct of modern software.

Under this Illinois facial recognition law, biometric information is defined broadly enough to capture the kind of face geometry a comparison tool produces. That matters because a facial comparison result is, at its core, a mathematical representation of a biometric identifier. If that identifier came from an Illinois resident, or was collected through a system operating in Illinois, the biometric information protections written into BIPA can attach to it regardless of where the case is ultimately heard.

The Illinois General Assembly built BIPA around a fairly simple idea: private entities should not be allowed to collect, store, or profit from someone's biometric identifiers without that person's informed knowledge. That principle sounds obvious once you say it out loud, but it was genuinely ahead of its time when the law passed, and it remains one of the strictest biometric information frameworks in the country.

Recognition technology has moved fast, but Illinois facial recognition law has tried to keep pace by focusing less on the technology itself and more on the information trail around it. A recognition system doesn't need to be flawless to comply with BIPA. It needs the underlying biometric information practices, consent, notice, retention, and deletion, to be documented and lawful. That's a very different bar than simply proving the face recognition math was accurate.

For investigators and legal teams working outside Illinois, the practical lesson is straightforward. Any biometric information tied to an Illinois resident, or collected through infrastructure connected to Illinois, may be subject to Illinois' biometric privacy law even if the underlying case is being tried somewhere else entirely. That's why a facial comparison result can look technically perfect and still create legal exposure if the biometric identifiers behind it were never properly consented to or documented.

This is also why the private entity language in BIPA carries so much weight. The Illinois Biometric Information Privacy Act (BIPA) does not just regulate government use of recognition tools, it reaches private companies that collect biometric information for commercial purposes. Any private entity handling face geometry, fingerprints, or voice patterns tied to an Illinois resident needs a written retention policy and a documented consent process, or it risks being out of compliance regardless of how accurate its recognition technology actually is.

Illinois facial recognition law, in other words, is less about the algorithm and more about the paper trail that surrounds it, the same theme that runs through every state's approach to this technology. Whether you're evaluating a match from Illinois, Washington, or anywhere in between, the underlying question is the same: was the biometric information collected lawfully, documented properly, and used within the boundaries the law actually allows.