AI Face Scan Laws: Why Your AI Protections Depend on State

Picture two neighbors. Same city, different sides of a state line. One has legal rights over how companies can scan and store her face. The other? Basically nothing. No law, no consent required, no way to say no. Same country. Same Tuesday. Completely different levels of protection, because of a ZIP code.

This isn't hypothetical. It's happening right now, and it's moving fast. A handful of states, Colorado, Connecticut, Idaho, Iowa, Nebraska, and Oregon among them, have passed new AI rules in 2026, according to Seeking Alpha. Meanwhile, the Trump administration is pushing to keep AI regulation at the federal level, which sounds reassuring until you realize there is no comprehensive federal AI law. Not one. The federal government currently relies on old laws, executive orders, and what amounts to a politely worded suggestion system. States are tired of waiting.

---

The Gap That Nobody Filled

Here's the thing about vacuums: something always rushes in to fill them. Congress has spent years talking about AI regulation. It has not produced a national law. So states started writing their own, and now Washington wants them to stop, even though Washington hasn't offered a replacement.

Vorys detailed the White House's March 2026 framework, which pushed to centralize AI oversight and block state-level rules. The argument from the administration is practical, sort of. If every state has different rules, companies building AI products nationally have to juggle fifty different legal checklists. That's messy and expensive.

President Trump made the point directly:

"If they had to get 50 different approvals from 50 different states, you could forget it." President Donald Trump, on AI companies and state-level regulation, as reported by U.S. News & World Report

Fair point, from a business perspective. But here's the problem: that argument only works if the federal government is actually doing something. Right now, it isn't. Telling states to stand down while offering nothing in return isn't a safety plan. It's a gap with a press release on top of it. This article is part of a series, start with Why Fake Faces Look More Real Than Genuine Photos.

And the states know it. The bipartisan push back has been striking. Republican governors who would normally be the first to resist federal overreach are siding with Democratic lawmakers on this one. The reasoning is blunt: if Washington won't act, we will.

---

Your Face. Your Voice. Which State's Rules Apply?

Let's get specific, because "AI regulation" sounds abstract until you realize what it actually covers. We're talking about:

Your face. Facial recognition technology, cameras and software that identify you from a photo or video, is completely unregulated at the federal level. No federal law governs how companies collect, store, or sell your face data. According to CEPA, 18 states have passed some kind of statewide facial recognition law, 3 more have laws pending, and 29 states have nothing at all. That's more than half the country with zero facial recognition protections on the books.

Your biometric data (your face scan, your voiceprint, your fingerprints, the body stuff that's uniquely yours and can't be changed if stolen). According to NPR, 23 states have passed or expanded laws restricting the mass collection of this data, but the rules vary wildly on what companies must do with your consent, how they're enforced, and whether you can actually sue if a company breaks the rules.

Your voice. AI voice cloning, where software learns to copy your voice from a few seconds of audio and then says anything, is a growing scam vector. A parent hears their child's voice on the phone begging for help. It isn't their child. Whether that scam is illegal, and whether you have any legal recourse, may depend entirely on which state you pick up the phone in.

What an AI Face Scan Actually Measures With Facial Landmarks

An AI face scan works by mapping facial landmarks, the corners of your eyes, the width of your nose, the distance between your cheekbones, into a set of numbers. That numeric map, not a photo itself, is what most face recognition systems store and compare later. This is why an ai-based face system can still identify you even after a bad haircut or new glasses; the landmarks underneath barely change.

How Face Detection Differs From Face Recognition

Face detection just answers one question: is there a face in this image at all? Face recognition goes a step further and tries to match that face against faces it already has on file. An app can run face detection on every photo you take without ever attempting recognition, which is one reason permission screens can be misleading about what's actually happening to your data.

Recognition Algorithms Behind Face Recognition AI Technology

The recognition algorithms that power face recognition ai technology have gotten dramatically better over the past decade, mostly because they've been trained on enormous photo libraries scraped from the open web. That same face recognition ai technology can now match a blurry photo to a clear one in under a second. Faster and cheaper recognition is exactly why lawmakers in states like Illinois moved early, before the technology outran the rules meant to govern it.

Ai-Powered Face Verification and Analyzing Facial Features

Some services use ai-powered face verification to confirm a person is who they claim to be, often by asking someone to blink or turn their head on camera. Under the hood, the system continues to analyze your facial features frame by frame, checking that a real, moving person is in front of the camera rather than a photo or recorded video. That distinction matters more every year as fake photo and video tools improve.

Faces, Photos, and What Gets Stored Long-Term

Not every company that scans faces keeps the underlying photo. Some only keep the numeric landmark data described above, others keep both the photo and the derived faces data indefinitely. Whether a company deletes your photo after processing, or holds onto both the photo and your facial map, is exactly the kind of detail state biometric laws try to force companies to disclose.

---

Why the Patchwork Is Actually Dangerous

Here's where it gets genuinely complicated, and a little maddening. Even in states that do have laws, the rules don't line up. Some states require companies to get your explicit permission before collecting your face data. Others require companies to tell you they're doing it, but don't need your sign-off. Some let you sue a company directly if it violates the rules. Others only let the state attorney general do that, which means if a company scrapes your photo without permission, you personally may have no legal path to hold them accountable.

It's not a safety net. It's more like a dozen different nets with different-sized holes, stitched together at odd angles, covering different parts of the country. Previously in this series: 200 000 Strangers Just Got Caught Trading Fake Nudes Of Real.

The compliance costs for businesses are real, nobody disputes that. But the risk being offloaded onto regular people when those businesses operate in unregulated states is also real. And somehow that part of the equation gets less airtime.

---

What You Can Actually Do About This

Look, nobody expects you to read 50 state statutes before downloading an app. But there are a few things worth knowing, right now, tonight, on your phone.

First: find out if your state has a biometric privacy law. Texas, Illinois, Washington, and a growing list of others do. Illinois in particular has one of the strongest in the country, and residents there have successfully sued companies over violations. If you live there, you have real legal teeth. If you live in a state with nothing on the books, you're essentially operating on the honor system with every app that uses your face or voice.

Second: when an app asks to access your camera or microphone, that permission isn't just about the feature you're using. It may be feeding data into systems you've never heard of. The question to ask isn't "does this app need my camera?", it's "what does this app do with what my camera sees?"

Third, and this is where it gets practical for anyone trying to verify identity online, the tools used to check whether a photo is real, whether a profile matches a real person, or whether someone is who they claim to be, are also subject to this same state-by-state mess. If you've ever wondered whether a photo or profile is really who it claims to be, that's the exact question that responsible identity-verification technology exists to answer. But not all of it is built with the same legal standards in mind. Tools designed with compliance baked in from the start, built to work within the laws your state actually has, or the laws coming next year, give you results that hold up. Worth asking, before you trust any tool with that job, whether it was built for the legal world your question lives in.

---

The Question Nobody Wants to Answer Out Loud

The federal-vs-state argument is often framed as a business question. Compliance costs. Legal uncertainty. Innovation burdens. All of that is real.

But strip it back to the actual stakes and it becomes something else. The federal government is asking states to trust that Washington will eventually produce a law that protects people from AI-powered fraud, identity theft, deepfakes, and unconsented face scanning. That law does not exist yet. It has not existed for years. And the administration's answer to states writing their own protections in the meantime is, essentially: wait.

Most people who've had their voice cloned, their face scraped, or their identity faked by an AI tool are not interested in waiting. Neither, it turns out, are most state legislatures, Republican or Democrat.

The engagement question buried in all of this is worth sitting with: should the same person get the same AI protections whether they live in Colorado or Mississippi? Because right now the answer is no. And the side arguing for that inconsistency is the same side that says it will fix it, later, federally, eventually, without a timeline and without a draft law on the table.

That's not a policy position. That's a waiting room with no doctor on call.

Meanwhile, Colorado's clock is already running. Oregon just passed its deepfake law unanimously. And somewhere right now, a person in an unprotected state is staring at a photo of themselves they didn't authorize, and discovering there's no law with their name on it.

None of this is abstract once you picture your own phone doing the scanning. Every time a face detection step runs before a face recognition match, your photo is quietly becoming data that outlives the moment you took it. An ai face scan does not care which state you're standing in when it happens, only the law that applies afterward does.

People often ask whether an ai-powered face check is safe to use at all. The honest answer is that safety depends less on the technology and more on what the company behind it promises to do with your facial biometrics once it has them. A face scan stored for a single verification and then deleted is a very different risk than one held forever in a searchable database.

Consider a simple example. You upload a selfie to confirm your identity for a new account. The service runs face detection to confirm a face is present, then recognition algorithms to compare it against a reference photo, then discards the image, keeping only the numeric result. That is a responsible use of an ai face scan, and it's the kind of design state biometric laws increasingly try to require.

Now compare that to a company that keeps the photo indefinitely, shares your faces data with marketing partners, and never tells you either is happening. Both companies technically ran an ai face scan on you. Only one of them treated your face like something that belongs to you.

This is where recognition algorithms trained on huge photo datasets cut both ways. The same math that lets a bank confirm you're really you in three seconds is the math that lets a stranger find your name from a single public photo. The algorithm doesn't know the difference. The law is supposed to.

If you want to find out how a particular app or service treats your data, start by looking for its privacy policy and searching it for the words biometric, facial, or face. If you can't find any mention of what happens to your photo after upload, that silence is itself an answer.

Try to find whether the company states a retention period for any photo or face scan you submit. A specific number of days is a good sign. Vague language about "as long as necessary for business purposes" is not.

Some identity-verification products now advertise that they analyze your facial features only in memory, never writing the image to a permanent server at all. Whether that claim is true is hard for an ordinary user to verify directly, but it's a meaningfully different design goal than products built to collect and retain as much face and photo data as possible.

The practical takeaway is simple even if the legal landscape isn't. An ai face scan is not inherently good or bad. What matters is the law standing behind it, and right now that law is a patchwork instead of a floor, which means the same scan can be tightly controlled in one state and completely unregulated one border over.