Your Face Is Legal to Steal in 29 States

Picture two neighbors. Same city, different sides of a state line. One has legal rights over how companies can scan and store her face. The other? Basically nothing. No law, no consent required, no way to say no. Same country. Same Tuesday. Completely different levels of protection — because of a ZIP code.

This isn't hypothetical. It's happening right now, and it's moving fast. A handful of states — Colorado, Connecticut, Idaho, Iowa, Nebraska, and Oregon among them — have passed new AI rules in 2026, according to Seeking Alpha. Meanwhile, the Trump administration is pushing to keep AI regulation at the federal level — which sounds reassuring until you realize there is no comprehensive federal AI law. Not one. The federal government currently relies on old laws, executive orders, and what amounts to a politely worded suggestion system. States are tired of waiting.

The Gap That Nobody Filled

Here's the thing about vacuums: something always rushes in to fill them. Congress has spent years talking about AI regulation. It has not produced a national law. So states started writing their own — and now Washington wants them to stop, even though Washington hasn't offered a replacement.

Vorys detailed the White House's March 2026 framework, which pushed to centralize AI oversight and block state-level rules. The argument from the administration is practical — sort of. If every state has different rules, companies building AI products nationally have to juggle fifty different legal checklists. That's messy and expensive.

President Trump made the point directly:

"If they had to get 50 different approvals from 50 different states, you could forget it." — President Donald Trump, on AI companies and state-level regulation, as reported by U.S. News & World Report

Fair point — from a business perspective. But here's the problem: that argument only works if the federal government is actually doing something. Right now, it isn't. Telling states to stand down while offering nothing in return isn't a safety plan. It's a gap with a press release on top of it. This article is part of a series — start with Why Fake Faces Look More Real Than Genuine Photos.

And the states know it. The bipartisan push back has been striking. Republican governors who would normally be the first to resist federal overreach are siding with Democratic lawmakers on this one. The reasoning is blunt: if Washington won't act, we will.

Your Face. Your Voice. Which State's Rules Apply?

Let's get specific, because "AI regulation" sounds abstract until you realize what it actually covers. We're talking about:

Your face. Facial recognition technology — cameras and software that identify you from a photo or video — is completely unregulated at the federal level. No federal law governs how companies collect, store, or sell your face data. According to CEPA, 18 states have passed some kind of statewide facial recognition law, 3 more have laws pending — and 29 states have nothing at all. That's more than half the country with zero facial recognition protections on the books.

Your biometric data (your face scan, your voiceprint, your fingerprints — the body stuff that's uniquely yours and can't be changed if stolen). According to NPR, 23 states have passed or expanded laws restricting the mass collection of this data — but the rules vary wildly on what companies must do with your consent, how they're enforced, and whether you can actually sue if a company breaks the rules.

Your voice. AI voice cloning — where software learns to copy your voice from a few seconds of audio and then says anything — is a growing scam vector. A parent hears their child's voice on the phone begging for help. It isn't their child. Whether that scam is illegal, and whether you have any legal recourse, may depend entirely on which state you pick up the phone in.

Why the Patchwork Is Actually Dangerous

Here's where it gets genuinely complicated — and a little maddening. Even in states that do have laws, the rules don't line up. Some states require companies to get your explicit permission before collecting your face data. Others require companies to tell you they're doing it, but don't need your sign-off. Some let you sue a company directly if it violates the rules. Others only let the state attorney general do that — which means if a company scrapes your photo without permission, you personally may have no legal path to hold them accountable.

It's not a safety net. It's more like a dozen different nets with different-sized holes, stitched together at odd angles, covering different parts of the country. Previously in this series: 200 000 Strangers Just Got Caught Trading Fake Nudes Of Real.

The compliance costs for businesses are real — nobody disputes that. But the risk being offloaded onto regular people when those businesses operate in unregulated states is also real. And somehow that part of the equation gets less airtime.

What You Can Actually Do About This

Look, nobody expects you to read 50 state statutes before downloading an app. But there are a few things worth knowing — right now, tonight, on your phone.

First: find out if your state has a biometric privacy law. Texas, Illinois, Washington, and a growing list of others do. Illinois in particular has one of the strongest in the country, and residents there have successfully sued companies over violations. If you live there, you have real legal teeth. If you live in a state with nothing on the books, you're essentially operating on the honor system with every app that uses your face or voice.

Second: when an app asks to access your camera or microphone, that permission isn't just about the feature you're using. It may be feeding data into systems you've never heard of. The question to ask isn't "does this app need my camera?" — it's "what does this app do with what my camera sees?"

Third — and this is where it gets practical for anyone trying to verify identity online — the tools used to check whether a photo is real, whether a profile matches a real person, or whether someone is who they claim to be, are also subject to this same state-by-state mess. If you've ever wondered whether a photo or profile is really who it claims to be, that's the exact question that responsible identity-verification technology exists to answer. But not all of it is built with the same legal standards in mind. Tools designed with compliance baked in from the start — built to work within the laws your state actually has, or the laws coming next year — give you results that hold up. Worth asking, before you trust any tool with that job, whether it was built for the legal world your question lives in.

The Question Nobody Wants to Answer Out Loud

The federal-vs-state argument is often framed as a business question. Compliance costs. Legal uncertainty. Innovation burdens. All of that is real.

But strip it back to the actual stakes and it becomes something else. The federal government is asking states to trust that Washington will eventually produce a law that protects people from AI-powered fraud, identity theft, deepfakes, and unconsented face scanning. That law does not exist yet. It has not existed for years. And the administration's answer to states writing their own protections in the meantime is, essentially: wait.

Most people who've had their voice cloned, their face scraped, or their identity faked by an AI tool are not interested in waiting. Neither, it turns out, are most state legislatures — Republican or Democrat.

The engagement question buried in all of this is worth sitting with: should the same person get the same AI protections whether they live in Colorado or Mississippi? Because right now the answer is no. And the side arguing for that inconsistency is the same side that says it will fix it — later, federally, eventually — without a timeline and without a draft law on the table.

That's not a policy position. That's a waiting room with no doctor on call.

Meanwhile, Colorado's clock is already running. Oregon just passed its deepfake law unanimously. And somewhere right now, a person in an unprotected state is staring at a photo of themselves they didn't authorize — and discovering there's no law with their name on it.