Biometrics and facial recognition

Biometric AI draws the tightest controls. The EU AI Act bans untargeted scraping of facial images and limits real-time remote biometric identification in public spaces to narrow law-enforcement exceptions, and it prohibits emotion recognition at work and in schools. Biometric categorization and post-hoc identification are treated as high-risk. In the US, biometric privacy statutes such as Illinois BIPA predate the AI wave but now drive much of the litigation. China regulates biometric use through its generative-AI and deep-synthesis rules.

Why it matters

Biometric data is often irreversible once exposed, so it attracts both AI-specific bans and separate privacy liability. Treat it as its own risk tier.

How each jurisdiction handles it

FlagJurisdictionHow it is handledStatus

ChinaExtensive binding sectoral rules; no single comprehensive actIn forceEuropean UnionComprehensive, horizontal, risk-based statutePhasing inPeruFirst AI law in Latin America; promotional statute with risk-based regulationIn forceUnited States: IllinoisEmployment anti-discrimination plus longstanding biometric privacyIn forceUnited States: TexasIntent-based statute with a NIST safe harborIn forceHong KongNo AI law; dense sectoral guidance, hardest in financeNo comprehensive lawTurkeyDraft AI framework pending; data protection and cybersecurity law bind nowProposed

Common questions