This article contains affiliate links. If you buy through them, we may earn a commission at no extra cost to you.
Your face is a password you can never change. And right now, in 2026, law enforcement agencies, federal immigration authorities, and private data brokers are storing, scanning, and acting on it — often without your knowledge and sometimes getting it catastrophically wrong. Some people think that’s a fair trade-off for public safety. They’re wrong. And the legal framework that’s supposed to protect you is, in most of the country, either nonexistent or toothless.
The debate over facial recognition has two camps: one that treats biometric surveillance as a necessary tool for a dangerous world, and one that sees it as a civil rights emergency dressed up in tech optimism. The evidence in 2026 leans hard toward the second camp — and the fix, according to privacy advocates and a growing bloc of legislators, starts with giving ordinary people the legal power to fight back themselves.
The facts:
- Nearly half of U.S. adults’ faces are already stored in facial recognition databases.
- Black, Brown, and Asian individuals are up to 100 times more likely to be misidentified by facial recognition algorithms than white men, according to research cited in the reintroduced Facial Recognition and Biometric Technology Moratorium Act.
- Kimberlee Williams, a grandmother from Oklahoma, was wrongfully arrested and jailed for six months after Maryland police relied on a false facial recognition match — and concealed that reliance from the court, per the ACLU.
- She is the fourteenth known person in the U.S. wrongfully arrested due to flawed facial recognition results.
- A Massachusetts data privacy bill is currently in conference committee, with a central fight over whether citizens can sue data holders directly — a “private right of action” — or whether enforcement stays with the attorney general alone.
Fourteen Wrongful Arrests and a System Still Running Hot
Kimberlee Williams had never set foot in Maryland. On June 23, 2021, she was helping her daughter with a DoorDash delivery to a military base in Oklahoma when security ran her ID and found outstanding Maryland arrest warrants. She was detained, jailed, and spent six months of her life paying for an algorithm’s mistake. Maryland police had used facial recognition to name her as a suspect in a series of fraudulent cash withdrawals — and then hid the fact that they’d used it when applying for the arrest warrant.
That’s not a glitch. That’s a pattern. Fourteen people in the U.S. have now been publicly identified as wrongfully arrested because police leaned on facial recognition and either ignored or concealed its unreliability. The technology doesn’t fail randomly. It fails in specific directions — against Black and Brown faces, against women, against people who look like someone a biased dataset decided they resembled. ICE and CBP are running mobile facial recognition apps in the field. The government is using biometric scanning to target immigrants and, according to members of Congress, to intimidate entire communities.
Representatives Jayapal, Tlaib, and Pressley, along with Senators Markey and Merkley, reintroduced the Facial Recognition and Biometric Technology Moratorium Act precisely because the federal government’s use of this tech has outpaced any reasonable regulatory boundary. The bill would prohibit government agencies from using facial recognition outright. That’s the right call. We’ve already seen what happens when you give law enforcement a powerful, error-prone tool and tell them to self-regulate. You get Williams sitting in a cell for six months for a crime she didn’t commit, in a state she’d never visited.
The argument that we need facial recognition to keep people safe collapses the moment you look at who it keeps safe and who it actively endangers. A technology that misidentifies Black individuals up to 100 times more often than white men is not a neutral public safety tool. It is a bias-amplification machine with a badge.
For a closer look at how computer vision is being deployed in other high-stakes environments, our piece on automating safety monitoring with computer vision and generative AI shows both the genuine promise and the serious implementation risks of building automated systems that make consequential decisions about human beings.
Why Private Right of Action Is the Real Fight in 2026
The Massachusetts Legislature is currently wrestling with exactly the question that will define whether data privacy laws have teeth or just good press releases. According to Commonwealth Beacon, the House and Senate versions of the state’s consumer data privacy bill differ on one critical point: who gets to enforce it. The Senate wants enforcement limited to the attorney general. The House wants individuals to be able to sue large data holders directly.
The Senate’s position sounds reasonable until you think about it for ten seconds. An attorney general’s office has finite resources, competing priorities, and institutional incentives to pick fights it can win cleanly. A private right of action means that when a company scans your face without consent, you — the person whose face it was — can take them to court. That’s not a technicality. That’s the entire difference between a law that corporations respect and one they treat as an annoying line item in the compliance budget.
Here’s the contrarian read that almost nobody in the privacy advocacy space wants to say out loud: most state-level data privacy laws have been deliberately written to be unenforceable. Not by accident. By design. Industry lobbying has been exceptionally effective at getting “comprehensive” privacy legislation passed that looks good in a press release and does almost nothing in practice. Limiting enforcement to overextended government offices is a feature, not a bug, for companies that profit from your biometric data.
If you want to understand how federal procurement and technology governance intersect on issues like this, the Department of Energy Acquisition Guide offers a useful lens on how government agencies are supposed to evaluate and govern the technologies they adopt — a process that clearly isn’t keeping pace with biometric surveillance deployment.
The moment a state passes data privacy law with a genuine private right of action — one with real damages and no arbitration trap — is the moment companies will actually start asking whether collecting and storing your facial data is worth the legal exposure. Until then, watch Massachusetts, because the conference committee outcome will signal whether 2026 is the year American privacy law finally develops a spine.
Watch the Breakdown
Sources
- To maximize consumer protection, new data privacy law must include a ‘private right of action’ — commonwealthbeacon.org
- Reps. Jayapal, Tlaib, Pressley and Sens. Markey, Merkley Reintroduce Legislation to Halt Government Use of Facial Recognition and Other Biometric Technology — jayapal.house.gov
- More than a Dozen Wrongful Arrests Due to Police Reliance on Facial Recognition Technology — www.aclu.org
