Does AI need consent to identify people by name in photos?

Why — the first-principles explanation

The key distinction, and the one that decides your answer, is between a photo and a faceprint. A photo is just an image. A faceprint — the biometric identifier — is a mathematical template extracted from the geometry of a face, precise enough to match that person anywhere. Most laws don't regulate photographs at all. They regulate the extraction step, the moment software converts a face into a template. That's why "can I post this picture?" and "can I run face recognition on it?" have completely different answers.

The reason biometrics get special treatment is a physical fact: you cannot change your face. A leaked password gets reset in thirty seconds. A leaked faceprint is permanent, and it works at a distance, without your knowledge, on a face you can't take off. That asymmetry — permanent, remote, and passive — is the whole justification for consent rules that don't apply to other data.

The US has no federal biometric privacy law, so the map is patchy and jurisdiction is everything. Illinois BIPA is the strong one: it requires notice and written consent before capturing an Illinois resident's biometric identifier, including a faceprint. Its power isn't the rule — it's the private right of action. Individuals can sue directly, which is why the litigation is real: Clearview AI, which built its database by scraping billions of internet images without consent, reached a $51.75 million class settlement approved in March 2025, the largest biometric privacy resolution to date. An earlier 2022 ACLU consent order permanently barred Clearview from selling its faceprint database to most private entities nationwide. Texas has a similar statute (CUBI) but only the attorney general can enforce it — no private suits — which changes the practical risk enormously. Most states have nothing.

There's a second route that catches people out: even with no biometric statute, general consumer-protection law applies. The FTC banned Rite Aid from using facial recognition for surveillance for five years in December 2023 — not under a biometric law, but because deploying a system that falsely flagged shoppers as shoplifters was unfair to consumers. People were wrongly detained and publicly accused, and the system was used disproportionately in neighborhoods with large Black, Latino, and Asian communities. The order forces Rite Aid to notify consumers when their biometric data is enrolled and to delete it. Accuracy and deployment are regulated too, not just consent.

Elsewhere, biometrics are typically special-category data requiring an explicit legal basis under GDPR-style regimes, generally stricter than most of the US.

One asymmetry worth knowing: identifying yourself is not the issue. Tagging your own face, unlocking your own phone — you consented. The legal question arises when you extract a faceprint from someone else who didn't. And the person whose consent matters is the one in the photo, not the person who took it.

An example that makes it click

How to do it

1. Identify the jurisdiction first — it decides everything. Illinois BIPA requires written consent and allows private lawsuits; Texas CUBI requires consent but only the attorney general enforces it; most US states have no biometric statute.
2. Separate the photo from the faceprint. Storing or posting an image is usually unregulated; extracting a biometric template from it is the act these laws target.
3. Check whose face it is. Identifying yourself is not the issue — the legal question arises when you extract a faceprint from someone who didn't consent.
4. If you're building anything that runs face recognition on other people, get written consent, publish a retention and destruction schedule, and don't scrape — Clearview's model produced a $51.75M settlement and a nationwide sales ban.
5. Under GDPR-style regimes, treat biometrics as special-category data requiring an explicit legal basis; consent standards are generally stricter than most US states.
6. Consult a licensed attorney before deploying face recognition. This page is general information, the law varies by state and country, and BIPA in particular carries per-violation statutory damages.

Key facts

• There is no comprehensive US federal biometric privacy law; requirements depend on state law, and most states have no biometric statute at all.
• Illinois BIPA requires companies that collect, capture, or obtain an Illinois resident's biometric identifier — including a faceprint — to first notify the individual and obtain written consent.
• BIPA's distinguishing feature is a private right of action allowing individuals to sue directly; Texas's CUBI statute (Tex. Bus. & Com. Code Chapter 503) requires consent but is enforceable only by the attorney general.
• A federal judge approved a $51.75 million Clearview AI class action settlement on March 20, 2025 — the largest biometric privacy resolution to date — over faceprints built from billions of scraped internet images.
• The FTC banned Rite Aid from using facial recognition for surveillance for five years, announced December 19, 2023, after finding the system falsely flagged consumers as shoplifters and was deployed disproportionately in neighborhoods with large Black, Latino, and Asian communities; some customers were wrongly detained or publicly accused.
• The FTC's Rite Aid order requires notifying consumers when their biometric information is enrolled in a database, deleting biometric information, implementing a data security program, and providing annual CEO certifications — showing federal consumer-protection authority can reach face recognition even absent a federal biometric statute.
• The regulated act is extraction of a biometric template from a face, not possession or publication of the photograph itself.
• Under GDPR-style regimes, biometric data used to identify a person is special-category data requiring an explicit legal basis, generally a stricter standard than most US states impose.

What authoritative sources say

People also ask

Related questions