Illinois was the first state to regulate biometric data when it enacted the Biometric Information Privacy Act in 2008. Since then, only Texas, Washington and California have passed laws governing the collection and storage of biometrics.

While biometric-specific laws are a rarity in the U.S., the collection and sharing of such data is far from uncommon. From granting security clearances to board planes to unlocking a cellphone to send a text message, face scans, thumbprints and other biometrics are being leveraged by the public and private sector at an increasing rate.

Despite the lack of laws specifically governing such data, lawmakers aren't obtuse to the growing collection of sensitive data. Indeed, more states are adding biometrics to the list of data that, if breached, requires a company to inform state regulators and adhere to data breach notification requirements. 

Still, it's municipalities that have taken the lead in regulating biometrics in the U.S. In 2019, three municipalities and one state have banned the use of facial recognition technology by local government. Though the cities' locations differ, they provide a similar reasoning behind the prohibition: Facial recognition technology hasn't been perfected and can lead to dire consequences if breached.

California

On Oct. 8, California Gov. Gavin Newsom approved amendments prohibiting local law enforcement from using facial recognition technology for three years.

The law does allow an officer to use a mobile fingerprint scanning device to identify a person who doesn't have ID, but it prohibits law enforcement from using biometric surveillance systems or biometric surveillance body cameras. The law also authorizes a person to bring private action for "equitable or declaratory relief" against a law enforcement agency or officer who violates the ban.

Notably, the law repeals these new provisions on Jan. 1, 2023. The time limit was to give the state more time to revisit facial recognition technology if the tech improves, according to CNN.

"This is a proactive piece of legislation," said the bill's cosponsor Assemblyman Phil Ting. "We wanted to introduce legislation before it became a major issue."

San Francisco

But before California became the first state to ban the use of biometric surveillance by law enforcement, it was proceeded by San Francisco.

In May, San Francisco passed the first legislation in the U.S. to ban the use of facial recognition software by its local agencies.

The measure passed 8-1 and the amended ordinance noted, "The propensity for facial recognition technology to endanger civil rights and civil liberties substantially outweighs its purported benefits, and the technology will exacerbate racial injustice and threaten our ability to live free of continuous government monitoring."

Somerville, Massachusetts

Facial recognition apprehensions aren't only discussed in California, as noted by Somerville, Massachusetts, in June unanimously voting to ban its local government agencies from leveraging facial recognition technology.

Somerville City Councilor and the law's sponsor Ben Ewen-Campen noted residents of the city 30 minutes outside of Boston were concerned about their personal data in an unregulated market.

"A lot of people who live here work somewhere in the tech industry and have more familiarity with this technology than the general public might," Ewen-Campen said, according to The Boston Globe. "They know how powerful this technology is. They see how unregulated it is."

Oakland

Following Somerville, Oakland became the third city  to ban the use of facial recognition tools by its local government agencies.

Such facial recognition technology is flawed, said Oakland City President Rebecca Kaplan in a memo calling for a ban.

"The city of Oakland should reject the use of this flawed technology on the following basis: 1) systems rely on biased data sets with high levels of inaccuracy; 2) a lack of standards around the use and sharing of this technology; 3) the invasive nature of the technology; and 4) and the potential abuses of data by our government that could lead to persecution of minority groups."