Is face search legal in the United States?

In the United States, face search is regulated in layers rather than by one law. State biometric statutes decide whether a company may turn a photo into a searchable face template and what consent it needs first. The Fair Credit Reporting Act decides what a search result may be used for when money, housing or a job is at stake. Criminal and civil laws on stalking, harassment and intimate-image abuse decide what a searcher may do with what they find. This page walks through each layer as it stood in November 2026 and extends the overview on is face search legal.

Is there a federal law on face search?

No. Congress has not passed a biometric privacy statute, and bills to create one have not advanced. Three federal laws still touch face search indirectly. The Fair Credit Reporting Act (FCRA) restricts how any information, including a face match, may be used in employment, tenant, credit and insurance decisions. Section 5 of the FTC Act lets the Federal Trade Commission act against unfair or deceptive practices, which it has used against data brokers and against companies that misdescribe how they handle biometrics. The Take It Down Act of 2025 gives victims of non-consensual intimate images, including AI-generated ones, a federal removal right against platforms. Everything else is state law, and the strictest state laws apply to the engine rather than to the person searching.

What does Illinois BIPA require?

The Biometric Information Privacy Act (740 ILCS 14), passed in 2008, is the law behind almost every US face-recognition lawsuit. It applies to private entities, not government, and it treats a scan of face geometry as a biometric identifier.

• Informed written consent before collection. A company must tell the person what is collected, why and for how long, and obtain a written release before it captures or buys a biometric identifier. Since the 2024 amendment, an electronic signature counts as a written release.
• A public retention schedule and destruction of the data when the purpose is met or within three years of the last interaction, whichever comes first.
• No selling or profiting from biometric identifiers, and no disclosure without consent except in narrow cases.
• A private right of action. An aggrieved person may sue for $1,000 per negligent violation or $5,000 per intentional or reckless one, plus attorney fees. Senate Bill 2979, signed on 2 August 2024, limits recovery to one award per person for the collection and disclosure duties, however many times the face was scanned. Whether that cap applies to cases filed before the amendment is being litigated.
• Reach. Courts have applied BIPA to companies outside Illinois that collect Illinois residents' biometrics, which is how Clearview AI ended up in a Chicago federal court.

For a person running a search, BIPA creates no duty: you are not collecting anyone's biometric identifier by uploading a photo to a service. For a person whose face was indexed, BIPA is the strongest remedy in the country if you are an Illinois resident and the engine built a template of you without consent.

How do Texas, Washington, California and Colorado differ?

What do the other state privacy laws say about biometric data?

About twenty states had comprehensive consumer privacy laws in force by 2026, with Indiana, Kentucky and Rhode Island joining in January 2026 and Alabama and Oklahoma due in 2027. Nearly all of them list biometric data processed to identify a person as sensitive data that needs opt-in consent before processing. California and Iowa are the main exceptions, using an opt-out model for sensitive data instead. None of these laws gives individuals a right to sue over biometrics; enforcement is by the state attorney general. The practical effect for a face search engine is that consent, or a lawful exemption, is needed before it indexes residents of most of these states, and residents can demand access to and deletion of their data.

Can a face search result be used for hiring, renting or lending?

Not lawfully, unless the provider is operating as a consumer reporting agency under the FCRA, which no face search engine does. The FTC settled with the people-search site Spokeo for $800,000 in June 2012 for marketing its profiles to recruiters and HR departments without FCRA safeguards, and it made clear that a disclaimer saying the service is not a consumer report does not change the analysis if the company knows the reports are used for employment screening. The same logic applies to tenant screening, credit and insurance. This is why FaceSearch, like every reputable engine, prohibits those uses in its acceptable use rules. If you are deciding whether to rent to, hire or lend to someone, use a licensed screening service that complies with the FCRA, not a face search.

What happened in the Clearview AI cases?

Clearview AI scraped billions of photos from the public web to build a face-recognition product for police, and it became the test case for US biometric law. In May 2022 the company settled a BIPA lawsuit brought by the ACLU in Illinois state court: it is permanently banned, nationwide, from making its faceprint database available to most private businesses, and it was barred from selling to Illinois state and local agencies, including police, for five years. A separate federal class action under BIPA produced a novel settlement in which class members would receive a 23 percent equity stake in the company, valued at about $51.75 million, because Clearview could not fund a cash payout. A district judge approved it in March 2025, but on 13 July 2026 the Seventh Circuit vacated the approval because subclasses that received more were not separately represented, and sent the case back. When this page was reviewed there was no approved settlement, and class members could not yet claim anything.

What laws protect you from deepfakes and intimate-image abuse?

• Take It Down Act. Signed in May 2025. Its criminal provisions took effect at once; its platform duties became enforceable on 19 May 2026. A covered platform must remove a non-consensual intimate image, real or AI-generated, and known identical copies within 48 hours of a valid request. The FTC enforces it, with civil penalties of up to $53,088 per violation, and runs a complaint portal for platforms that ignore requests.
• State deepfake laws. Ballotpedia counted 46 states with laws on sexually explicit deepfakes as of January 2026. Several, including California, set shorter removal deadlines than the federal 48 hours.
• Stalking and harassment. Every state criminalises stalking, and most now cover online conduct. Using a face search to locate, follow or contact someone against their wishes is the conduct these laws target, whatever tool was used.
• Doxxing. A growing number of states penalise publishing someone's personal information with intent to harass or cause harm. Posting what a face search found about a private person can fall under these laws.

If someone has shared intimate images of you, the intimate image abuse page lists the removal routes in order, and the photo takedown page covers ordinary photos.

Searching your own face versus someone else's

How does this apply to FaceSearch?

FaceSearch indexes only publicly accessible pages and shows where a similar face appears; it holds no names and makes no identity claims, so a result is a lead for you to confirm, never a consumer report. Our acceptable use rules prohibit employment, tenant, credit and insurance uses, searches for anyone under 18, and any tracking or exposure of a person, and we close accounts that break them. The photo you upload is stripped of metadata, used only for your search and never used to build a face database, which keeps your own biometric data out of any index. US residents, like everyone else, can be excluded from results for free by email through remove my photos. Where the law is still moving, as it is in the Clearview litigation, we update this page.