Laws
Laws that govern face search, by jurisdiction
Biometric, data-protection and image-abuse laws by country and US state, with what each one changes for face search.
- Privacy Privacy Act 1988 Australia
- Cal. California Consumer Privacy Act of 2018, amended by the California Privacy Rights Act of 2020 United States, states
- S.C. Personal Information Protection and Electronic Documents Act Canada
- OJ Regulation (EU) 2024/1689, Artificial Intelligence Act European Union
- OJ Regulation (EU) 2022/2065, Digital Services Act European Union
- 15 Fair Credit Reporting Act United States, federal
- OJ Regulation (EU) 2016/679, General Data Protection Regulation European Union
- 740 Biometric Information Privacy Act United States, states
- Act Information Technology Act 2000, with the Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules 2021 India
- Act Digital Personal Data Protection Act, 2023 and Digital Personal Data Protection Rules, 2025 India
- S.Q. Act to modernize legislative provisions as regards the protection of personal information (Law 25), amending the Act respecting the protection of personal information in the private sector Canada
- Public Tools to Address Known Exploitation by Immobilizing Technological Deepfakes on Websites and Networks Act (TAKE IT DOWN Act) United States, federal
- Tex. Capture or Use of Biometric Identifier Act United States, states
- Retained UK General Data Protection Regulation and Data Protection Act 2018 United Kingdom
- Online Online Safety Act 2023; Sexual Offences Act 2003 sections 66A to 66F as amended United Kingdom
- RCW Biometric identifiers (RCW 19.375) and My Health My Data Act (RCW 19.373) United States, states
- No specific protection
- General data protection
- Biometric-specific rules
- Biometric rules, private enforcement
Source: Editorial assessment, see each entry
United States, federal
- Fair Credit Reporting Act How the US Fair Credit Reporting Act applies to face search: why engines disclaim consumer-report use, what a permissible purpose is, and employer duties. 15 U.S.C. sections 1681 to 1681x; Regulation V, 12 CFR part 1022 · in force
- Tools to Address Known Exploitation by Immobilizing Technological Deepfakes on Websites and Networks Act (TAKE IT DOWN Act) The US TAKE IT DOWN Act: a criminal offence for non-consensual intimate images and deepfakes, the 48-hour platform removal duty enforced by the FTC from May 2026. Public Law 119-12 (S. 146, 119th Congress); 47 U.S.C. 223 note and 15 U.S.C. 45 enforcement · in force
United States, states
- California Consumer Privacy Act of 2018, amended by the California Privacy Rights Act of 2020 California CCPA/CPRA: biometric data as sensitive personal information, the rights to know, delete and limit, CPPA and Attorney General enforcement, and face search. Cal. Civ. Code sections 1798.100 to 1798.199.100; regulations at 11 CCR 7000 et seq. · in force
- Biometric Information Privacy Act Illinois BIPA (740 ILCS 14): consent before collecting face geometry, a private right of action, $1,000 to $5,000 per violation, the 2024 amendment, and face search. 740 ILCS 14/1 to 14/99 (Public Act 95-994), amended by Public Act 103-769 · in force
- Capture or Use of Biometric Identifier Act Texas CUBI (Bus. & Com. Code 503.001): consent before capturing face geometry, Attorney General enforcement at $25,000 per violation, the Meta and Google deals. Tex. Bus. & Com. Code section 503.001 · in force
- Biometric identifiers (RCW 19.375) and My Health My Data Act (RCW 19.373) Washington's two biometric laws: RCW 19.375 (2017, Attorney General only) and the My Health My Data Act (2023, private right of action), and face search. RCW 19.375.010 to .900 (2017 c 299); RCW 19.373 (2023 c 191, HB 1155) · in force
European Union
- Regulation (EU) 2024/1689, Artificial Intelligence Act EU AI Act Article 5(1)(e): the ban on untargeted scraping of facial images for recognition databases, in force since February 2025, fines up to 7% of turnover. OJ L, 12 July 2024; Article 5(1)(e), Article 5(1)(f) to (h), Article 99 · partly in force
- Regulation (EU) 2022/2065, Digital Services Act The EU Digital Services Act: notice-and-action duties, statements of reasons, trusted flaggers, very large platform duties, fines up to 6%, and misused photos. OJ L 277, 27 October 2022, p. 1; Articles 6, 16, 17, 20, 22, 34, 35, 52, 74 · in force
- Regulation (EU) 2016/679, General Data Protection Regulation GDPR and face search: Article 9 biometric data, the household exemption, territorial reach under Article 3(2), fines up to 4%, and the Clearview and PimEyes cases. OJ L 119, 4 May 2016, p. 1; Articles 4(14), 9, 3(2), 17, 83 · in force
United Kingdom
- UK General Data Protection Regulation and Data Protection Act 2018 UK GDPR and the Data Protection Act 2018: biometric data as special category data, ICO fines up to 17.5 million pounds or 4%, Clearview, and the 2025 DUA Act. Retained Regulation (EU) 2016/679 as amended; Data Protection Act 2018 c. 12; Data (Use and Access) Act 2025 c. 18 · in force
- Online Safety Act 2023; Sexual Offences Act 2003 sections 66A to 66F as amended UK Online Safety Act 2023: Ofcom's platform duties, intimate image offences in force since January 2024, the 2026 deepfake creation offence, and misused photos. Online Safety Act 2023 c. 50; Data (Use and Access) Act 2025 c. 18 section 138 · in force
India
- Information Technology Act 2000, with the Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules 2021 India's IT Act 2000 and IT Rules 2021: Section 66E privacy offences, 24-hour removal of intimate and impersonating images, safe harbour, and the 2026 deepfake rules. Act 21 of 2000, as amended by Act 10 of 2009; G.S.R. 139(E) of 25 February 2021; amendments including G.S.R. 120(E) of 10 February 2026 · in force
- Digital Personal Data Protection Act, 2023 and Digital Personal Data Protection Rules, 2025 India's DPDP Act 2023 and Rules 2025: phased commencement to May 2027, consent and notice duties, the Data Protection Board, penalties up to 250 crore rupees. Act No. 22 of 2023; Rules notified by G.S.R. 846(E), November 2025 · partly in force
Canada
- Personal Information Protection and Electronic Documents Act Canada's PIPEDA and face search: consent for facial images, the 2021 Clearview findings, the provincial orders upheld on appeal, and Bill C-36 tabled in June 2026. S.C. 2000, c. 5 · in force
- Act to modernize legislative provisions as regards the protection of personal information (Law 25), amending the Act respecting the protection of personal information in the private sector Quebec Law 25: express consent for biometric identification, a 60-day database declaration to the CAI, penalties to CAD 25 million or 4 percent, and the Clearview or S.Q. 2021, c. 25; CQLR c. P-39.1; biometric provisions in the Act to establish a legal framework for information technology, CQLR c. C-1.1, sections 44 and 45 · in force