Bernie Sanders and Jeff Merkley have a plan to protect you from facial recognition

New legislation would require that companies get your consent before taking your biometric data.

Sens. Jeff Merkley and Bernie Sanders are proposing more federal regulation for facial recognition technology. Among other limits, their newly announced National Biometric Information Privacy Act would require private companies and corporations to get written consent from people in order to collect their biometric data. Should companies violate the consumer protection in the law, regular citizens and state attorneys general could sue them.

Over the past few months, there’s been a national reckoning over facial recognition that’s centered on whether law enforcement should have access to this powerful technology. Major tech companies including IBM, Amazon, and Microsoft have now paused or scaled back facial recognition systems that are sold to police departments. Senators have even proposed legislation that would put a moratorium on its use by the federal government and discourage its use by law enforcement, which followed the news of the first known false arrest caused by police use of facial recognition.

The new bill is a sign that officials aren’t just concerned about government or law enforcement having access to this controversial, biometrics-based technology. It signals that the growing movement to regulate the technology will also take into account how private companies and corporations make use of facial recognition and the specific issues their use of the technology can spur.

Worry over private companies’ use of facial recognition has been growing steadily this year. In July, Reuters reported that the pharmacy chain Rite Aid had deployed facial recognition in 200 stores, often at locations in low-income and minority neighborhoods. There’s also concern over facial recognition that could be integrated into home security systems, like the ones sold by Amazon’s camera-doorbell company Ring, as well as lingering anxiety over the power of private companies like Clearview AI, which collected billions of photos without the consent of those pictured, and at one point had designs to provide this technology to private chains like Macy’s and Best Buy.

“We can’t let companies scoop up or profit from people’s faces and fingerprints without their consent,” said Sen. Jeff Merkley in a statement. “We have to fight against a ‘big brother’ surveillance state that eradicates our privacy and our control of our own information, be it a threat from the government or from private companies.”

A staffer familiar with the legislation said one purpose of the law is to increase consumer understanding of the pervasiveness of facial recognition, but they would not comment on on how this law would impact specific companies. They explained that the law is modeled after Illinois’s Biometric Information Privacy Act, a powerful piece of state legislation that has cost Facebook $650 million in fines over its facial recognition-enabled tagging, and likely keeps Google from making available a facial recognition feature available on Nest home security cameras in the state. The statute has also kept Clearview from operating in Illinois following a lawsuit filed under that state’s law.

That the Illinois law has already caused significant legal hurdles for existing providers of biometric technology is a sign that a national version of the same legislation likely won’t be well-received. After all, companies affected will have to secure their consent from consumers before collecting biometric information as well as let them know what information they already have on file. Companies will also be financially liable in any lawsuits linked to the new law. Taken together, these measures could drastically transform how facial recognition is sold and operated in the American private sector.

It’s not yet clear how the written consent requirement would play out for companies as varied as Clearview AI, Facebook, and Amazon, which use and deploy the technology in different ways. Importantly, the law notes that the written consent can’t be combined with an employment contract or “any other consent or permission-seeking instrument or function.”

The law isn’t about outlawing surveillance cameras or devices that take pictures of people’s faces. It’s specifically designed to target the software that’s used to extract biometric information, which is a specific, algorithmic process. Evan Greer, the deputy director of the digital rights group Fight for the Future, which supports the legislation, emphasizes that the stakes are higher when it comes to biometrics, which is data collected about your body.

“If your Social Security number leaks, you can get a new Social Security number. If your credit card number leaks, you can get a new credit card number,” Greer told Recode. “If a biometric scan of your face leaks, you can’t get a new face.”

Greer added that regulation like the new bill by Sanders and Merkley would discourage the rapid adoption of this technology.

Merkley has been concerned with the private sector’s use of biometric technology since at least February, when he discussed the topic in an interview with Recode. The Oregon senator also expressed concern over the data collected by companies like Clear, which aims to use biometrics to bring people back to public spaces amid the Covid-19 pandemic. Notably, Sanders has also been a critic of facial recognition; he was the first 2020 candidate to call for a complete ban on police use of facial recognition. He told Vox in December that “this technology is dangerous and under-regulated, and it represents an intrusion into the privacy rights of Americans.”

Previous Senate legislation proposed to regulate commercial facial recognition include the Commercial Facial Recognition Privacy Act, a bipartisan proposal that was put forward by Sen. Brian Schatz and Sen. Roy Blunt, and the Algorithmic Accountability Act, a law that would empower the Federal Trade Commission to study their algorithms for bias, neither of which has passed. But the movement to clamp down on facial recognition seems to be growing, and there’s increasing demand from activists for a full ban on the technology for any application.

“There’s a lot of businesses across the world that are harvesting and monetizing the biometrics, without us — the general public — really having a lot of knowledge about exactly what’s going on or consenting to the practice,” said India McKinney, the director of federal affairs of the Electronic Frontier Foundation, which also supports the legislation.

It’s unclear how much traction this newest proposal will receive, but the bill certainly sets a higher bar for companies selling facial recognition, a technology that remains broadly unregulated at the federal level. Still, the proposal is a clear indication that, as the move to rein in facial recognition continues, officials won’t just be worried about cops, but all the entities that can access this technology. While privacy advocates say that’s great news, companies selling facial recognition probably won’t feel the same.

Open Sourced is made possible by Omidyar Network. All Open Sourced content is editorially independent and produced by our journalists.

Support Vox’s explanatory journalism

Every day at Vox, we aim to answer your most important questions and provide you, and our audience around the world, with information that has the power to save lives. Our mission has never been more vital than it is in this moment: to empower you through understanding. Vox’s work is reaching more people than ever, but our distinctive brand of explanatory journalism takes resources — particularly during a pandemic and an economic downturn. Your financial contribution will not constitute a donation, but it will enable our staff to continue to offer free articles, videos, and podcasts at the quality and volume that this moment requires. Please consider making a contribution to Vox today.