H.R. 4695 — Facial Recognition Act of 2025

This section amends the Driver's Privacy Protection Act (DPPA, 18 U.S.C. 2721 et seq.), which restricts state departments of motor vehicles (DMVs) from disclosing personal and highly restricted personal information (i.e., name, address, photograph) from motor vehicle records except for permissible uses such as law enforcement functions, by (1) prohibiting DMV disclosure of department-operated facial recognition systems except as provided in new subsection (f); (2) limiting disclosure of individuals' photographs under permissible use (b)(1) for law enforcement facial recognition to a case-by-case basis without bulk transfers to law enforcement agencies or third-party entities; and (3) adding subsection (f) to authorize DMV access only pursuant to court orders issued under this section. The section further restricts investigative or law enforcement use of facial recognition with reference photo databases (e.g., arrest photo databases) to court orders (issued upon prosecutorial application showing probable cause of a serious violent felony under 18 U.S.C. 3559(c)(2)(F), prior failed investigative steps, and other specifics, valid for no more than 7 days), emergencies, or exceptions; requires custodians of arrest photo databases, beginning 180 days after enactment and every 6 months thereafter, to remove photos of minors, those released without charge, with dropped or dismissed charges, or acquitted (applicable only to facial recognition, not other uses such as fingerprinting); mandates agency compliance procedures; and directs DMVs to post public notices (multilingual as needed) on facial recognition access in criminal investigations.

This section prohibits investigative or law enforcement officers from using facial recognition technology in specified circumstances, including (1) creating records on individuals exercising constitutional rights such as free assembly, association, and speech; (2) relying on actual or perceived race, ethnicity, national origin, religion, disability, gender, gender identity, or sexual orientation to select persons for such use, absent trustworthy information linking persons with those characteristics to a specific criminal incident or scheme in a particular area and time frame; and (3) enforcing U.S. immigration laws or sharing data for that purpose. The section further prohibits using or requesting facial recognition (1) with images from body cameras, dashboard cameras, or aircraft/drone cameras; (2) for face surveillance; (3) as the sole basis for probable cause in searches, arrests, or other actions, requiring careful examination of results for potential inaccuracies; or (4) with databases containing illegitimately obtained information.

This section requires a law enforcement agency whose investigative or law enforcement officers use facial recognition to log its use to the extent necessary to comply with the public reporting and audit requirements of sections 104 and 105.

This section establishes annual reporting requirements, beginning the first January after enactment, for state and federal judges and prosecutors on court orders authorizing facial recognition use with reference photo databases and on related investigative searches. State judges report to a designated state agency on applications, approvals (including pursuant to sections 101(b) or 102(c)), offenses, applicants, and databases searched; state prosecutors report to the state agency on searches conducted, offenses investigated, arrests and convictions (disaggregated by race, ethnicity, gender, and age), suppression motions, and databases used (including photos removed); the state agency forwards judiciary data within 90 days to the Bureau of Justice Assistance and prosecutor data to the Administrative Office of the United States Courts (AOUSC). Federal judges and prosecutors report the same information directly to the AOUSC. (Thus, the AOUSC Director releases a public report in June each year—including all collected data—posts it online, and transmits it to Congress.) The section further directs the Bureau of Justice Assistance and AOUSC Directors to issue rules on report content and form for this section and sections 105 and 106.

This section establishes annual audits of facial recognition use by federal, state, and local law enforcement agencies to prevent misuse and ensure compliance with restrictions in sections 101, 102, and 103 of the Act. For federal agencies, the Government Accountability Office (GAO) conducts the audit based on agency-submitted data—including a summary of violations and procedures for removing arrest photos from databases—and requires suspension of use with public notice if violations are found until corrected. For state and local agencies, an independent state agency (designated by the state's chief executive) conducts the audit based on similar data, reports findings (including violations and removal procedures) to the Director of the Administrative Office of the U.S. Courts for public release and online posting, and imposes the same suspension and notice requirements. Data must be disaggregated by race, ethnicity, gender, and age when feasible.

This section prohibits investigative and law enforcement officers from using facial recognition systems or derived information unless the systems undergo (1) annual benchmark testing by the National Institute of Standards and Technology (NIST) for overall accuracy and variance by race, ethnicity, gender, or age; (2) pre-use independent testing for new systems on the same metrics; and (3) annual operational testing by an independent entity, per NIST protocols, also assessing human reviewer impacts. It further prohibits use of systems failing to meet NIST-determined sufficient accuracy thresholds (including demographic variance); requires test summary reports under subsections (a) and (d) to be submitted to the Director of the Administrative Office of the U.S. Courts for public internet posting; directs the DOJ Civil Rights Division Assistant Attorney General to promulgate a rule defining sufficient accuracy levels after consulting experts in civil rights, civil liberties, racial justice, data privacy, bioethics, law enforcement, public defense, forensic science, and related fields; and takes effect 18 months after enactment.

This section establishes enforcement mechanisms for violations of the Act's facial recognition restrictions. Specifically, it (1) suppresses in any proceeding evidence derived from unlawful facial recognition use or emergency use without subsequent court order; (2) requires law enforcement agencies to initiate disciplinary proceedings against officers for intentional violations raising serious questions; (3) authorizes affected persons to bring civil actions against officers or agencies for equitable relief, damages (the greater of profits or $50,000 per violation), punitive damages, and reasonable attorney's fees, subject to a two-year statute of limitations and good faith defenses based on warrants, subpoenas, statutory authority, or emergency determinations under section 101; and (4) authorizes civil actions against law enforcement agencies for disparate impact from facial recognition use based on race, ethnicity, gender, or age.

This section requires a law enforcement agency using facial recognition technology to identify an arrested individual to provide the individual, at a minimum, with (1) notice of the name of the agency that operated the facial recognition system and the name of any database used for identification; and (2) copies of the authorizing order, accuracy or bias reports required under this Act, each probe image used, any modifications to the probe image, the candidate list in rank order, and any other related police documentation. The section further requires that such information be provided in an appropriate language if the individual is not fluent or literate in English.

This section directs the National Institute of Standards and Technology (NIST) to (1) develop best practices for law enforcement agencies to evaluate the accuracy and fairness of facial recognition systems; (2) develop and offer an ongoing benchmark test for law enforcement that evaluates actual algorithms on real-world probe images and database sizes and assesses bias by race, ethnicity, gender, or age; (3) develop an operational testing protocol for annual testing of system accuracy, human reviewer impacts, and demographic variations in accuracy; and (4) study and develop training standards for human operators of facial recognition results to ensure accuracy and prevent bias. The section authorizes appropriations of $5 million to NIST for each of FY2026 through FY2029.

This section clarifies that nothing in the Act preempts concurrent or more stringent federal, state, or local limitations on facial recognition technology or other privacy, civil rights, and civil liberties laws and rules. It further clarifies that nothing in the Act authorizes state or local governments to use facial recognition unless expressly and unambiguously authorized by state or local law.

This section requires each agency covered by this Act to establish and make publicly available on its website, not later than 90 days after enactment, a policy governing the agency's use of facial recognition systems to ensure investigative and law enforcement officer compliance with the Act's requirements.

This section abrogates state sovereign immunity under the Eleventh Amendment from suits in federal or state court for violations of this Act and makes available against a state the same remedies (at law or in equity) as against any other public or private entity.