Commercial Facial Recognition Privacy Act of 2019
This bill prohibits entities from collecting, processing, storing, or controlling facial recognition data unless such entities (1) provide documentation that explains the capabilities and limitations of facial-recognition technology, and (2) obtain explicit affirmative consent from end users to use such technology after providing notice about the reasonably foreseeable uses of the collected facial-recognition data. Facial-recognition data includes attributes or features of the face that permit facial-recognition technology to uniquely and consistently identify a specific individual.
Controllers of facial recognition data also are prohibited from (1) using such data to discriminate against end users, (2) using such data for a purpose that is not reasonably foreseeable to the end user, (3) sharing such data with a third party without the additional affirmative consent of the end user, or (4) conditioning the use of a product on an end user providing affirmative consent.