The Federal Government Uses Facial Recognition. But There Are No Rules Yet.

Federal law enforcement agencies are actively using facial recognition technology to help solve crimes. That finding comes from a government audit published in March 2024 — and it is the latest in a series of reports asking the same question: how did this powerful tool get deployed so fast without clear rules to guide it.

The Government Accountability Office, or GAO, is the federal agency that audits how other government agencies work. They have been studying facial recognition use for three years now, and each time they issue a new report, the picture is the same. Federal police are using this technology. But there is no federal law that says how they should use it or what safeguards they must put in place.

How Facial Recognition Actually Works in Law Enforcement

When a law enforcement officer uses facial recognition, they submit a photograph to a system — often from surveillance footage or a photo from social media — and the system searches databases to find people who might match that face. The system returns possible candidates, and a human investigator then reviews the matches to decide whether to pursue a lead.

Here is what matters: this tool is not meant to be proof on its own. It is a starting point. A human has to do the real investigative work.

The technology has real limitations. Different systems catch faces accurately at different rates, depending on the person's age, skin tone, and other characteristics. A match generated from a grainy security camera frame is far less reliable than a match from a clean mugshot taken under controlled conditions. Add to this that some police agencies use commercial systems that pull images from public sources like driver's licenses or social media — a sourcing practice that raises new questions about whether those images were collected fairly.

The Split Between Local and Federal Approaches

Something interesting has happened. At the local level — in cities and counties — there has been a push in the opposite direction. San Francisco became the first major U.S. city to ban government agencies from using facial recognition in 2019. Within three years, at least 16 other municipalities had enacted similar bans, according to the Electronic Frontier Foundation.

Meanwhile, federal law enforcement agencies have kept expanding their use. This creates an unusual situation: a small city might be prohibited from using facial recognition, while FBI agents in that same city are actively using it.

There is a deeper pattern here worth understanding. Throughout history, when government agencies acquire new surveillance tools — wiretaps, cell phone tracking, surveillance cameras — the technology gets used first. The rules come later, if they come at all. Sometimes it takes years or decades. Facial recognition appears to be following that same path.

What Safeguards Actually Exist

Right now, there is no federal law governing how law enforcement agencies can use facial recognition. That is the core problem.

The GAO's series of reports has asked agencies what they are doing to keep this power in check. Do they have written policies? Do they log and review every search? Do they train their analysts? Do they assess privacy risks? The answer from the 2021 audit of 42 federal agencies was mixed. Some agencies, like U.S. Immigration and Customs Enforcement, had done privacy assessments. Others had not.

This matters because a system without proper logging and training is a system where mistakes can happen and no one will necessarily catch them. If an agent searches millions of faces and gets a false match, but there is no record of that search, how would anyone ever know the system was wrong.

Without rules at the federal level, the GAO can only make recommendations to agencies. Recommendations are helpful, but they are not legally binding. An agency can read a GAO report and choose to ignore it.

The Bigger Problem

Think of facial recognition as a powerful tool that works best when it is not operating alone. It needs backup safeguards: clear documentation of who used it and why, records of searches, training for the people using it, and regular audits to catch problems.

Right now, the federal government is using facial recognition without all of those protections in place across all agencies. That creates room for error — and error in an identification system can have serious consequences for the people involved in an investigation.

One more point: this situation is not unique to facial recognition. The federal government is still figuring out how to regulate artificial intelligence broadly. The Biden administration released AI guidelines in 2023, and the National Institute of Standards and Technology published a risk management framework. But whether police agencies are actually following these guidelines when they deploy facial recognition is not clear from public records.

Where This Stands Now

As of March 2024, facial recognition is confirmed as an active tool in federal law enforcement. It is working. It is generating investigative leads that are helping to solve crimes.

But the rules for when, how, and how often federal agents can use this tool do not exist yet. There is no federal law saying what privacy protections must be in place. There is no federal standard for which databases can be searched. There is no requirement for training or logging.

The GAO keeps auditing to try to fill that gap. They issue a report every twelve to eighteen months. But audits happen after the fact. They tell you what agencies did, not what they are allowed to do going forward. As long as there is no statutory law in place, that is the only oversight mechanism available.

The challenge for lawmakers will be straightforward once they decide to act: create rules that let law enforcement use this useful investigative tool while ensuring the people affected by searches have actual protections in place.