Facial recognition is everywhere, but there aren't any laws that limit what businesses can do with that data. At least not yet.
On Thursday, two US senators introduced proposed legislation called the Commercial Facial Recognition Privacy Act, which would prevent businesses from collecting facial recognition data on customers without their knowledge or using it without their consent.
That would mean businesses couldn't use facial recognition to identify and track customers that walk into their stores unless the customers have given permission.
Facial recognition is powerful technology that lets businesses and government agencies identify people based on an image alone. It's primarily used by police, but businesses are increasingly adopting the technology.
If passed, the new bill would be the first federal law on facial recognition and privacy. The bipartisan proposal was introduced by Sens. Roy Blunt, a Republican from Missouri, and Brian Schatz, a Democrat from Hawaii.
"Our faces are our identities. They're personal. So the responsibility is on companies to ask people for their permission before they track and analyze their faces," Schatz said in a statement.
The call for regulation on facial recognition doesn't come only from lawmakers; major Silicon Valley players have also warned about the technology's potential to uproot your privacy. That includes Brad Smith, the president of Microsoft, who supports the bill.
In a statement, Smith said facial recognition "needs to be regulated to protect against acts of bias and discrimination, preserve consumer privacy, and uphold our basic democratic freedoms."
Privacy advocates have also spoken out against facial recognition use, which has the potential to log a person's location and shopping habits and track that info over time.
Businesses also often share and sell that biometric data with one another, as there're no limits on what they can do with it.
The bill would also require companies to conduct mandatory testing to address accuracy and bias issues.
If passed, it would prevent companies from selling facial recognition data to third parties without consent.
"Consumers are increasingly concerned about how their data is being collected and used, including data collected through facial recognition technology," Blunt said in a statement.
Though this is the first proposed federal legislation looking to take on commercial facial recognition, there are state laws similar to Schatz and Blunt's bill.
Illinois has a Biometric Information Privacy Act, which prevents businesses from collecting data like your fingerprints and facial recognition info without your consent.
Until a federal law passes on facial recognition, businesses can continue using the technology and selling that data.
"We deserve clear rules and limits on how our faces can be analyzed, identified and tracked over time," Chris Calabrese, the vice president for policy at the Center for Democracy & Technology, said in a statement.
You can read the full bill here: