Your camera records faces. The moment it reads them to identify, it stops being a camera — it becomes a regulated biometric system.
On February 2, 2025, Article 5 of the EU AI Act (Reg. EU 2024/1689) took effect. It bans real-time remote biometric identification in publicly accessible spaces for law-enforcement purposes, with only narrow judicial exceptions [1]. Penalties for breaching the prohibitions run to €35 million or 7% of global annual turnover, whichever is higher [1].
( and the EU is only one of four fronts that matter )
Illinois has been litigating biometrics for 17 years under BIPA (2008). Statutory damages are $1,000 USD per negligent violation and up to $5,000 USD per intentional one, with a private right of action [2]. Walmart paid $10M USD in 2021 for palm scans of 22,000 employees without written consent [4]. Clearview AI settled for $51.75M USD in 2025. Illinois courts saw more than 107 BIPA class actions filed in 2025 alone [4]. Texas enforces CUBI through the Attorney General only, with civil penalties up to $25,000 USD per violation [5].
Mexico’s new LFPDPPP (DOF March 20, 2025) classifies biometric data as sensitive personal data [3]. The regulator, after the 2024-2025 dissolution of INAI, is now the Secretaría Anticorrupción y Buen Gobierno (SABG). On July 12, 2026, the SABG fined Mexico’s Football Federation MXN 42,849,095 (~$2.3M USD) for two Fan ID violations: failing to disclose facial photos as sensitive data, and using a checkbox instead of express written consent [8].
Brazil’s LGPD also treats biometric data as sensitive; ANPD opened a Tomada de Subsídios in June 2025 to study whether to regulate biometrics and facial recognition specifically [7].
The practical lesson: if your camera stack includes face detection + identification — not just recording — you are already processing biometric data. That triggers written express consent, a published retention policy, and a Data Protection Impact Assessment if you operate in the EU. Every deployment I review for tv4agent, the question is no longer “how many megapixels?” — it’s “what happens when your vendor pushes a firmware update that turns facial recognition on by default?”
P.D. Does your current privacy notice mention that your cameras may capture biometric data? If the answer is “no” or “I’m not sure,” today is a good day to fix it — before a regulator or a customer does it for you.
📰 Source: EU AI Act (Reg. EU 2024/1689) Art. 5; BIPA (740 ILCS 14/1); Texas CUBI; LFPDPPP Mexico 2025; LGPD + ANPD Radar 2024; People of Internet Jul-2026.
Sources
[1] EU AI Act — Article 5: Prohibited AI Practices (entry into force 2 February 2025) — https://artificialintelligenceact.eu/article/5 [2] MC Law — Biometric Data Privacy Laws and their Impact on AI Development (2026) — https://mclaw.io/blog/biometric-data-privacy-laws-and-their-impact-on-ai-development [3] Cámara de Diputados — Ley Federal de Protección de Datos Personales en Posesión de los Particulares (LFPDPPP, DOF 20-mar-2025) — https://www.diputados.gob.mx/LeyesBiblio/pdf/LFPDPPP.pdf [4] Digital Security Insights — The Credential You Can’t Change (BIPA settlements overview) — https://digitalsecurityinsights.com/briefings/the-credential-you-cant-change [5] ComplyFine — Biometric Privacy Laws by State: Illinois, Texas, Washington, Colorado (2025) — https://complyfine.com/us-privacy-laws/biometric-privacy-laws-by-state [6] ANPD Brasil — Radar Tecnológico: Biometria e reconhecimento facial (jun 2024) — https://www.gov.br/anpd/pt-br/centrais-de-conteudo/documentos-tecnicos-orientativos/radar-tecnologico-biometria-anpd-1.pdf [7] ANPD — Tomada de Subsídios sobre Tratamento de Dados Biométricos (jun 2025) — https://www.gov.br/anpd/pt-br/assuntos/noticias/anpd-abre-tomada-de-subsidios-sobre-tratamento-de-dados-biometricos [8] People of Internet — SABG fines FMF MXN 42.8M over FAN ID biometric consent (jul 2026) — https://peopleofinternet.com/articles/mexico-fines-football-federation-2-3m-over-fan-id-consent-fa