--- title: "United States — Algorithmic, Biometric & Surveillance Governance | Data Protection Monitor" canonical: https://dataprotection.gi/jurisdictions/united-states/algorithmic-biometric-and-surveillance-governance/ source_html: /jurisdictions/united-states/algorithmic-biometric-and-surveillance-governance/index.html description: "United States — Algorithmic, Biometric & Surveillance Governance: algorithmic_biometric_and_surveillance_governance Algorithmic, Biometric & Surveillance Governance 6 sub-modules 5 claims Amber ▾ # Substantive biometric/ADM governance exists but" generated_at: 2026-10-25T04:46:50Z content_sha256: 875ce321463f126a1a271168766ca4136752474e35c886386c1a435ec7830e6b generator: "fe-fleet/md-twin@1.0" --- # United States — Algorithmic, Biometric & Surveillance Governance | Data Protection Monitor ### D8Algorithmic, Biometric & Surveillance Governance6 sub-modules5 claimsAmber▾# Substantive biometric/ADM governance exists but is state-fragmented; no general federal biometric or profiling statute exists, and state-surveillance carve-outs for national security are addressed only indirectly via the DPF redress mechanism. Primary framework Illinois Biometric Information Privacy Act (BIPA); CCPA ADMT regulations (Cal. Code Regs. tit. 11); COPPA Rule (as amended 2025) Supervisory authority [California Privacy Protection Agency (CalPrivacy)](https://cppa.ca.gov) Traffic-light rationale — Amber Substantive biometric/ADM governance exists but is state-fragmented; no general federal biometric or profiling statute exists, and state-surveillance carve-outs for national security are addressed only indirectly via the DPF redress mechanism. #### Sub-modules (6) #### Profiling RestrictionsAmber California's ADMT regulations, applicable since 1 January 2026, introduce profiling-adjacent oversight requirements for automated decision-making technology. Claims (1): - California CCPA regulations for automated decision-making technology, risk assessments, and cybersecurity audits became applicable on 1 January 2026. #### Automated Decision Making TransparencyAmber The same 2026 CCPA ADMT rules impose transparency and risk-assessment duties tied to automated decision-making technology. Claims (1): - California CCPA regulations for automated decision-making technology, risk assessments, and cybersecurity audits became applicable on 1 January 2026. #### Ai Risk AssessmentsAmber Illinois SB 315 (2026, awaiting enactment) would require covered AI entities to conduct pre-deployment risk assessments, mandatory governance, and annual third-party audits — a first among US state AI statutes. Claims (1): - Illinois Senate Bill 315, approved by the Illinois General Assembly and awaiting enactment, would require covered AI entities to conduct pre-deployment risk assessments and undergo mandatory annual third-party audits. #### Biometric RegimeAmber Illinois's BIPA (2008) is the first comprehensive US biometric privacy statute, includes a private right of action, and has generated landmark litigation including a $650M Facebook settlement and a Illinois Supreme Court ruling (Cothron v. White Castle) permitting per-scan damages accrual. Claims (2): - Illinois's BIPA, in effect since 2008, prohibits collection of biometric identifiers or information absent specified conditions and includes a private right of action that produced a $650 million Facebook settlement in March 2021. - The Illinois Supreme Court's Cothron v. White Castle decision held that separate BIPA claims accrue for every biometric scan, exposing White Castle to potential damages of up to $17 billion under the current ruling. #### Genetic DataAmber PADFAA separately designates genetic data as a category of sensitive data subject to foreign-adversary transfer restrictions. Claims (1): - PADFAA's definition of personally identifiable sensitive data includes health, financial, genetic, biometric, geolocation, and sexual-behavior information as well as account/device credentials and government-issued identifiers. #### State Surveillance CarveoutsAmber The EU-US DPF includes binding safeguards limiting US intelligence-service access to EU data to what is necessary and proportionate, with a Data Protection Review Court able to order deletion of unlawfully collected data — the principal check on surveillance carve-outs relevant to this transfer corridor. Claims (1): - The EU-US Data Privacy Framework introduces binding safeguards limiting access to EU data by US intelligence services to what is necessary and proportionate and establishes a Data Protection Review Court able to order deletion of unlawfully collected data. Category narrative 83 words Algorithmic/biometric governance is emerging fastest at the state level: California's ADMT regulations became applicable 1 January 2026, Illinois's BIPA remains the most litigated biometric statute nationally (with a 2021 $650M Facebook settlement and pending multibillion-dollar exposure in Cothron v. White Castle), and a new Illinois frontier-AI transparency bill (SB 315) introduces mandatory annual third-party audits. Federally, the 2025 COPPA amendments expanded 'personal information' to include biometric identifiers, and the EU-US DPF's redress mechanism addresses (EU-facing) intelligence-access safeguards as a partial surveillance carve-out check. no periodic updates on record for this sub-brief Evidence 5 Sources and claims (5) - Probable[IAPP](https://iapp.org/news/a/notable-ai-privacy-bills-hit-finish-line-in-illinois-connecticut-and-new-york) — Illinois Senate Bill 315, approved by the Illinois General Assembly and awaiting enactment, would require covered AI entities to conduct pre-deployment risk assessments and undergo mandatory annual third-party audits.observed 2026-07-29 - Probable[IAPP](https://iapp.org/news/a/the-rise-of-us-state-level-bipa-illinois-leads-others-catching-up) — Illinois's BIPA, in effect since 2008, prohibits collection of biometric identifiers or information absent specified conditions and includes a private right of action that produced a $650 million Facebook settlement in March 2021.observed 2026-07-29 - Probable[IAPP](https://iapp.org/news/a/the-rise-of-us-state-level-bipa-illinois-leads-others-catching-up) — The Illinois Supreme Court's Cothron v. White Castle decision held that separate BIPA claims accrue for every biometric scan, exposing White Castle to potential damages of up to $17 billion under the current ruling.observed 2026-07-29 - Probable[IAPP](https://iapp.org/news/a/european-commission-adopts-eu-u-s-adequacy-decision) — The EU-US Data Privacy Framework introduces binding safeguards limiting access to EU data by US intelligence services to what is necessary and proportionate and establishes a Data Protection Review Court able to order deletion of unlawfully collected data.observed 2026-07-29 - Probable[FTC](https://www.ftc.gov/system/files/ftc_gov/pdf/statement-of-chair-lina-m-khan-re-coppa-amendments-1-16-2025.pdf) — The 2025 COPPA amendments clarify that the Rule applies to children's biometric identifiers usable for automated or semi-automated recognition of an individual.observed 2026-07-29