Are there laws about personal privacy?
The patchwork in the United States
The United States does not have one comprehensive federal privacy law that covers all everyday personal data. Instead, protection comes from a mix of federal rules for specific sectors, such as health and children's data, plus state laws.
California has one of the best-known comprehensive state privacy laws, and many other states have passed their own versions in recent years. Illinois is a well-known example of a law that regulates biometric identifiers, including face geometry, and it has led to lawsuits against companies that collected facial data without proper notice and consent.
- No single federal privacy law covers all personal data
- Many states have comprehensive privacy laws with different rules
- Illinois has a strict biometric privacy law that covers face data
- Some rules apply only to certain industries or age groups
Europe, the UK and elsewhere
The EU's GDPR and the UK GDPR treat facial images as personal data, and biometric data used to identify someone receives extra protection under those rules. Canada, Brazil and many other countries also have national privacy laws, although their scope and enforcement differ.
Because a face swap app may process data in another country, you may need to check both the laws where you live and the laws where the company is based. Terms of service do not replace these laws, even when a company's policy is clear.
Common mistakes
- Assuming that a face swap that is legal in one place is legal everywhere.
- Believing privacy law only protects text and contact details, when a face image can be protected too.