Appearance Recognition Compliance Guide
BluSKY Person Reader Deployments Across the U.S.
BluSKY’s appearance recognition is safe, private, and opt-in. Still, some cities and states have adopted rules that limit or condition how face recognition can be used. This page summarizes those rules so that customers and integrators know where BluSKY’s approach is accepted, where conditions apply, and where recognition must be disabled.
Quick Reference Matrix
|
Jurisdiction |
Status for Private Facilities |
Key Rules / Conditions |
BluSKY Compliance Guidance |
|
Portland, OR (City) |
Prohibited in places of public accommodation |
City ban on private-sector face recognition in retail, lobbies, public spaces |
Disable appearance recognition in public-facing areas; rely on card/phone/QR/PIN; proof-of-presence photos OK |
|
San Francisco, CA (City) |
Allowed |
Ban applies only to government use |
No restrictions on private buildings |
|
Boston, MA (City) |
Allowed |
Government ban only |
Safe to use in private facilities |
|
Minneapolis, MN (City) |
Allowed |
Government ban only |
Safe to use in private facilities |
|
Portland, ME (City) |
Allowed |
Government ban only |
Safe to use in private facilities |
|
New York City, NY (City) |
Allowed with conditions |
Retail/food/entertainment: must post biometric notice, no sale/trade of data. Residential smart access: explicit consent, data minimization, retention limits |
Post signage, follow NYC TDPA consent & retention rules. BluSKY opt-in/opt-out matches requirements |
|
Baltimore, MD (City) |
Allowed |
Private ban expired Dec 2022 |
No current restrictions |
|
Illinois (State) |
Allowed with conditions |
BIPA: written consent, retention schedule, delete after purpose or 3 years, private right of action |
Capture explicit opt-in consent; publish retention/deletion policy; leverage BluSKY’s opt-in/opt-out |
|
Texas (State) |
Allowed with conditions |
CUBI: notify + obtain consent before capture; confidentiality + destruction |
Inform and obtain consent before enrollment; configure automatic deletion policies |
|
Washington State |
Allowed with conditions |
RCW 19.375: notice, consent or opt-out mechanism, disclosure & retention limits |
BluSKY’s consent/opt-out aligns; ensure disclosure of retention/deletion |
|
Maryland (State) |
Allowed with conditions |
Employers must get consent before using face recognition in interviews (HB1202) |
Restriction applies to hiring only, not access control |
|
Maine (State) |
Allowed |
State ban applies only to government |
No restrictions on private facilities |
Key Takeaways
Only one “hard stop”: Portland, OR. Face recognition cannot be used in private-sector places of public accommodation.
- Government-only bans (e.g., SF, Boston, Minneapolis, Portland ME) do not affect private deployments.
- Consent-focused states (IL, TX, WA, NY): BluSKY’s on-reader opt-in/opt-out and “no biometric measurements stored” approach is well aligned. Just ensure signage, consent logs, and retention schedules are in place.
- Proof-of-presence photos are not biometric templates. They are event logs and generally outside the scope of these bans, but best practice is to disclose their use in local privacy policies.
BluSKY Recommended Practice
- Enable on-reader opt-in/opt-out everywhere – satisfies consent requirements and empowers individuals.
- Deploy signage where required (e.g., NYC commercial spaces).
- Publish data retention & deletion policies – follow stricter state rules (IL/TX/WA) as your baseline.
- Disable appearance recognition in public-facing areas in Portland, OR.
✅ Bottom line: With BluSKY, compliance is straightforward: only Portland, OR requires disabling appearance recognition; elsewhere, BluSKY’s opt-in design and dynamic, non-biometric storage approach put you ahead of legal requirements.