Is Emotion Recognition Legal in the US?

This is not legal advice. It is a buyer's orientation to a fast-moving patchwork, written by a vendor in the category. US state law changes every legislative session and BIPA case law is actively contested. Take specific advice in every state you operate in, and treat any vendor claim — including ours — as something to verify rather than accept.

There is no federal law — so what governs?

The United States has no AI statute, no general federal privacy statute, and no prohibition on emotion recognition in any setting. What it has instead is four overlapping layers, and a buyer has to clear all four.

State biometric statutes govern the collection of facial and voice data — Illinois, Texas and Washington most prominently. State AI employment statutes govern its use in hiring and promotion, with Illinois, Colorado and California leading. City ordinances add their own layer, New York City most notably. And underneath all of it, federal anti-discrimination law — the ADA and Title VII — applies in every state regardless of what any privacy statute says.

The result is that American legality is geographic in a way it is not elsewhere. In the EU the question is which use case you are running. In the US it is which use case, in which state, for candidates located where. The same hiring funnel can be routine in Georgia and a class action in Illinois.

Illinois BIPA is the whole ballgame

If you read one thing about US exposure, read this section. The Biometric Information Privacy Act regulates biometric identifiers, which expressly include scans of face geometry, and it requires written notice, a statement of the specific purpose and retention period, and a signed written release before collection.

None of that is unusual. What is unusual is the enforcement mechanism. BIPA carries a private right of action with statutory damages — $1,000 per negligent violation and $5,000 per reckless or intentional one — and a claimant does not have to prove any actual harm. That combination is why BIPA has generated a sustained stream of class actions and nine-figure settlements while comparable statutes elsewhere have generated almost no litigation at all.

Illinois adds two further layers on top. The AI Video Interview Act has since 2019 required employers using AI analysis of recorded interviews to give notice, explain how the AI works and what characteristics it uses, obtain the applicant's consent, and delete recordings within 30 days of a request. And HB 3773, in force since 1 January 2026, makes the discriminatory use of AI in employment decisions a civil rights violation and attaches notice obligations to it. An emotion analysis tool used in Illinois hiring can breach all three at once.

The rest of the patchwork

Texas CUBI also requires informed consent before capturing a biometric identifier for a commercial purpose, but it is enforceable only by the Attorney General, with penalties up to $25,000 per violation. Same duty, radically different risk profile — no plaintiffs' bar. Texas also brought TRAIGA into force on 1 January 2026.

Colorado's SB 24-205, delayed to 30 June 2026, imposes a duty of reasonable care to protect against algorithmic discrimination on both developers and deployers of high-risk AI systems, which expressly include systems used in employment decisions, with notice and impact assessment obligations attached. New York City Local Law 144 requires an annual independent bias audit and published results before an automated employment decision tool may be used, plus candidate notice. California has finalised FEHA regulations covering automated decision systems in employment.

For a national employer, the practical consequence is that the strictest jurisdiction you touch sets your process. Running one compliant hiring funnel is cheaper than running fifty.

Use case by use case

The table grades how hard each deployment is to defend in the US rather than whether it is allowed, because none of them is prohibited. Assume Illinois is in scope unless you can prove no Illinois resident will ever be processed.

Compare this against the EU position and the difference is instructive. The EU prohibits the bottom three rows outright and leaves the top three almost unregulated. The US prohibits nothing and prices everything.

The ADA exposure nobody budgets for

American procurement treats this as a biometric privacy question and stops there. It is also a disability discrimination question, it is federal, and it applies in all fifty states whether or not any biometric statute does.

Emotion inference degrades unevenly across populations. Autistic candidates, stroke survivors, people with Bell's palsy or Parkinson's, and people whose expressive norms differ by culture are all liable to be read as disengaged, evasive or low-affect by systems trained on a narrower baseline.

Under the Americans with Disabilities Act, a selection procedure that screens out individuals with disabilities must be job-related and consistent with business necessity, employers carry reasonable accommodation obligations, and a tool that strays into inferring a medical or psychological condition raises the separate question of whether it constitutes a prohibited medical examination. Title VII disparate impact liability runs alongside. Critically, none of this is cured by consent — a signed BIPA release does nothing for an ADA claim.

Five questions to put to any US vendor in writing

1. Does your system collect or store a scan of face geometry as BIPA defines it — and if so, what indemnity do you carry for BIPA class actions?
2. What notice, purpose-and-retention statement and written release template do you provide, and has counsel reviewed them for BIPA?
3. What independent bias audit have you published, and does it satisfy NYC Local Law 144?
4. What adverse impact testing have you done across disability and race, and will you disclose enough for us to defend an ADA or Title VII claim?
5. Which states would you decline to support — and separately, would you support this deployment in the EU?

The first question is the one that reveals whether a vendor has US counsel. The indemnity half of it reveals whether they believe their own answer.

Where EchoDepth sits

EchoDepth reports observable delivery signals using the Facial Action Coding System — 44 Action Units calibrated across 14 cultural cohorts in 6 countries — together with vocal and language measures. It reports what the signals did and leaves interpretation to context-aware human review, rather than returning an emotion label. The calibration work is what we put behind the fourth question above.

We scope US deployments on the same lines as our EU and UK ones. Contact centre, investor and executive communication, market research and message testing are supported. We do not scope candidate-facing recruitment assessment or employee monitoring deployments in any jurisdiction, and we will say so at the first conversation rather than the last. Where a security or public-space application is proposed in a state with a biometric consent statute, we expect the client to take specific advice before we proceed.

Primary sources

Read the statutes rather than summaries of them. Illinois BIPA is 740 ILCS 14; the AI Video Interview Act is 820 ILCS 42; HB 3773 amends the Illinois Human Rights Act. Texas CUBI is Business and Commerce Code § 503.001. Colorado's is SB 24-205 as amended by SB 25B-004. NYC Local Law 144 and its DCWP rules govern bias audits. The EEOC has published guidance on the ADA and algorithmic decision-making tools. Where this page and a primary source disagree, the primary source is right.

Frequently Asked Questions