Since June 2025, ICE agents have used the agency's Mobile Fortify facial recognition app more than 100,000 times in field operations, according to a February 2026 WIRED investigation cited in federal court filings. The app works by pointing a smartphone camera at a person in a public space and searching the Automated Biometric Identification System (IDENT)—the U.S. government's largest biometric repository, drawing on passports, visas, and state driver's license records. Non-matching photographs—images taken of people who turn out not to be the suspect—are retained for 15 years.
That would be significant for a tool used exclusively by federal agents. But Mobile Fortify is no longer exclusively federal. A companion app called Mobile Identify is already being distributed to state and local law enforcement through 287(g) federal-state partnership agreements. According to a June 2026 analysis by Biometric Update, ICE plans to extend the infrastructure to more than 1,000 local police departments nationwide. Once complete, biometric searches of a database holding records on millions of Americans will be routine patrol-car technology—operating under no consistent national legal framework.
The Case for Biometric Law Enforcement Tools
Advocates for biometric identification in law enforcement make a case that deserves serious engagement before it is dismissed. Modern facial recognition systems have improved substantially, with NIST benchmarks showing top commercial systems achieving identification accuracy above 99 percent in controlled conditions. The technology has helped identify kidnapping suspects, locate missing children, and verify identities at ports of entry. Used proportionately and with proper judicial oversight, biometric identification can be a legitimate law enforcement instrument.
The question is not whether the government may ever use facial recognition. It is whether current deployment meets any standard of proportionate governance. On that question, the documented record is troubling.
A Privacy Architecture Dismantled
Records reviewed by WIRED revealed that DHS dismantled centralized privacy reviews before deploying Mobile Fortify, and that the app was rolled out without a formal privacy impact assessment—a baseline procedural requirement that has existed in federal data governance since the E-Government Act of 2002. Rather than tightening that gap, the Homeland Security Appropriations Act signed on April 30, 2026 widened it. Section 207 of the law prohibits using border security funds for non-autonomous surveillance systems, effectively mandating procurement of AI-driven hardware. The same law allocates $340.8 million for DHS intelligence and fusion center operations—the infrastructure that aggregates biometric data across federal, state, and local agencies—without including any warrant requirement, accuracy standard, or mandatory audit mechanism.
Documented operational failures underscore the stakes. Agents used Mobile Fortify on legal observers and protesters in Minneapolis and Chicago—people engaged in First Amendment-protected activity. In Florida, officers were found to have incorrectly claimed that a biometric match from Mobile Fortify established probable cause for arrest, resulting in a wrongful detention and mandatory departmental retraining. WIRED's investigation further found that the app does not reliably "verify" identities as claimed—it surfaces possible matches, not confirmed ones, a distinction agencies have struggled to communicate to officers using it in the field.
States Fill a Gap They Shouldn't Have to Fill
In the absence of federal action, states have moved. Texas's Responsible Artificial Intelligence Governance Act (TRAIGA), effective January 1, 2026, prohibits state and local governmental entities from deploying AI systems to uniquely identify individuals from public images without consent. Virginia revised its facial recognition law, effective July 1, 2026, establishing an affirmative authorization standard: local law enforcement cannot deploy facial recognition unless the use is expressly authorized by statute—a structural shift from "permitted unless prohibited" to its inverse.
Illinois's Biometric Information Privacy Act, the oldest state biometric law, generated more than 107 new class action lawsuits in 2025. The Clearview AI BIPA settlement resulted in a permanent nationwide ban on the company selling faceprint access to private entities, with a five-year sales ban on Illinois law enforcement specifically. These enforcement outcomes demonstrate that statutory frameworks work.
But the patchwork has a structural ceiling: state laws cannot bind federal agencies. ICE can deploy Mobile Fortify in states with strict biometric privacy laws without being subject to them. The third-party doctrine—the legal principle that data shared with third parties, including state DMVs, is not constitutionally protected—means the federal government can access state-collected biometric data without triggering Fourth Amendment warrant requirements. This loophole makes state-level protections structurally incomplete without federal action.
A Warrant Requirement Is the Right Federal Floor
Representatives Thomas Massie and Lauren Boebert introduced H.R. 8470, the Surveillance Accountability Act, on April 23, 2026. The bill would require federal and local government agencies to obtain a warrant before conducting facial recognition searches, collecting biometric data, or purchasing location information from commercial data brokers. Crucially, it would close the third-party doctrine loophole by imposing a statutory warrant requirement regardless of how the underlying data was originally collected. H.R. 8470 currently sits in the House Judiciary Committee.
The FTC has applied its consumer protection authority in a more limited but instructive register. In January 2025, it voted 5-0 to finalize a consent order against IntelliVision Technologies, prohibiting the company from claiming its facial recognition software was free of gender or racial bias without competent, reliable testing to back that claim. The enforcement model—require substantiated accuracy claims, penalize misleading representations—is exactly right for the commercial side of the industry.
The proportionate federal architecture is not complicated: require judicial warrants for biometric identification searches; prohibit real-time mass scanning of public spaces without particularized suspicion; mandate accuracy testing and retention limits for every federal biometric database; require auditable disclosure of deployment patterns. Virginia's affirmative authorization model offers a useful template.
The governance gap is not a product of regulatory complexity—it is a choice. Mobile Fortify has been deployed 100,000 times in the field, is retaining non-matching biometric data for 15 years, and is being integrated into local police departments while Congress has not enacted a single statute requiring a warrant to query the database it draws on. That window closes a little further with every new 287(g) agreement signed.