In November 2022, a lawyer went with her daughter’s Girl Scout troop to see the Christmas Spectacular at Radio City Music Hall. She never made it past the lobby. By her account, security told her the venue’s facial recognition system had picked her up. She was not a threat to anyone. Her law firm was in litigation with the company that owns the venue, and under that company’s policy, that was enough to keep her out.
Almost four years later, New York City is deciding what to do about it. Two bills in the City Council would sharply limit how businesses and landlords can use facial recognition and other biometric technology. Neither is law yet. But they now have support from the mayor and, according to press reports, a majority of the Council. If you run a store, a venue, an office building or an apartment building in this city, this is the time to understand them.
What the bills would do
Int 0213-2026, sponsored by Council Member Shahana Hanif, covers places of public accommodation: stores, restaurants, bars, gyms, hotels, arenas and similar businesses. It would bar them from using biometric recognition, such as face, fingerprint or voice matching, to identify or verify customers. It would also ban the sale of biometric data. People could enforce it themselves through private lawsuits.
Int 0428-2026, sponsored by Council Member Pierina Sanchez, covers residential buildings. It would bar owners of apartment buildings from using biometric recognition to identify their tenants or their tenants’ guests.
The Committee on Technology held a hearing on March 2. The bills are still in committee, and no vote has been scheduled. Earlier versions stalled in previous sessions. What is different this time is the politics: Mayor Mamdani backed the effort in August, and supporters held a rally outside Madison Square Garden the same month.
Two sides, one word
Supporters frame this as a privacy issue. A password can be changed after a breach; a face cannot. “You cannot cancel your face,” Council Member Hanif said at the March hearing. “No one should have to surrender their personal privacy in order to watch their favorite sports team,” said Samuel Levine, the city’s commissioner of consumer and worker protection.
The security industry frames it as a security issue. The Security Industry Association has warned that the bill, as drafted, “would be unlike any policy anywhere in the world as far as how restrictive it would be.” Its concern is the reach of the term “public accommodation.” Almost any business that serves the public could fall under it, and so could the back-office access control in a building that has a storefront on the ground floor.
Both sides are using the same words to describe two very different things. That is the most useful thing to understand about this debate.
Identification is not verification
Identification means a camera compares every face that walks through a door against a list. The people being scanned never enrolled and usually do not know it is happening. That is what happened at Radio City.
Verification means a person who chose to enroll, such as an employee or a resident, shows their face to a reader to open a door they are already allowed to open. It works like a key that cannot be lent, copied or lost.
The risk in identification is not the camera. It is the list: who is on it, why they are on it, and who decided. The list at Radio City had lawyers on it, not threats. That use had nothing to do with security, and it is a large part of why our whole industry is now facing a ban.
We install camera systems and visitor-management tools for clients, and some of them can match faces. Our view is simple. These tools should be used to keep people safe, with rules that the people being scanned can understand. A good law would draw a clear line between scanning the public and verifying people who chose to enroll. As drafted, Int 0213 treats both the same way when the person is a customer. That is the part to watch as the bills move through committee.
What to do now, before any vote
None of this is legal advice, and anyone running biometric systems should talk to counsel. But these steps make sense whatever the Council decides.
- Find out what your cameras can already do. Many modern camera and video platforms come with face search or face matching built in, and an installer may have turned it on. Ask your integrator for a written list of every analytic feature enabled on your system. You cannot follow a rule about a feature you do not know you have.
- Check the law that already exists. Since 2021, New York City has required retail stores, food and drink businesses and entertainment venues that collect biometric data from customers to post a clear sign at every customer entrance. The same law bans selling that data, and customers can sue for $500 to $5,000 per violation. If you are matching faces without the sign, you are exposed today, not after a vote.
- Keep a non-biometric way in. In residential buildings, every resident should be able to enter with a fob, a card or a key, without enrolling their face. The city’s Tenant Data Privacy Act already regulates smart-access systems, and Int 0428 would go further. Offering it now costs little and avoids a fight with residents later.
- Write down why each system exists. For every biometric tool, record what it is for, who is enrolled, who can see the data and how long it is kept. If the law changes, you will know exactly what to switch off and what is worth defending. If a lawsuit arrives, that record is your first line of defense.
- Do not let one tool carry your security. If your lobby depends on a face reader and a ban passes, your security posture disappears overnight. The basics still work: trained officers who know who belongs, a real visitor-management process, credential-based access control and live camera monitoring by people who know what they are looking at. Technology should make those layers stronger, not replace them.
The point
The question in front of New York is not whether cameras can recognize faces. They can. The question is who ends up on a list, why, and who gets to decide. Our industry would be in a stronger position today if it had answered that question before a lawyer was turned away from a Christmas show.
Whatever the Council decides, a building that can explain what each of its security tools does, and why, will adapt. A building that cannot will find out from a lawsuit. If you are not sure what your systems are doing right now, talk to us. We will start with the inventory.
Nelson Vergara is the founder of a New York-based executive and residential protection practice.
