Data Protection, Cybersecurity, and AI

World Cup Games Put Facial Recognition Technology Regulations on Display for Municipalities in MA

Facial recognition technology (FRT) is a powerful tool that scans human faces and matches them to facial features to identify individuals. While FRT preceded the advent of generative artificial intelligence (“GenAI”), using GenAI allows FRT to quickly sift through hundreds of hours of footage or photographs, processing information rapidly. As the New York Times reports, this dataset can include anything between a few thousand to billions of images. This year, FRT’s utility for crowd flow, ticketing, VIP access, and security screening at large events is on full display in Massachusetts. Boston Stadium, one of the 2026 FIFA World Cup stadiums, is using drone and counter-drone systems with FRT embedded.

While a few Massachusetts municipalities have banned governmental use of FRT, the technology remains largely unregulated by local governments statewide. For municipalities, understanding FRT is increasingly important—not only because of its growing use at public events and facilities, but also because of new potential requirements for civildeployments of FRT that may affect municipal operations and vendor relationships. Municipalities must also understand the discrimination and privacy concerns posed by FRT. The 2026 games at Boston Stadium provide a timely opportunity for Massachusetts municipal leaders to consider how FRT may intersect with their own operations—from public safety and permitting to vendor procurement.

Why Facial Recognition is Used in Large-Crowd Events

In recent years, sports and entertainment venues have used FRT for a variety of reasons, and with varying degrees of transparency. Some venues use FRT to assist with guest entry, sometimes partnering with CLEAR, a FRT company with devices most commonly found in airports. Others use it more surreptitiously, including for general security or specific exclusion of unwanted guests. Some professional sports leagues or organizations have also explored using FRT to help detect and control gambling on sports. It is unclear whether FIFA, which has strict oversight of venue security and logistics, has sanctioned the use of facial recognition software, but its security measures have certainly included innovative digital technology such as robotic patrol dogs.

The widespread adoption of FRT in the 2026 World Cup Games underscores its integration into daily life. For municipalities deploying or considering these systems, and for the individuals whose data is captured, the legal questions surrounding facial recognition are only beginning. Moreover, a new Massachusetts law potentially taking effect in January 2027 would change the FRT landscape dramatically.

The Massachusetts Data Privacy Act (MDPA)

The MDPA, which passed the House in June 2026 and is now in conference committee, would classify “face scans” as protected sensitive data requiring affirmative consent before it can be collected, sold, or shared. While Massachusetts already has strong protections against the use of FRT by law enforcement, if enacted, the MDPA would be the first comprehensive regulation of FRT in civil and commercial contexts.

At the federal level, there is currently no comprehensive statute that expressly regulates the use of FRT by government agencies or private entities, leaving a significant regulatory gap despite growing deployment of FRT in law enforcement, airports, and commercial settings.  While Congress has considered legislation—including the Facial Recognition and Biometric Technology Moratorium Act—it has failed to carry any through to enactment, prompting states to fill the void with their own frameworks. At the state level, Massachusetts has strong protections against the use of FRT in law enforcement contexts. However, the MDPA is the most comprehensive regulation of FRT in civil contexts to date.

The cornerstone legal requirement of the MDPA as currently drafted is that individuals must give affirmative consent before their face scans are collected, sold or shared. Realistically, acquiring and noting affirmative consent is a challenge. The legislation would require the consent be “freely given, specific, informed and unambiguous,” and accessible to many groups of people. Critically, consent to face scans cannot be inferred from inaction or continued use of the service incorporating FRT.

Municipalities Would Be Exempt from the MDPA, Vendors Would Not

Under the current version of the bill, municipal governments acting in their own governmental capacity would be exempt from MDPA requirements (though this is subject to change based on conference committee discussions as the House and Senate are still reconciling the legislation). But the exemption would affect private actors, and therefore regulate municipalities indirectly. This is a critical distinction for municipalities to understand: while the municipality itself may be exempt, the vendors it works with would not be.

Under the bill as drafted, vendors or private entities that a municipality contracts with would be subject to the law’s affirmative consent requirement. Even if the MDPA does not impose a direct obligation on a municipality, a municipality should consider potential indirect exposure. Consider, for example, a location-based application that collects residents’ geolocation data for parking and transit fees, or a security vendor that uses FRT at a municipal facility. Such applications and services would not fall within the MDPA’s governmental exception and would therefore require affirmative consent from individuals. Municipalities should be aware that even if their own data collection is exempt, partnering with non-compliant vendors could expose the municipality to reputational risk and vendor disputes.

To protect themselves and their residents, municipalities considering the use of FRT should not assume they can rely solely on a government exemption. Instead, if the MDPA passes, municipalities would need to create relationships with private vendors that properly articulate responsibilities and ensure compliance.

Discrimination and Privacy Considerations for Municipalities

In addition to the affirmative consent requirement of the MDPA, municipalities must also be aware of the discrimination and privacy concerns posed by FRT. Algorithms embedded in FRT have been found to perform less accurately on people of color, women, and younger individuals. As the Center on Privacy and Technology writes, when used in law enforcement, false positives in FRT can lead to the wrongful detainment or arrest of innocent people. According to the U.S. Government Accountability Office, the use of FRT can erode expectations of privacy and deter the public from freely exercising their rights to peaceful assembly. Municipalities can combat these concerns by being transparent about the FRT they use, collaborating with companies that prioritize equity in algorithmic decision-making, and ensuring opportunities for community dialogue around the use of the technology.

For Massachusetts municipalities, the 2026 FIFA World Cup games at Boston Stadium may ultimately serve as more than a global sporting event—they may become a real-world test of existing federal and Massachusetts privacy laws. As Massachusetts continues to consider privacy legislation and lawmakers grapple with the appropriate limits on FRT, municipalities should monitor developments and begin thinking now about how they would prepare for the MDPA’s requirements if the bill passes.

Key Considerations for Massachusetts Municipalities

1. Understand indirect liability municipalities may face through their private vendors . If passed in its current form, the MDPA exempts municipalities acting in their governmental capacity, but this exemption does not extend to private vendors. Municipalities should review current and planned FRT deployments to identify which activities may involve non-exempt parties.
2. Mitigate risk through contract obligations. For any vendor that collects biometric data, including face scans, municipalities should ensure contracts address MDPA compliance, specify data handling and consent obligations, and include appropriate indemnification and liability provisions.
3. Consider discrimination and privacy implications. Before deploying FRT, municipalities should evaluate the technology’s accuracy across demographic groups and consider whether its use aligns with the municipality’s commitment to equitable service delivery.
4. Stay informed and seek legal counsel. The legal landscape for FRT and biometric data is evolving rapidly. Municipalities should monitor developments as the MDPA moves through the legislative process and consult with counsel to understand how pending and future requirements may affect their operations.