3 Years After NYC Law, Erie County Issues First NY Biometric Ban

For privacy and regulatory attorneys, Erie County's move is not an outlier but a preview of cascading local biometric rules. A 2021 New York City ordinance requiring disclosure forced Wegmans to reveal facial recognition use; unanswered questions then led one county to leap from transparency to an outright ban, showing how quickly local privacy law can escalate for clients operating across multiple jurisdictions.

Erie County, New York, has become the first county in the state—and one of the first major counties anywhere in the United States—to ban private-sector biometric collection outright. The ban did not emerge from a single high-profile data breach or federal mandate. It grew out of a local accountability chain: a 2021 New York City ordinance requiring businesses to disclose biometric data practices led Wegmans, earlier in 2026, to reveal that it was using facial recognition and storing customers' biometric data at some New York City stores. When the Buffalo-based Investigative Post then asked whether the grocer used the same technology in its Western New York locations, the company did not respond. Erie County Legislator Lawrence Dupre, who represents Buffalo's predominantly Black East Side, introduced legislation on May 26; by August 2026, the county had enacted an outright ban. The sequence illustrates how a disclosure law originally intended to create transparency became the foundation for a far stricter prohibition.

“

Erie County Legislator Lawrence Dupre, who represents Buffalo's predominantly Black East Side, introduced legislation on May 26; by August 2026, the county had enacted an outright ban.

The policy escalation is significant because it reverses the usual path of privacy regulation. New York City's biometric law took three years to pass and evolved from a proposal requiring businesses to disclose biometric collection into one of the nation's most restrictive local laws governing commercial facial recognition. Erie County's move is more aggressive still: rather than adding notice, consent, or data-deletion obligations, it simply bans private-sector biometric collection. That turns a compliance conversation into an operational prohibition, forcing retailers and other private entities to decide whether to disable in-store biometric systems, segment their operations by jurisdiction, or abandon facial analysis tools altogether.

The trigger point was corporate silence. Under the 2021 New York City ordinance, Wegmans disclosed that it analyzed faces, eyes, and voices in some stores. That disclosure initially drew little attention beyond the city. But when Investigative Post sought to clarify whether the company also deployed the technology in Western New York, the lack of a direct answer became the story. Dupre said the silence drove his initial response. For local lawmakers, unanswered questions about biometric databases transformed a routine notice into a governance failure. It is a cautionary example for companies: once disclosure is required, refusing to explain scope can produce stricter rules than a direct answer might have avoided.

The civil rights and equity dimension also matters. Dupre represents neighborhoods where, as he described it, surveillance has become the norm. Residents are already watched and profiled, and the prospect of corporate biometric databases operating without their knowledge raised deeper concerns about whose data is collected and why. That framing suggests the new ban is not only a privacy rule but a response to concentrated surveillance in historically overpoliced communities. Biometric restrictions may therefore become intertwined with broader debates about local police surveillance, commercial data brokerage, and algorithmic discrimination.