The reanimation of the pseudosciences of physiognomy and phrenology at scale through computer vision and machine learning is a matter of urgent concern. This Article—which contributes to critical data studies, consumer protection law, biometric privacy law, and antidiscrimination law—endeavors to conceptualize and problematize physiognomic artificial intelligence (“AI”) and offer policy recommendations for state and federal lawmakers to forestall its proliferation. Physiognomic AI, as this Article contends, is the practice of using computer software and related systems to infer or create hierarchies of an individual’s body composition, protected class status, perceived character, capabilities, and future social outcomes based on their physical or behavioral characteristics. Physiognomic and phrenological logics are intrinsic to the technical mechanism of computer vision applied to humans. This Article observes how computer vision is a central vector for physiognomic AI technologies and unpacks how computer vision reanimates physiognomy in conception, form, and practice and the dangers this trend presents for civil liberties. This Article thus argues for legislative action to forestall and roll back the proliferation of physiognomic AI. To that end, it considers a potential menu of safeguards and limitations to significantly limit the deployment of physiognomic AI systems, which hopefully can be used to strengthen local, state, and federal legislation. This Article foregrounds its policy discussion by proposing the abolition of physiognomic AI. From there, it posits regimes of U.S. consumer protection law, biometric privacy law, and civil rights law as vehicles for rejecting physiognomy’s digital renaissance in AI. Specifically, it contends that physiognomic AI should be categorically rejected as oppressive and unjust. Second, it argues that lawmakers should declare physiognomic AI unfair and deceptive per se. Third, it proposes that lawmakers should enact or expand biometric privacy laws to prohibit physiognomic AI. Fourth, it recommends that lawmakers should prohibit physiognomic AI in places of public accommodation. It also observes the paucity of procedural and managerial regimes of fairness, accountability, and transparency in ad- dressing physiognomic AI and attend to potential counterarguments in support of physiognomic AI.

A new biometrics privacy ordinance has taken effect across New York City, putting new limits on what businesses can do with the biometric data they collect on their customers. From Friday, businesses that collect biometric information -- most commonly in the form of facial recognition and fingerprints -- are required to conspicuously post notices and signs to customers at their doors explaining how their data will be collected. The ordinance applies to a wide range of businesses -- retailers, stores, restaurants and theaters, to name a few -- which are also barred from selling, sharing or otherwise profiting from the biometric information that they collect. The move will give New Yorkers -- and its millions of visitors each year -- greater protections over how their biometric data is collected and used, while also serving to dissuade businesses from using technology that critics say is discriminatory and often doesn't work. Businesses can face stiff penalties for violating the law, but can escape fines if they fix the violation quickly.

McDonald's is being sued for recording customers' biometric data at its new artificially intelligent-powered drive-thru windows without getting their consent. In court filings, Shannon Carpenter, a customer at a McDonald's in Lombard, Illinois, claims the system violates Illinois' Biometric Information Privacy Act, or BIPA, by not getting his approval before using voice-recognition technology to take his order. BIPA requires companies to inform customers their biometric information--including voiceprints, facial features, fingerprints and other unique physiological features--is being collected. Illinois is only one of a handful of states with biometric privacy laws, but they are considered the most stringent. A McDonald's customer in Chicago is suing the burger chain, claiming it records and stores users' voiceprints without their written consent, in violation of Illinois strict biometric privacy law In 2020, the fast-food chain began testing out using voice-recognition software in lieu of human servers at 10 locations in and around Chicago.

Facebook in January agreed to a historic $550 million settlement over its face-identifying technology. But now, the federal judge overseeing the case is refusing the accept the deal. Facebook in January agreed to a historic $550 million settlement over its face-identifying technology. But now, the federal judge overseeing the case is refusing the accept the deal. Next week, lawyers for Facebook will be back in court, trying to convince a judge they should be allowed to settle a class action suit that accuses the company of violating users' privacy.