Facial Recognition Cameras at Work: What Michigan Businesses Need to Know in 2026

A Grand Rapids manufacturer installed facial recognition cameras at the loading dock last fall. Six weeks later, an employee threatened a lawsuit. The company hadn't published a privacy notice. They hadn't asked for consent. They didn't have a retention policy. And the cameras were also pointed at the breakroom doorway.

The technology wasn't the problem. The deployment was.

Facial recognition cameras are one of the fastest-growing physical security categories for small and mid-sized businesses in West Michigan — and one of the easiest ways to land in legal trouble if you skip the planning. Here's what facial recognition actually does in 2026, where Michigan privacy law currently stands, and how to deploy these systems the right way.

What Facial Recognition Cameras Actually Do

Today's business-grade facial recognition cameras combine three capabilities most owners conflate:

• Detection — the camera notices that a face is present (this is normal AI camera behavior and not legally controversial)
• Identification — the camera matches that face to a known person in an enrolled database
• Verification — the camera confirms a specific person is who their badge or credential claims they are

Identification and verification are the legally sensitive functions. Detection by itself is essentially smart motion analytics — useful, low-risk, and already standard on most modern business cameras.

A typical 2026 deployment for a 50-employee Michigan office combines facial recognition at one or two doors (usually as a backup or step-up to a badge or mobile credential), AI video analytics across the rest of the cameras, and integration with your access control platform so unlock events are tied to a person, not just a card.

When configured well, the system removes the most common security gap in SMB offices: badges left at desks, tailgating, and the "I forgot my fob again" call to IT three times a week.

Where Michigan Privacy Law Stands in 2026

Michigan does not yet have a dedicated biometric privacy law on the books — but the gap is narrowing fast, and you should not assume "no specific law" means "no risk."

Three things matter for businesses operating in Michigan today:

1. There is no Michigan equivalent to Illinois' BIPA — yet. Illinois' Biometric Information Privacy Act has driven settlements in the hundreds of millions of dollars. Senate Bill 359, introduced in mid-2025, would bring a similar framework to Michigan by defining biometric data — including facial geometry — and requiring informed consent before collection. As of May 2026, the bill has not been enacted, but momentum is real. Source: Michigan Public Radio coverage of state biometric efforts.

2. Existing Michigan surveillance law still applies. MCL 750.539d already prohibits recording in places with a reasonable expectation of privacy — bathrooms, locker rooms, lactation rooms, and similar spaces. Facial recognition layered on top of cameras in those areas is a felony exposure, not a civil one.

3. Federal and contract obligations may already require consent. If you serve healthcare, financial, or defense clients, your contracts likely require disclosure of biometric processing. HIPAA's Privacy Rule treats facial templates of patients as PHI. CMMC L2 controls expect documented consent and access policies. Cyber insurance applications increasingly ask whether biometric data is collected and how it is protected.

The practical takeaway: even without a Michigan BIPA, a careful, documented deployment is non-negotiable in 2026.

The 4 Places You Absolutely Cannot Put One

Whether or not Michigan passes a biometric law this year, these placements are already legally and ethically off-limits:

• Bathrooms, locker rooms, and lactation rooms — flat prohibition under Michigan surveillance law
• Anywhere employees change clothes or receive medical care
• Pointed into a neighbor's property or a public sidewalk where you don't control access — this is where most lawsuits start
• Without signage — Michigan law and basic professionalism require that anyone subject to facial recognition be put on notice before they walk into the area

Get any of these wrong and the strongest camera system in the world becomes a liability, not a control.

How to Deploy Facial Recognition the Right Way

Here's the checklist Evolv Technology Solutions uses with Grand Rapids businesses deploying facial recognition for the first time. Working through this before you buy hardware saves five-figure mistakes later.

1. Define the Business Purpose in Writing

Document why you need facial recognition specifically — not generic "security." Common defensible purposes: securing a server room, protecting controlled inventory, enforcing access to a regulated lab, reducing tailgating at a single main entry. Vague purposes ("we just want to know who's here") will not hold up under a privacy challenge.

2. Limit Scope to the Smallest Useful Footprint

The cameras and the recognition function should cover only the area required for the documented purpose. A single perimeter door with facial recognition plus standard cameras everywhere else is a far stronger legal posture than facial recognition on every camera in the building.

3. Publish a Biometric Privacy Notice

Even without a Michigan law requiring it, publish — and post at the entrance — a plain-English notice explaining: what data is collected, why, how long it's kept, who has access, how to request deletion, and what employees can do if they object. This single document neutralizes most claims before they start.

4. Get Written, Opt-In Employee Consent

Employees should sign a biometric consent acknowledgment as part of onboarding (and existing employees should sign one before the system goes live). Tie it into your employee handbook. If you're a Michigan employer with union employees or covered contracts, your HR or legal counsel should review the language.

5. Lock Down Data Retention and Access

Facial templates should be encrypted at rest, stored on a system with role-based access and MFA, and automatically deleted within a defined window — typically 30–90 days for transient access logs, longer only where a documented legal or safety reason requires it. Vendor systems vary widely on this — vet the retention controls before you sign.

6. Integrate with Your Broader Compliance Program

Your facial recognition deployment is now part of your overall security and compliance posture. It should be reflected in your incident response plan, your annual security audit, your cyber insurance application, and — for regulated firms — your HIPAA, IRS Pub 4557, or NAIC WISP compliance documentation. If it isn't, you have a gap.

When Facial Recognition Is the Wrong Tool

Honest answer: a lot of the time.

If your problem is tailgating, mobile credentials and a real door access control system solve it with a fraction of the legal exposure. If your problem is theft, AI video analytics without facial identification often gives you everything you need. If your problem is visitor management, a tablet-based visitor system with photo capture (not identification) is usually the right answer.

Facial recognition shines when the access decision itself needs a step-up factor — a server room, an executive area, a controlled-substance cabinet, a manufacturing line with controlled tooling. For everything else, simpler systems are cheaper, faster to deploy, and far less risky.

A good vCIO or vCISO will push back if a vendor is selling you facial recognition for a problem that doesn't need it.

Frequently Asked Questions

Is facial recognition legal for businesses in Michigan in 2026? Yes — Michigan currently has no statute specifically banning private-sector facial recognition. However, employers and businesses must still comply with general Michigan surveillance law (MCL 750.539d), federal regulations like HIPAA where applicable, and any contractual requirements. Evolv Technology Solutions recommends businesses deploy facial recognition only with documented purpose, signage, and opt-in employee consent — that posture protects you even if Michigan passes biometric legislation later.

Do I need employee consent to use facial recognition at work? Michigan does not currently require it by statute, but written opt-in consent is best practice and is already required under many cyber insurance policies, healthcare contracts, and CMMC obligations. If a Michigan biometric privacy law passes, retroactive consent will be far harder to collect — so building consent into your deployment now is the safer move.

How long can I keep facial recognition data? There is no specific Michigan retention limit yet, but the strongest defensible policy in 2026 is to keep templates only as long as the documented business purpose requires, with automatic deletion. For most office access use cases, 30–90 days is reasonable. Longer retention should be tied to a written justification.

What's the difference between facial recognition and AI cameras? AI cameras can detect events (motion, loitering, weapons, license plates) without identifying specific people. Facial recognition specifically matches a face to a known identity. AI analytics carries dramatically less legal risk and solves most SMB use cases. Evolv Technology Solutions typically recommends starting with AI analytics and layering facial recognition only where the business case demands it.

Will my cyber insurance cover a biometric privacy lawsuit? Often no — many policies now exclude statutory biometric privacy claims, and several major carriers added exclusions in 2024 and 2025 in response to BIPA litigation. Review your policy with your broker before deploying facial recognition. This is one of the most common gaps Michigan SMBs discover at renewal.

Get It Right the First Time

Facial recognition is a powerful tool when it solves the right problem with the right safeguards. It's a fast track to a lawsuit when it doesn't.

If you're considering facial recognition cameras for a West Michigan office, warehouse, or healthcare facility, Evolv Technology Solutions will walk through your use case, your compliance obligations, and your options before you spend a dollar on hardware. We're a Grand Rapids–based managed IT and cybersecurity firm that helps Michigan SMBs make calm, well-documented technology decisions — especially the ones that involve your employees, your customers, and the law.

Book a 30-minute discovery call and we'll tell you honestly whether facial recognition is the right answer for your business.