Half of all American adults are already in some sort of facial recognition network accessible to law enforcement, according to a comprehensive new study.

Conducted over a year and relying in part on Freedom of Information and public record requests to 106 law enforcement agencies, the study, conducted by Georgetown Law’s Center on Privacy and Technology, found American police use of facial recognition technology is a scattered, hodgepodge network of laws and regulations.

More Inside The Government Centers Where The FBI Shares Intel With Police

“Looking at the sum total of what we found, there have been no laws that comprehensively regulate face recognition technology, and there’s really no case law either,” Clare Garvie, an associate at the CPT, told Vocativ. “So we find ourselves having to rely on the agencies that are using that technology to rein it in. But what we found is that not every system — by a long shot — has a use policy.”

That so many American adults are in at least one facial recognition database is largely due to the fact that at least 26 states, and likely more, share their Department of Motor Vehicles databases with the FBI, state police, or other law enforcement agencies, the study found. Compounded with that, police often have access to mugshot databases. Garvie’s study found that most law enforcement agencies don’t purge such records, even if the arrested suspect is found not guilty, unless a court orders it. The sole known exception is the Michigan State Police, which does expunge photos after a set amount of time.

The report also found that more than one in four law enforcement agencies have access to some sort of facial recognition capability, meaning either that the agency possesses such software or it has some sort of partnership with a police intelligence agency that does. The West Virginia Fusion Center, for example, a Charleston-based coalition of federal and local law enforcement, possesses software that matches individuals in video footage with a database of still photographs. Not only does it share information with the FBI, West Virginia State Police, and city and county departments, it may grant access to 77 other fusion centers across the country.

“These systems are used on law-abiding Americans without their knowledge or consent in most cases,” Garvie said.