If you’re already worried about the growth of the surveillance state, a new study may give you pause. Researchers from Georgetown Law’s Center on Privacy and Technology have found that half of Americans have photos in facial recognition networks used by law enforcement around the country—and many are likely unaware of it. The resulting report notes that the study is “the most comprehensive survey to date of law enforcement face recognition and the risks that it poses to privacy, civil liberties, and civil rights.”

Study authors Alvaro Bedoya, Jonathan Frankle and Clare Garvie queried more than 100 police departments across the nation over the course of a year to come to their conclusions. They found that more than 117 million adults—overwhelmingly law-abiding citizens of these United States—have pictures in these systems. Amassing such a large number of photos of American adults is a result of interagency collaboration. In addition to mugshot photos taken following arrests, “26 states (and potentially as many as 30) allow law enforcement to run or request searches against their databases of driver’s license and ID photos.” They also write that big-city police departments—Chicago, Dallas and Los Angeles among them—are looking into real-time recognition on live street surveillance cameras, which allow “police [to] continuously scan the faces of pedestrians walking by a street surveillance camera.”

A primary concern here is that the use of facial recognition efforts by law enforcement is largely unregulated, opening the door for potential misuse. There are justifiable concerns, rooted in historical precedent, that the latest form of surveillance state technology could be deployed to quell free speech, particularly for activists and others involved in civil rights protests and other actions. With no oversight, few U.S. police departments, including the FBI, have ever been audited to ensure proper database use.

The report points to a few examples of cases where database expansion is “out of control.” Perhaps unsurprisingly, Arizona’s notoriously racist, anti-immigrant, civil rights-violating Sheriff Joe Arpaio’s department came up:

No state has passed a law comprehensively regulating police face recognition. We are not aware of any agency that requires warrants for searches or limits them to serious crimes. This has consequences. The Maricopa County Sheriff [Arpaio]’s Office enrolled all of Honduras’ driver’s licenses and mug shots into its database. The Pinellas County Sheriff’s Office system runs 8,000 monthly searches on the faces of seven million Florida drivers—without requiring that officers have even a reasonable suspicion before running a search. The county public defender reports that the Sheriff’s Office has never disclosed the use of face recognition in Brady evidence.

They go on to note that of the 52 agencies that make use of facial recognition systems, only “the Ohio Bureau of Criminal Investigation… expressly prohibits its officers from using face recognition to track individuals engaging in political, religious, or other protected free speech.”

As with pretty much everything related to criminal justice, black folks will be hardest hit by any flaws in the system. “Face recognition may be least accurate for those it is most likely to affect: African Americans,” researchers write, based on the findings of a previous FBI study. That’s a real problem in a system where, on the most basic level, accuracy in physically identifying suspects is key. What’s more, study authors write, in general “[f]ace recognition is less accurate than fingerprinting, particularly when used in real-time or on large databases.” Nonetheless, only the San Francisco and Seattle police departments “conditioned purchase of the technology on accuracy tests or thresholds.”

There’s one last major issue with these systems, and it all comes down to a lack of transparency by America’s police departments:

Ohio’s face recognition system remained almost entirely unknown to the public for five years. The New York Police Department acknowledges using face recognition; press reports suggest it has an advanced system. Yet NYPD denied our records request entirely. The Los Angeles Police Department has repeatedly announced new face recognition initiatives—including a “smart car” equipped with face recognition and real-time face recognition cameras—yet the agency claimed to have “no records responsive” to our document request. Of 52 agencies, only four (less than 10%) have a publicly available use policy. And only one agency, the San Diego Association of Governments, received legislative approval for its policy.

You can read the Georgetown Law study, The Perpetual Line Up, in its entirety online. State-by-state breakdowns of how agencies scored can be found here.