Half of American adults are in a face-recognition database, according to a Georgetown University study released Tuesday. That means there's about 117 million adults in a law enforcement facial-recognition database, the study by Georgetown's Center on Privacy & Technology says.

"We are not aware of any agency that requires warrants for searches or limits them to serious crimes," the study says.

The report (PDF), titled "The Perpetual Line-up: Unregulated Police Face Recognition in America," shows that one-fourth of the nation's law enforcement agencies have access to face-recognition databases, and their use by those agencies is virtually unregulated.

"Innocent people don't belong in criminal databases," said Alvaro Bedoya, the executive director of the Center on Privacy & Technology and co-author of the study. "By using face recognition to scan the faces on 26 states' driver's license and ID photos, police and the FBI have basically enrolled half of all adults in a massive virtual line-up. This has never been done for fingerprints or DNA. It's uncharted and frankly dangerous territory."

Where do the mug shots come from?

For starters, about 16 states allow the FBI to use facial recognition to compare faces of suspected criminals to their driver's licenses or ID photos, according to the study. "In this line-up," the study says, "it's not a human that points to the suspect—it's an algorithm." The study says 26 states or more allow police agencies to "run or request searches" against their databases or driver's licenses and ID photos. This equates to "roughly one in two American adults has their photos searched this way," according to the study. Many local police agencies also insert mug shots of people they arrest into searchable, biometric databases, according to the report.

According to the report, researchers obtained documents stating that at least five "major police departments," including those in Chicago, Dallas, and Los Angeles, "either claimed to run real-time face recognition off of street cameras, bought technology that can do so, or expressed an interest in buying it."

The Georgetown report's release comes three months after the US Government Accountability Office (GAO) concluded that the FBI has access to as many as 411.9 million images as part of its face-recognition database. The bulk of those images are photographs of people who have committed no crime. That study, which provided examples of crimes solved by using the database, noted that the FBI database was used in investigations involving credit card and identity fraud, bank robberies, violent crime, and other felonies.

Meanwhile, the Georgetown study also said that police departments have little oversight of their databases and don't audit them for misuse:

Maryland's system, which includes the license photos of over two million residents, was launched in 2011. It has never been audited. The Pinellas County Sheriff's Office system is almost 15 years old and may be the most frequently used system in the country. When asked if his office audits searches for misuse, Sheriff Bob Gualtieri replied, “No, not really.” Despite assurances to Congress, the FBI has not audited use of its face recognition system, either. Only nine of 52 agencies (17%) indicated that they log and audit their officers' face recognition searches for improper use. Of those, only one agency, the Michigan State Police, provided documentation showing that their audit regime was actually functional.

Clare Garvie, the report's lead author, sent records requests to 100 police departments. Only half of them acknowledged using facial recognition. Many of the agencies allow police to search for someone regardless of whether he or she is suspected of a crime.

"With only a few exceptions, there are no laws governing police use of the technology, no standards ensuring its accuracy, and no systems checking for bias" Garvie said. "It's a Wild West."