What exactly does Maryland require before a facial recognition service is used in an interview?

An employer may not use a facial recognition service during an applicant's interview unless the applicant consents by signing a waiver. The statute is unusually specific about the waiver's contents: the applicant's name, the date of the interview, a statement that the applicant consents to the use of facial recognition during the interview, and a statement that the applicant has read the waiver. That specificity is what makes it operationally awkward. A generic privacy consent buried in an application flow does not contain those elements, and a clickwrap acceptance of terms is not the artefact the provision describes. The compliance question is therefore not whether you have consent language somewhere, but whether you can produce a signed instrument naming this candidate and this interview date.

We use an AI video interview tool but we are not doing facial recognition. Are we in scope?

That is the assumption worth testing before relying on it, because vendors and statutes use the phrase differently. Employers hear 'facial recognition' and think identity matching against a database. The concept in the employment provision is a service that analyses a face to identify or to generate a template from facial features. A platform that detects a face, tracks expressions or derives any facial measurement to produce a score is doing more than recording video. Ask the vendor a narrow written question — does the product create, derive or store any representation of facial geometry, and is any part of the score influenced by facial analysis — and keep the answer. A marketing page saying the product focuses on speech content is not that answer.

Does the law apply if the candidate is remote or the employer is out of state?

An interview with a Maryland applicant is the practical trigger, and the interview being conducted over video from another state does not relocate the candidate. Out-of-state employers who never considered Maryland law are exposed through the same mechanism that exposes them everywhere else: a single national process applied to a candidate pool that spans jurisdictions with different rules. The remedy is not a Maryland-specific hiring process. It is a routing rule in the scheduling step that attaches the waiver whenever the candidate's location is in a state that requires one, which is a change to a workflow rather than to a policy.

How is this different from Illinois' biometric and video interview statutes?

Three different obligations, often triggered by the same fifteen-minute interview. Illinois' biometric privacy statute attaches informed written consent, a published retention schedule and a private right of action to the collection of biometric identifiers including face geometry. Illinois' video interview provision attaches notice, an explanation of how the AI works and what characteristics it uses, consent, sharing limits and a destruction-on-request duty to AI analysis of recorded video interviews. Maryland's provision attaches a signed waiver with prescribed contents to facial recognition during an interview. A single national video interview flow can satisfy none, one or two of these and still fail the third, which is why a per-state matrix beats a single consent screen.

Can we avoid the whole problem by turning the feature off?

Frequently yes, and it is usually the cheapest answer available. Facial analysis is rarely the feature a hiring team bought the platform for — structured questions, asynchronous scheduling and a reviewable recording are. If the facial component can be disabled at the tenant level, disabling it removes the consent duty, removes a category of discrimination exposure that has been litigated elsewhere, and removes a data type from your retention obligations. Two cautions: get written confirmation that disabling it stops the derivation rather than merely hiding the output, and record the date, because the question later will be whether the feature was active for a particular interview.

Who has to hold the signed waivers, us or the vendor?

The duty runs to the employer, so the employer needs to be able to produce the waiver even if the vendor collected it. In practice the vendor's platform is the natural collection point because it controls the moment before the interview starts, and that is fine as long as two things are true: the waiver contains the prescribed elements rather than the vendor's generic consent text, and you can export signed copies on demand including after the contract ends. Add both to the agreement. Vendor-held compliance records have a way of becoming unavailable at exactly the moment a former customer needs them.

Maryland's Interview Facial Recognition Consent Law and AI Video Hiring 2026

A Consent Rule Written as a Document, Not a Principle

Privacy statutes usually describe the quality of consent — informed, freely given, unambiguous — and leave the form to the controller. Maryland's interview provision goes the other way and describes the document. The waiver identifies the applicant by name, states the date of the interview, records that the applicant consents to the use of facial recognition during that interview, and records that the applicant has read the waiver, with the applicant's signature.

Prescribing the contents has a practical effect that a principles-based rule does not: it is checkable in seconds, by anyone, without expert evidence. Either the signed instrument exists with those elements or it does not. That makes this one of the rare hiring-technology obligations where a compliance failure is a documentary fact rather than an argument about whether disclosures were adequate.

The Trigger Is a Capability, Not a Product Category

The most common misreading is definitional. Hiring teams picture facial recognition as matching a face against a watchlist, decide they are not doing that, and stop. The relevant notion is broader: analysing a face to identify a person or to produce a template derived from facial features. An asynchronous interview platform that detects a face to frame the video, measures expressions, or produces any engagement or "professionalism" signal from what the camera sees is deriving something from facial features, whatever the dashboard calls the resulting number.

This is why the inquiry has to be put to the vendor in writing and in narrow terms. "Do you use facial recognition?" reliably produces a no, because the vendor is answering about identity matching. "Does any component of your product detect, measure, encode or store a representation of a candidate's facial features, and does any score depend on it?" produces a useful answer, or a delay that is itself informative.

Where the Waiver Has to Live in the Funnel

Because the instrument names the interview date, it cannot be collected at the top of the application flow along with everything else. It belongs to the scheduling or pre-interview step, which is the step most hiring stacks have automated and least often instrumented. For synchronous interviews this is a person's calendar invite. For asynchronous video it is the platform's landing screen, which is the vendor's surface rather than yours.

Determine, per role and per candidate, whether facial analysis is active in the tooling used.
Route Maryland candidates to a flow that presents the waiver before the interview begins.
Capture name, interview date, the consent statement, the read statement and a signature.
Store the signed waiver against the candidate record, not only in the vendor's system.
Offer and document an alternative for candidates who decline, so the choice is real.
Snapshot the platform configuration on the interview date, so you can prove what ran.

Declining Has to Lead Somewhere

A consent regime where refusal ends the candidacy is consent in name only, and it invites a second problem — the candidates most likely to decline a face scan are not randomly distributed, which converts a privacy design choice into a disparate-impact question. Decide in advance what the alternative path is: a live interview with a human, a written exercise, or the same asynchronous format with the analysis disabled.

Then measure it. Count how many candidates are offered the waiver, how many decline, and what happens to the ones who do. If the decline rate is non-trivial and the advancement rate for decliners is near zero, you have documented the problem rather than solved it — but you will have documented it before someone else does, which is the difference between a fixable process and a disclosed one.

The Cheapest Compliant Answer Is Usually Off

Before building a multi-state consent workflow, price the alternative: disable facial analysis for every candidate everywhere. It removes the Maryland waiver duty, removes an Illinois biometric collection, removes a data category from your retention schedule, and removes a scoring input whose validity for predicting job performance has never been well evidenced in public research. What it costs is a feature most hiring teams did not evaluate the platform on in the first place.

If the feature stays on, the decision should be written down with a named owner and a reason, because that record is what turns an unexamined default into a considered business choice. Every regime in this area treats those two things very differently.

Questions Talent and Legal Teams Are Asking

Is a checkbox in our application portal enough?

Not for an obligation drafted as a signed waiver with prescribed contents and an interview date. A checkbox at application time cannot state the date of an interview that has not been scheduled, and a generic terms acceptance does not contain the two required statements. Electronic signature is a separate question from checkbox consent, and an e-signed document that carries the named elements and an audit trail is a far stronger position than a logged boolean in a database. The test to apply internally is simple: could you print one page for a single candidate that a stranger would recognise as the waiver the statute describes?

Our vendor says they are compliant in all fifty states. Is that sufficient?

It is a statement about the vendor's product, and the duty in an interview setting runs to the employer. Treat vendor assurances as a starting point and ask for the artefacts that would exist if it were true: a sample of the waiver text presented to candidates, confirmation of which elements are captured, an export path for signed copies, and a description of what facial data is derived and how long it is retained. A vendor that has genuinely built for this can send all four quickly. A vendor that responds with a compliance badge and a trust page has told you where its effort went.

Does this reach interviews conducted by a staffing agency on our behalf?

The agency's process is where the interview happens, so the agency's tooling is what triggers the rule, but you are the employer the candidate is being screened for and you carry the downstream consequences of an unlawfully obtained assessment. Handle it in the contract rather than in hope: require disclosure of any facial analysis in use, require the prescribed waiver where applicable, and require delivery of signed copies to you. Also ask the narrower question that agencies rarely volunteer — which of their tools are used before a candidate is ever presented to you, since screening that happens upstream is still screening for your role.

How does this interact with a general state privacy law?

Comprehensive privacy statutes typically treat biometric data as sensitive, adding consent or limitation duties, risk-assessment obligations and rights to access or delete, and several carve out or partially carve out employment data in ways that change by state. The interview waiver sits on top of all of that and is not satisfied by any of it. The sequencing that works is to treat the waiver as the gate on the activity and the privacy programme as the governance around the data once it exists — retention limits, deletion on request where applicable, and an accurate entry in your data map for a category most HR data maps omit.

What is the realistic enforcement risk here?

Lower-profile than Illinois' biometric litigation, which is driven by a private right of action and statutory damages that support class practice, but the documentary nature of this obligation makes it unusually easy to allege and unusually hard to defend after the fact. The more probable business impact is adjacent: a candidate complaint that surfaces the practice, a client or partner security review that asks what facial data you hold, or an acquirer's diligence questionnaire asking for your biometric consents. Each of those arrives on a schedule you do not control, and each is answered in minutes by an employer who kept the waivers and in weeks by one who did not.

Ask the Vendor One Question This Week

Put it in writing and keep the reply: does any part of your product detect, measure, encode or store a representation of a candidate's face, and does any score we see depend on it? Everything else in this area — waivers, retention, alternative paths — follows from that answer.

If the answer is yes and the feature is not something your hiring process actually relies on, the shortest compliant path is to switch it off, in writing, with a date.