For the fourth time this year, a class-action lawsuit was filed in Illinois this week against Facebook over the site’s controversial facial recognition technology. 

There is currently no federal regulations for so-called “biometric” data, and several prominent privacy organizations backed out of talks to establish them earlier this year when representatives from the tech industry would not provide even basic protections for users.

“You can’t turn off your face,” said Alvaro M. Bedoya, executive director of Georgetown University’s Center on Privacy & Technology. “Yes, it’s 2015, and yes, we’re tracked in a million different ways, but for most of those forms of tracking, I can still turn it off if I want to… There’s an awful lot at stake here. In the end, do we want to live in a society where everyone is identified all the time the minute they walk out into public? I think most people aren’t ready for that world.”

However, despite the lack of federal attention to the issue, Illinois and Texas both have state laws governing the collection of facial data. Illinois passed the Biometric Information Privacy Act in 2008 long before most companies were thinking about collecting the information, and ACLU reps from the state say it would be hard to pass a similar law now with the tech industry’s massive lobbying presence.

Even though there might never be a federal law against the practice of collecting this sensitive info, at least these state cases can call attention to what is certainly an important—and underreported—issue.