There are a number of state laws but the last time I checked the one in Illinois (which requires affirmative consent to do facial recognition) is the only effective one because it contains what’s called a “right of private action” - if the state does not sue a company you (each individual plaintiff) can sue for $5k statutory damages (which can make class actions a huge threat even to rich tech cos).

https://www.nytimes.com/2022/05/30/opinion/illinois-biometri...