The faces of more than 117 million American adults, typically drawn from state drivers license databases, are regularly scanned in the course of police investigations, according to a major report published on Tuesday by privacy advocates at Georgetown University.
The report, titled “Perpetual Lineup,” says the facial scanning means that half of Americans are participating in what amounts to a digital version of a police line-up without prior knowledge. And unlike a traditional line-up, most of those included in the scanning are law-abiding citizens.
The findings also describe how the technology is spreading rapidly and is almost entirely unregulated. Currently, 16 states reportedly allow the FBI to scan their driver license databases, while dozens of local law enforcement agencies are using commercial software to scan faces too.
Get Data Sheet, Fortune’s technology newsletter.
According to the findings, only one of 52 agencies had a policy in place to prevent police from using the database to track the faces of people involved in lawful political or religious speech, and only two of them had minimum accuracy requirements.
Accuracy is a concern because facial recognition is far from perfect—one leading provider of scanning tools says its reliability rating is only 95%. Meanwhile, there are also questions about racial bias given that the technology is reportedly less accurate when it comes to identifying faces of black people.
Read More: Walmart Used Facial Recognition Technology to Catch Shoplifters
The report comes a week after the ACLU reported that Baltimore police were using facial recognition tools to monitor Facebook, Twitter (TWTR), and Instagram feeds in real time for suspected suspects. Such tactics raise the specter of police using cameras to collect and identify people’s faces in crowds or in everyday life.
The growing use of these tools—and the absence of oversight—is likely to increase calls for new laws to regulate facial recognition software. The Center on Privacy on Technology, which published Tuesday’s report, is calling for legislation that would prevent law enforcement from scanning driver’s license database and require agencies to limit the scanning to mug shots instead. The report also calls for improved accuracy standards for the technology.
The report coincides with a debate over how and when private companies like Facebook (FB) and Google (GOOG) can scan users’ faces. Currently, the companies are fighting class action lawsuits in the state of Illinois, where consumers say the tech giants failed to obtain consent before adding their faces to a database. The companies have also pressed state lawmakers to remove the consent rules.