The Supreme People’s Court of China issued regulations Wednesday for use of facial recognition technology by private businesses. The guidelines require private businesses to receive consent from customers before collecting and processing their facial information.

Under the new regulations, individuals have the right to reject the use of facial recognition technology for identity verification. They must be offered a reasonable alternative form of access to the building or service.

The Supreme Court’s regulations treat violation of the law as a personal rights infringement and enable the aggrieved individual to file a claim for compensation. The regulations also state that businesses must notify customers with a specific clause to obtain explicit and “independent” consent before carrying out a scan. Hence, they cannot stow away their use of facial recognition in the general terms of use or through bundled consent, a method of obtaining consent for multiple requests with a single swipe.

The regulations cover civil disputes involving private players and the Chinese government. The government’s nationwide surveillance system, which has widespread ramifications on civil liberties, remains outside the regulations’ purview for public security reasons. There is also an exception for services that cannot function without facial recognition information.

The first facial recognition lawsuit in China was brought in 2019 in a court of Hangzhou by a law professor, Guo Bing, who sued the Hangzhou Safari Park. Bing alleged Hangzhou Safari Park refused entry to visitors who did not submit to the facial recognition and that it had not taken adequate precautions to protect visitors’ biometric information. Earlier this year, the Hangzhou court ruled in favor of Bing. However, its decision was based on a breach of contract and not the legality of data use in facial recognition.