; or (B) facial recognition data to determine whether an end user has given affirmative consent if the controller immediately and permanently destroys the facial recognition data after determining that the end user has not given affirmative consent. (2) Security applications Subsections (a)(1)(A) and (b) shall not apply to controllers that use an application that is a security application. (3) Rule of construction Nothing in paragraph (1)(B) may be construed to authorize the mass scanning of faces in spaces where end users do not have a reasonable expectation that facial recognition technology is being used on them. 4. Enforcement (a) Unfair or deceptive act or practice A violation of section 3 shall be treated as a violation of a rule defining an unfair or deceptive act or practice prescribed under section 18(a)(1)(B) of the Federal Trade Commission Act ( 15 U.S.C. 57a(a)(1)(B) ). (b) Powers of Commission (1) In general The Federal Trade Commission shall enforce this Act in the same manner, by the same means, and with the same jurisdiction as though all applicable terms and provisions of the Federal Trade Commission Act ( 15 U.S.C. 41 et seq.) were incorporated into and made a part of this Act. (2) Privileges and immunities Any person who violates section 3 shall be subject to the penalties and entitled to the privileges and immunities provided in the Federal Trade Commission Act ( 15 U.S.C. 41 et seq.). (c) Enforcement by States (1) In general If the attorney general of a State has reason to believe that an interest of the residents of the State has been or is being threatened or adversely affected by a practice that violates section 3, the attorney general of the State may, as parens patriae, bring a civil action on behalf of the residents of the State in an appropriate district court of the United States to obtain appropriate relief. (2) Rights of Commission (A) Notice to Commission (i) In general Except as provided in clause (iii), the attorney general of a State, before initiating a civil action under