Half of adult American faces are stored in police databases in the United States thanks to the aggressive use of facial recognition technologies by local police over the past few years, according to a new study out Tuesday from researchers at Georgetown Law School Center for Privacy and Technology.

An estimated one in four U.S. police departments have access to face recognition software, and authors of the study, “The Perpetual Line-Up,” warn they’re using them in ways that “may undermine longstanding, legally recognized rights.”

The report found at least 26 states that allow their law enforcement agencies to run face recognition searches against databases containing driver’s license information, meaning millions of law abiding citizens are potentially being pulled into the dragnet.

“Face recognition is a powerful technology that requires strict oversight,” Clare Garvie, an associate of the center who led the study, said in a news release. “But these controls by and large don’t exist today … It’s a wild west.”

The researchers acknowledge the benefits of face recognition technology for catching violent criminals and fugitives, as well as its use in law enforcement. “This report does not aim to stop it,” they wrote. “Rather, this report offers a framework to reason through the very real risks that face recognition creates.”

Face recognition technology analyzes the dimensions of someone’s face — the contour of their ear, the width of their nose, the length of their forehead — and then searches the database for potential matches.

How face recognition is being used in police surveillance of protests is one area of concern for the researchers. The report found that of the 52 agencies which use (or have used) face recognition, only one — Ohio’s Bureau of Criminal Investigation — has a policy which explicitly prohibits its officers from using the software to monitor religious, political or other free speech activities.

For example: the Baltimore Police Department used face recognition technology during the 2015 demonstrations over Freddie Gray’s death to identify protesters with outstanding warrants. T.J. Smith, a spokesperson for the Baltimore police, acknowledged the software had been used “for purposes of trying to identify those who were involved in criminal wrongdoing.”