Nearly two dozen states have passed laws regulating how tech companies collect data from our faces, eyes and voices. It comes as Congress has yet to pass any facial recognition technology.