Law enforcement’s use of facial recognition programs has long been problematic, and it’s lead to lawsuits, like one a Detroit-area man filed for wrongful arrest. But there’s at least some hope these programs may be contained.

The Virginia General Assembly overwhelmingly approved a bill banning local police from purchasing or using facial recognition programs without the General Assembly’s approval prohibits any department currently using facial recognition programs from continuing to use them “without [legislative] authorization after July 1, 2021.”

The bill goes a step further, requiring “any local police agency eventually authorized to have ‘exclusive control’ over the facial recognition system, preventing the use of Clearview AI and other commercial FR products.”

That last bit is important, because commercial facial recognition programs market their databases of billions of images to law enforcement…often resulting in abuse:

Uses to which the tool was put included searches for protesters, criminals—and friends and family members. Inappropriate searches on acquaintances could have been predicted by anybody aware of the abuse of official databases for curiosity and personal gain. “Police officers across the country misuse confidential law enforcement databases to get information on romantic partners, business associates, neighbors, journalists and others for reasons that have nothing to do with daily police work,” the AP reported in 2016. A massive facial recognition database is an enormous temptation for unscrupulous government employees already accustomed to misusing such tools.

Putting the facial recognition genie back in the bottle may be asking for too much. But that should not stop lawmakers from putting limits on how this creepy tech is used.