Absent federal regulations on government's use of facial recognition, more states and localities are coming up with their own rules and prohibitions.