The FBI has collected nearly 430,000 iris scans over the past three years, an investigation by technology website The Verge, has revealed.
What started as a pilot in 2013 has grown into a database "without any public debate or oversight", said the American Civil Liberties Union.
It amounted to "runaway surveillance", director of technology Nicole Ozer tweeted.
The FBI project was launched in September 2013 and has been carried out in cooperation with agencies in Texas, Missouri and California.
The iris data, taken from people who have been arrested, can be scanned in a fraction of a second.
The scan takes a detailed image of the ridges in the coloured part of the eye, which are as detailed and distinctive as a fingerprint.
An average of 189 iris scans were collected every day in California at the start of 2016, according to documents obtained by The Verge.
The US law enforcement agency said it was developing "best practices" for iris image capture.
The programme was started to "evaluate technology, address key challenges and develop a system capable of performing iris image recognition services", according to the FBI's website.
Such technology is necessary in order to easily track criminals and quickly catch repeat offenders and suspects who try to hide their identities, the FBI argued.
Privacy International said it was "deeply concerning" that hundreds of thousands of iris scans were being added to a database without public debate, proper safeguards "or even awareness that such data has been taken and is being stored".
"If our biometric data is to be collected at all, such systems should not be introduced or continued before a public debate, strong legal frameworks, and strict safeguards are in place," the organisation told the BBC.
The FBI said the project fell under its $US1bn next-generation identification system that aimed to expand the bureau's old fingerprinting database to other identifiers such as facial recognition and palm prints.