Back to News & Commentary

Are Stores You Shop at Secretly Using Face Recognition on You?

Shopper in store aisle with her face being scanned
Shopper in store aisle with her face being scanned
Jenna Bitar,
ACLU Speech, Privacy, and Technology Project
Jay Stanley,
Senior Policy Analyst,
ACLU Speech, Privacy, and Technology Project
Share This Page
March 26, 2018

Are American retail stores using face recognition on their customers without telling them? We asked some of America’s biggest retailers and, with a few exceptions, they refused to tell us.

We do know that most major retailers have video cameras in their stores. We know that at least one face recognition vendor is pushing the use of the technology for identifying shoplifters, and claims to have several Fortune 500 retailers among its clients. We know the technology’s use is rapidly growing in the UK. We know the New York Times reported recently that the use of face recognition is being “explored” at Madison Square Garden. We know that Walmart tested the technology in its stores for several months in 2015. And now we know that at least one major American retailer, Lowe’s hardware, has begun using the technology without informing visitors to its stores.

We also know that a government-run “multi-stakeholder” process attempting to craft voluntary standards for the use of face recognition fell apart in 2015 because not a single company or corporate trade association would agree to the principle that people shouldn’t be subject to face recognition without their permission.

At this point, customers may understand intellectually that their movements in stores are captured on video — although most stores place them in domes made of smoked glass for no reason other than to hide the cameras from customers (who might find the swiveling, zooming lenses therein to be spooky and actually gain a realistic sense of the extent to which they are being watched). Most customers also probably expect that most camera feeds, most of the time, are not being monitored — and that if they are, nothing is done with the video footage that is collected, so long as nothing dramatic is captured.

But I think it’s fair to say that most customers do not think that they are being subject to a perpetual lineup, scrutinized by face recognition technology to see if they resemble anyone that a company security service has decided to put on a watch list. They do not expect that their faces are being captured, retained, connected to their real-world identity (for example when they use a credit card at checkout), and combined with information about their income, education, demographics, and other data. They do not expect that their every footstep, hand motion, and gaze will be analyzed by computers and filed away to give insight into their shopping habits, patterns, and preferences, and shared among different companies, data brokers, and advertisers. They do not expect that they are subject to the risk of being misidentified as someone in a database of suspected criminals, fugitives, terrorists, or whatever other blacklists stores may be using or begin using in the future. They don’t expect that all these intimate details about their behavior will become accessible to government agencies through legal demands or voluntary sharing.

And if those things are happening, I think most customers would want to know about it.

We don’t know how many of those things are being done by how many American retailers. We do know that the technology already exists, and that stores have a strong financial incentive to collect as much information about their customers as they can get. And we do know that when it comes to this kind of cutting-edge technology, which is taking the human race to places it’s never been before, the public has a right to know what stores are doing with it, if anything, so they can vote with their feet if they don’t like it.

Now we also know that most top retail companies are not willing to be transparent about even the most basic uses of face recognition today.

We decided to start with a simple question for some of the top American retailers: “Are you using face recognition with cameras on your customers?” Last month we took a list of the top 20 retailers published by the National Retail Federation, subtracted Amazon because of their minimal brick-and-mortar presence, and added Disney because it deals with many millions of people at its theme parks. We then sought answers to our simple question from those companies’ chief privacy officers, press contacts, or whatever other contacts we could find.

Of the 20 companies we contacted, only one was willing to tell us that they don’t use it: the company Ahold Delhaize, whose U.S. brands include the supermarkets Food Lion, Stop & Shop, Giant, and Hannaford. And one company, the hardware company Lowes, said that it does use face recognition technology — to identify shoplifters.

All the other companies we contacted refused to answer our question. Target and McDonald’s said the answer was “considered proprietary.” Rite Aid and TJX Companies (whose brands include T.J. Maxx and Marshalls) responded to us but would neither confirm nor deny the use of biometric face scans. Lowes’s competitor Home Depot, which told Fortune in 2015 that it did not use the technology, now told us that the answer to our question was confidential for “competitive reasons.”

Thirteen of the companies we contacted refused to give us an answer at all. Even Walmart, which told a reporter from Fortune in 2015 that it had experimented with the technology but stopped using it, wouldn’t say that it was not using it now.

It is unacceptable that so many companies refused to respond to our request. Customers should not have their faces scanned without their permission—and they certainly shouldn’t be scanned without their knowledge. Companies using face recognition should inform their customers — not only by answering queries from groups such as the ACLU and journalists such as those from Fortune, but by providing notice to customers in their stores.

If companies don’t think their customers will care, then why won’t they tell us exactly how they are using face recognition? If companies are afraid that their customers won’t like hearing that their face prints are being taken, and yet are doing it anyway, then there is a word for that: unethical.

The security wings of these companies may be accustomed to operating in the shadows — doing everything they can to watch customers without making them feel they are being watched. But face recognition is a brand-new, rapidly evolving technology that has enormous implications for the privacy of individuals in America. It is also a technology that has been found to have racially differential impacts. We have to decide whether we want our way of life to be significantly altered by this technology, or whether we want to limit its use to reflect our values. That assessment cannot happen if this face recognition is being arrogantly deployed in secret.

Retailer

Uses Face Recognition?

Wal-Mart Stores

Refused to answer

The Kroger Co.

Refused to answer

Costco

Refused to answer

The Home Depot

Refused to answer

CVS Caremark

Refused to answer

Walgreens Boots Alliance

Refused to answer

Target

Refused to answer

Lowe’s Companies

YES

Albertsons Companies

Refused to answer

Royal Ahold Delhaize USA

NO

McDonald’s

Refused to answer

Best Buy

Refused to answer

Publix Super Markets

Refused to answer

Rite Aid

Refused to answer

Macy’s

Refused to answer

TJX Companies

Refused to answer

Aldi

Refused to answer

Disney

Refused to answer

Dollar General

Refused to answer

What’s really needed is for retail use of face recogntition technology to be subject to sensible regulation to ensure it comports with basic norms of privacy and fairness — but until we have that, customers have no choice but to vote with their feet. Some Americans may disagree with the ACLU’s view that we should not allow this technology to become widespread and routine in American life—but we can all agree that people should have the information they need as to whether they want to patronize stores that decide to use it in.

As far as Lowe’s goes, they deserve credit for at least being willing to answer our question, unlike most of the other companies we contacted, and for disclosing their practices in their online privacy policy. More credit goes to Ahold Delhaize, which was not only transparent, but is not using face recognition on its customers. Lowe’s writes to us that “we may use facial recognition technologies to identify known shoplifters,” and says that they do not retain facial data on people for whom it does not match to their facial database of suspected shoplifters, which is good as far as it goes. Still, if they’re going to use face recognition in their stores they should post signs alerting their customers so those customers are meaningfully informed that they are being subject to a virtual lineup.

We don’t know how widespread facial recognition is in American retail. Shoplifter identification may be the first widespread use, but without meaningful restrictions, it won’t be the last. Companies are already selling “VIP recognition” and all kinds of analytical capabilities.

These retail applications of face recognition, like the technology’s unnecessary adoption by Customs and Border Patrol, risks a dangerous normalization of this technology in American life that will clear the path for truly nightmarish uses. These systems are the beginnings of an infrastructure for tracking and control that, once constructed, will have enormous potential for abuse, to create chilling effects, and to change what it means to be in public in the United States.

Learn More About the Issues on This Page