Facial recognition is spreading into stores faster than the rules can keep up

A camera mounted near a store entrance can now do far more than record footage for a security guard to review later. Paired with facial recognition software, it can match a shopper’s face against a watch list in real time, flag a repeat visitor, or quietly build a profile of who comes through the door and how often, all without a sign, an announcement, or any obvious indication that the matching is happening at all. Retailers have adopted the technology faster than lawmakers have written rules to govern it, leaving most of what happens with a scanned face up to whatever each store or vendor decides on its own. The gap between deployment and regulation is not a temporary lag that will close on its own; it reflects how differently retail technology and privacy law tend to move, with one driven by vendor competition and loss-prevention budgets and the other by a slower legislative process that varies enormously from one state to the next.

What Store Facial Recognition Actually Does During a Visit

A facial recognition system works by converting a captured image of a face into a numerical template and comparing that template against a stored database, looking for a close enough match to flag. In a retail setting, that database is typically built from photos of people previously identified as shoplifters or banned individuals, so an ordinary shopper’s face is being measured and compared even though the vast majority will never trigger a match. The comparison happens automatically and instantly, with no requirement that a human review every scan before a match is accepted or dismissed. Some systems are configured to alert staff only when a match crosses a certain confidence threshold, while others log every face detected regardless of whether a match is found, a distinction that matters enormously for how much data ends up retained but is rarely disclosed to the shoppers being scanned.

Loss Prevention Is the Main Reason Retailers Have Adopted It

Retail chains have deployed the technology overwhelmingly to reduce theft rather than for marketing or customer-recognition purposes, though the actual footprint remains modest relative to how much attention the technology draws. A government review of the commercial market found that roughly 6 percent of stores surveyed in a national retail security survey had implemented facial recognition across all locations specifically for loss prevention, a real but still limited slice of the broader retail industry that nonetheless represents millions of shopper interactions each year across the chains that have adopted it. Banks and casinos have adopted comparable systems for similar security reasons, which means the same underlying technology and the same open questions about consent extend well beyond ordinary retail into other everyday errands.

The Accuracy Gap That Keeps Showing Up in Testing

Government scrutiny of the technology has consistently centered on how unevenly accurate it performs across different groups of people. The Government Accountability Office’s review of commercial facial recognition cites federal testing showing that the technology generally performs better on lighter-skinned men and worse on darker-skinned women, and that it also performs less reliably on children and elderly adults. In a retail context, that unevenness translates directly into who is more likely to be wrongly flagged as a match against a watch list, since a system’s error rate is not evenly distributed across every shopper who walks past the camera.

A Patchwork of Rules Instead of One Federal Standard

No single federal law sets out what a retailer must disclose, or what consent it must obtain, before scanning shoppers’ faces, leaving the space governed by a mix of narrower state biometric privacy laws, industry self-regulation, and non-binding federal guidance. The Federal Trade Commission has published best-practices guidance urging companies to give clear notice, obtain meaningful consent, and secure any biometric data they collect, but that guidance sets recommendations rather than binding legal requirements, and enforcement against a specific retailer generally depends on separate consumer protection or state biometric statutes rather than the facial recognition guidance itself.

Why Disclosure at the Door Is So Easy to Miss

Where a store does disclose that facial recognition is in use, the notice is often a small sign posted near an entrance, worded in general terms, and easy to walk past without reading, especially compared to the prominent placement retailers give more familiar notices like a return policy or a coat-check reminder. That gap between what a law in one state might require and what a shopper actually notices on the way in means the practical extent of disclosure often depends less on the letter of any rule and more on how much effort an individual retailer chooses to put into making a posted notice actually visible.

What the Current Gap Means for an Ordinary Shopper

Until a more uniform standard exists, the amount of information a shopper can realistically get about whether their face is being scanned, stored, or matched against a database varies enormously by state, by retailer, and by how closely a small posted sign happens to be read. That variation is the practical meaning behind rules struggling to keep pace with deployment: the technology has moved from a novelty to a routine loss-prevention tool faster than any single, consistent legal framework has caught up to define what a retailer owes a shopper walking through the door.

This article was produced with the assistance of AI and reviewed by Morning Overview editors.

More from Morning Overview