Retailers Are Collecting Your Biometrics. Some Local Governments Are Fighting Back.

When shoppers walk into a grocery store, they expect security cameras. Few expect the store to analyze their faces, eyes, and voices. Earlier this year, customers entering some Wegmans stores in New York City learned that the retailer was using facial recognition technology in its locations and storing customers’ biometric data. The disclosure, required under a 2021 city ordinance governing biometric collection, initially drew little attention beyond the city. But when the Buffalo-based Investigative Post asked whether Wegmans was also using the technology in Western New York stores, the company’s lack of response drew concern from local lawmakers. Now, Erie County has banned private-sector biometric collection outright, becoming the first county in the state and one of the first major counties across the United States to do so. For Erie County Legislator Lawrence Dupre, who represents Buffalo’s predominantly Black East Side and introduced the legislation on May 26, the unanswered questions raised a larger issue: how much personal information should private companies be allowed to collect from people who simply walk through their doors?. “That silence [from Wegmans] is what drove my initial response,” Dupre told Next City via email. “My constituents live in neighborhoods where surveillance has become the norm. We are already watched and profiled as we go about our lives. When I learned that the same corporations operating in our neighborhoods might be building biometric databases without telling us, I initially responded with a bill that was modeled on what New York City passed in 2021.” It took three years for the city to pass its biometric privacy law. What began as a proposal requiring businesses to disclose biometric collection ultimately evolved into one of the nation’s most restrictive local laws regulating commercial facial recognition technology. The more Dupre studied biometric surveillance, the more he concluded that transparency alone would not solve the problem. A disclosure requirement, he argued, amounted to little more than a permission slip. “You are telling businesses: go ahead and collect this permanent, irreplaceable data, just put up a sign first. A ban was the right response because the data itself is the danger.” On April 30, Erie County Executive Mark Poloncarz signed the Biometric Transparency and Privacy Act into law. The measure prohibits private businesses from collecting, using, retaining, or selling biometric identifiers, including facial recognition data, in most commercial settings. Violators face fines of up to $5,000 per day. “You can reset a password. You cannot reset your face,” said Dupre during the press conference announcing the new law. According to the New York Civil Liberties Union, the new measure is necessary to address the rise of facial recognition technology in businesses in response to evidence that the technology was frequently inaccurate and racially biased, leading to wrongful harassment, removal from establishments, arrests, and even jail time for misidentified individuals. Wegmans later confirmed that it had deployed facial recognition technology in “a small fraction” of its stores, saying biometric information was not shared with third parties and was retained only as long as necessary for security purposes. The company did not disclose how long data was stored, stating only that its retention practices align with industry standards, nor did it identify how many locations used the technology or where they were located. Facial recognition technology has rapidly become embedded in everyday life. It unlocks smartphones, verifies identities at airports, and increasingly serves as a security tool for retailers and entertainment venues. Yet privacy advocates argue that regulation has failed to keep pace with adoption. Fight for the Future, a digital rights organization, has identified numerous retailers that either use or may be using facial recognition technology in stores. A woman exits a Rite Aid store in Philadelphia. In 2023, the Federal Trade Commission banned Rite Aid from using facial recognition technology for five years over allegations that a surveillance system it used incorrectly identified potential shoplifters, especially Black, Latino, Asian, and female shoppers. The government agency charged that the drugstore chain didn’t implement “reasonable procedures” to prevent harm to its customers. (Photo by Matt Rourke / AP) Lia Holland, campaigns and communications director for Fight for the Future, told Next City that the growth of biometric surveillance is occurring largely outside public awareness. “The retail industry is sensitive to customer outcry, and that is the most effective lever we have found for self-regulation short of passing a law. However, outcry has also gotten less effective over time as the surveillance industry pours millions of PR and marketing dollars into overcoming how unwanted their technology is.” The United States currently has no comprehensive federal law regulating facial recognition technology. At the state level, only Illinois, Texas, and Washington currently have laws dedicated to private uses of biometric data. Everywhere else, biometric data is protected either as a category of sensitive data under a general consumer privacy law, or only through data-breach notification rules. ICE and government use of biometric data For immigrant communities, another concern looms large: government access to biometric data collected by private entities. Erie County’s law exempts government agencies acting within their official duties, as well as financial institutions. That exemption means federal immigration authorities are not restricted by the county’s ban when conducting enforcement operations. “The most urgent harm we see is illustrated by how this data is being fed into the hands of Immigration and Customs Enforcement officers and it is being used not only to abduct people off the streets, but also to intimidate activists and legal observers who challenge ICE,” Holland says. Federal immigration agencies have dramatically expanded their use of facial recognition technology in recent years. Critics warn that commercial databases could eventually become valuable sources of information for enforcement agencies seeking to identify and track individuals. Jillian E. Nowak, managing attorney of the Buffalo Immigration Office for Prisoners’ Legal Services of New York, says that Erie County’s law only offers a potential remedy for surveillance violations committed by private entities but does nothing to address ICE’s own use of the technology. “We know that ICE uses and continues to develop technology to identify individuals based on facial recognition or iris-scanning technology, particularly in orchestrating widespread community pick-ups,” Nowak says. “ICE also routinely uses GPS monitoring via ankle or wrist devices and monitors social media.” “Absent intervention from the courts,” she adds, “I am not aware of any meaningful oversight or guardrails of ICE’s use of these surveillance technologies.” Several immigrant leaders in the city tell Next City that knowledge of facial recognition and its ubiquity in public life remains low within their communities, despite fears about immigration enforcement. For Dupre, Erie County’s ordinance was never intended to be the final answer. Instead, he sees it as a model that other local governments can adopt while state and federal lawmakers continue debating broader reforms. “A lot of communities are waiting for the state legislature or Congress to act, and that wait could take years,” Dupre says. “County government is close enough to the people to hear what they need and responsive enough to act on it. Other counties can do the same.” He says the law draws a distinction between ordinary security measures and biometric surveillance. “We designed this to change behavior, not generate lawsuits,” Dupre says. “A store can still record video. What it cannot do is run facial recognition software to build a biometric profile of everyone who walks through the door. The line this law draws is between security and surveillance.” Victor Maung is an independent investigative journalist based in Washington, D.C., covering civil liberties, immigration, AI surveillance, and refugee communities. A Fulbright scholar with master's degrees in journalism from American University and Hong Kong Baptist University, he has reported across Southeast Asia and the United States for more than two decades. His work appears in Prism News and Frontier Myanmar, among other outlets. He is originally from Burma (Myanmar). Add to the Discussion Next City sustaining members can comment on our stories. Keep the discussion going! Join our community of engaged members by donating today. Already a sustaining member? Login here.