The technology compares shoppers' faces against watchlists of people suspected of theft, fraud, or violence.
Privacy advocates warn that everyone entering the store is scanned, and facial recognition isn't always accurate.
California shoppers can request information about — and in some cases deletion of — their biometric data under state privacy laws.
Several Grocery Outlet stores in the San Francisco Bay Area have begun using facial recognition technology at their entrances, raising new questions about privacy and how retailers are using technology to combat shoplifting.
According to reporting by SFist and Mission Local, four stores in San Francisco neighborhoods are among those using a system called SAFR Guard, which scans the faces of people entering the store and compares them against a watchlist of individuals suspected of theft, fraud, violence, or other criminal activity.
Small signs posted near store entrances notify shoppers that "Face Matching software" is in use.
How does it work?
SAFR Guard uses security cameras to capture facial images as customers enter the store. Those images are compared against a retailer watchlist compiled from previous security incidents. If the system believes it has identified someone on the list, store employees may receive an alert.
According to the company, the technology is designed for security purposes and is intended to identify people "reasonably suspected" of unlawful activity rather than monitor every shopper.
Why are privacy advocates concerned?
Privacy advocates make the argument that the system scans everyone who walks through the door, including shoppers who have done nothing wrong.
They also point out that facial recognition technology is not perfect. Experts say factors such as lighting, camera angles, and image quality can lead to false matches. Previous studies have also found that some facial recognition systems have higher error rates for certain demographic groups.
Those concerns aren't just theoretical. In 2023, the Federal Trade Commission (FTC) prohibited Rite Aid from using facial recognition technology for five years after concluding the company's system repeatedly misidentified innocent customers as shoplifters.
What rights do California shoppers have?
California's Consumer Privacy Act (CCPA) gives residents important rights over personal information collected by businesses.
If a retailer collects biometric information such as facial images, consumers can generally:
Request to know what personal information has been collected.
Ask that eligible personal information be deleted.
Request that certain personal information not be sold or shared.
People who believe they have been placed on SAFR's watchlist can also request that their biometric information be deleted through the company.
One limitation, however, is that your image may already have been collected before you have the opportunity to make those requests.
What if you don't live in California?
Privacy protections vary widely from state to state.
While a growing number of states have enacted comprehensive consumer privacy laws, many do not specifically regulate facial recognition in retail settings. In many areas, retailers can legally use facial recognition as long as they provide any required notices and comply with applicable state laws.
If you're concerned about biometric privacy:
Look for signs near store entrances indicating facial recognition is in use.
Review the retailer's privacy policy before shopping.
Ask customer service how facial images are stored, shared, and how long they're retained.
Also, don’t be afraid to ask whether you can request deletion of your data under your state's privacy laws.