Not just Wegmans: More NYC retailers using facial recognition as tech outpaces law

Grocery chain Wegmans’ expanding use of facial recognition technology in New York City is reigniting debates over consumers’ privacy rights and retailers’ interest in safeguarding their stores.

But while Gothamist’s reporting this month put Wegmans in the spotlight, the Rochester-based chain is by no means the only retailer in New York City using some form of facial recognition and biometric data as a theft prevention measure. Experts, lawmakers and shoppers this week voiced concerns that the technology is outpacing regulation — and creating potential privacy risks and data-sharing concerns for New Yorkers.

“There’s very little regulation in this area,” said Darrell West, a senior fellow at the Washington, D.C.-based Brookings Institution who has researched this technology. Businesses using facial recognition tech, he added, should disclose it so that people who want to avoid those stores can do so. “We should make sure that companies don’t keep that data for an extended period. There’s no justification for keeping your face on record for months and months.”

The technology uses artificial intelligence to identify people by analyzing their faces and matching them against available biometrics, often from other databases. It is becoming more common at retail businesses both in the city and nationwide, according to experts and media reports. But the software continues to evolve rapidly and can be unclear and confusing for people just trying to pick up some groceries.

Gothamist reached out to nearly 50 major retailers last week to ask whether they use facial recognition software at their New York City stores. Most have not responded, but many — including CVS, Target, Stop & Shop, Burlington, Marshalls, TJ Maxx and HomeGoods — said they do not. Other retailers, such as Macy’s, confirmed they use the tech, at least at some local stores.

Under a 2021 city law, businesses that collect shoppers’ biometrics must post signs informing customers of the practice and cannot sell or profit off the data. But the city’s Department of Consumer and Worker Protection said it has no enforcement mechanism if a company does not comply; customers can pursue legal action for alleged violations.

It’s not clear how many businesses are complying with the law.

Customers at retailers throughout the city said this week they did not know the store they were in used facial recognition software — and they weren’t very happy about it.

At the Fairway supermarket on the Upper West Side, none of the shoppers who spoke with Gothamist said they’d noticed the biometric warning sign posted just above the shopping baskets. The letter-sized sign informed customers the store collects biometrics potentially including facial recognition, voiceprints and eye scans “that can be used to identify or help identify you.”

“That’s a little creepy, I don’t appreciate it,” Washington Heights resident Katherine Rothwell said. “ But whether we pick up our heads and read a sign is a totally different thing.”

Fairway’s parent group, Wakefern Food Corp., did not respond to an inquiry.

Wegmans said the software helps address crime and misconduct at “stores that exhibit an elevated risk.” The company also said it does not share facial recognition data with third parties, does not collect retinal scans or voiceprints and keeps images and videos only as needed for security purposes.

Even when businesses disclose their use of facial recognition tools, as they are required to do in the five boroughs, privacy advocates say the growing collection of facial scans introduces privacy risks far beyond conventional data breaches.

“ If your credit card leaks, you can go get a new credit card,” said Evan Greer, director of digital rights organization Fight for the Future. “If a private, biometric scan of your face leaks, you can't go get a new face.”

NYC stores using biometric scans

At Macy’s flagship store in Herald Square on Thursday, signs posted at a handful of entrances on 34th Street stated “this business collects, retains, converts, stores or shares customers’ biometric identifier information … for asset protection purposes.” The signs listed several examples of such data — eye scans, fingerprints, voiceprints, hand scans, face geometry “or any other identifying characteristic” — and said Macy’s does not share or sell biometrics to third parties “other than law enforcement agencies.”

"The safety and security of our customers and colleagues is our number one priority,” wrote a Macy’s representative, who said the company collects facial recognition data in “some stores for customer safety and asset protection purposes."

An online survey conducted by West and the Brookings Institution in 2018 found half of U.S. respondents were unfavorable toward the use of facial recognition software in retail stores to prevent theft. West said people’s tolerance for the tools can depend on the setting, with major hubs like airports and stadiums generally understood to have more security risks than everyday venues like grocery and clothing stores.

“I think retail is more controversial from the standpoint of the general public because people worry businesses may misuse the information without having as strong of a security concern as is the case at an airport,” he said.

Gothamist spotted biometric disclosures Thursday at the Whole Foods in Columbus Circle and Westside Market in Chelsea. In Amazon-owned Whole Foods’ case, customers who use Amazon One palm scanners to make payments give the company identifying information, but those who avoid the devices do not, according to a sign posted at the store.

A representative for Amazon One said customers have to sign up for the service to use the scanners, and it only collects palm data, not other biometrics. Amazon One does not share biometric data with third parties, the rep said.

A facial recognition sign at Westside Market was similar to Fairway’s, except graphics for eye scans and voiceprints were crossed out with red Xs. The company did not return an inquiry about its use of facial recognition tech.

‘So many daily risks already’

Retailers and security companies argue facial recognition software helps reduce shoplifting and violence by alerting stores when the tech matches someone to the profile of a person suspected of wrongdoing. But some experts point out these tools sometimes misidentify people, including because of racial biases built into the algorithms they are built on, and lead to needless escalations.

“You can easily achieve similar goals with simple video cameras that can be analyzed, following an event, for forensics to identify people,” said Ben Zhao, a computer science professor at the University of Chicago who studies facial recognition tech.

“There are so many daily risks that we already have to deal with” when it comes to privacy, he added.

Retail theft declined 14% citywide last year compared to 2024, according to the NYPD. The department, which uses facial recognition tech to fight crime, said nearly half of all retail theft complaints resulted in an arrest, the highest rate since 2019. A spokesperson emphasized facial recognition data is never enough to establish probable cause but can help police pursue investigatory leads.

Still, civil rights advocates contend the tech can invade people’s privacy in retail venues.

“It’s not any different than a security guard asking every person to sign in by name, having their purchases being tracked and showcasing their ID,” said Daniel Schwarz at the nonprofit New York Civil Liberties Union. “That is all happening now invisibly by the means of AI.”

Experts pointed to California and Illinois as states leading the way on regulating facial recognition software and biometrics. They said the United States lacks a comprehensive national data privacy law, meaning each jurisdiction has to come up with its own regulations.

Some members of the New York City Council and state Legislature have proposed bills to ban or restrict facial recognition tech in places of public accommodation. After Gothamist reported on Wegmans’ use of the software, state Assemblymember Linda Rosenthal called attention to her bill to require “clear notice and privacy protections when retailers use tracking or biometric technology in their stores.”

“People should not have to surrender their biometric data to go grocery shopping,” she tweeted.