吃瓜大本营

Are American retail stores using face recognition on their customers without telling them? We asked some of America鈥檚 biggest retailers and, with a few exceptions, they refused to tell us.

We do know that most major retailers have video cameras in their stores. We know that at least one face recognition vendor is pushing the use of the technology for identifying shoplifters, and claims to have among its clients. We know the technology鈥檚 use is rapidly . We know the New York Times reported recently that the use of face recognition is being 鈥渆xplored鈥� at . We know that Walmart in its stores for several months in 2015. And now we know that at least one major American retailer, Lowe鈥檚 hardware, has begun using the technology without informing visitors to its stores.

We also know that a government-run 鈥渕ulti-stakeholder鈥� process attempting to craft voluntary standards for the use of face recognition fell apart in 2015 because to the principle that people shouldn鈥檛 be subject to face recognition without their permission.

At this point, customers may understand intellectually that their movements in stores are captured on video 鈥� although most stores place them in domes made of smoked glass for no reason other than to hide the cameras from customers (who might find the swiveling, zooming lenses therein to be spooky and actually gain a realistic sense of the extent to which they are being watched). Most customers also probably expect that most camera feeds, most of the time, are not being monitored 鈥� and that if they are, nothing is done with the video footage that is collected, so long as nothing dramatic is captured.

But I think it鈥檚 fair to say that most customers do not think that they are being subject to a , scrutinized by face recognition technology to see if they resemble anyone that a company security service has decided to put on a watch list. They do not expect that their faces are being captured, retained, (for example when they use a credit card at checkout), and combined with information about their income, education, demographics, and other data. They do not expect that their every footstep, hand motion, and gaze will be analyzed by computers and filed away to give insight into their shopping habits, patterns, and preferences, and shared among different companies, data brokers, and advertisers. They do not expect that they are subject to the risk of being misidentified as someone in a database of suspected criminals, fugitives, terrorists, or whatever other blacklists stores may be using or begin using in the future. They don鈥檛 expect that all these intimate details about their behavior will become accessible to government agencies through legal demands or voluntary sharing.

And if those things are happening, I think most customers would want to know about it.

We don鈥檛 know how many of those things are being done by how many American retailers. We do know that the technology already exists, and that stores have a strong financial incentive to collect as much information about their customers as they can get. And we do know that when it comes to this kind of cutting-edge technology, which is taking the human race to places it鈥檚 never been before, the public has a right to know what stores are doing with it, if anything, so they can vote with their feet if they don鈥檛 like it.

Now we also know that most top retail companies are not willing to be transparent about even the most basic uses of face recognition today.

We decided to start with a simple question for some of the top American retailers: 鈥淎re you using face recognition with cameras on your customers?鈥� Last month we took a list of the top 20 retailers published by the National Retail Federation, subtracted Amazon because of their minimal brick-and-mortar presence, and added Disney because it deals with many millions of people at its theme parks. We then sought answers to our simple question from those companies鈥� chief privacy officers, press contacts, or whatever other contacts we could find.

Of the 20 companies we contacted, only one was willing to tell us that they don鈥檛 use it: the company Ahold Delhaize, whose U.S. brands include the supermarkets Food Lion, Stop & Shop, Giant, and Hannaford. And one company, the hardware company Lowes, said that it does use face recognition technology 鈥� to identify shoplifters.

All the other companies we contacted refused to answer our question. Target and McDonald鈥檚 said the answer was 鈥渃onsidered proprietary.鈥� Rite Aid and TJX Companies (whose brands include T.J. Maxx and Marshalls) responded to us but would neither confirm nor deny the use of biometric face scans. Lowes鈥檚 competitor Home Depot, which told Fortune in 2015 that it did not use the technology, now told us that the answer to our question was confidential for 鈥渃ompetitive reasons.鈥�

Thirteen of the companies we contacted refused to give us an answer at all. Even Walmart, which told a reporter from Fortune in 2015 that it had experimented with the technology but stopped using it, wouldn鈥檛 say that it was not using it now.

It is unacceptable that so many companies refused to respond to our request. Customers should not have their faces scanned without their permission鈥攁nd they certainly shouldn鈥檛 be scanned without their knowledge. Companies using face recognition should inform their customers 鈥� not only by answering queries from groups such as the ACLU and journalists such as those from Fortune, but by providing notice to customers in their stores.

If companies don鈥檛 think their customers will care, then why won鈥檛 they tell us exactly how they are using face recognition? If companies are afraid that their customers won鈥檛 like hearing that their face prints are being taken, and yet are doing it anyway, then there is a word for that: unethical.

The security wings of these companies may be accustomed to operating in the shadows 鈥� doing everything they can to watch customers without making them feel they are being watched. But face recognition is a brand-new, rapidly evolving technology that has enormous implications for the privacy of individuals in America. It is also a technology that has been found to have . We have to decide whether we want our way of life to be significantly altered by this technology, or whether we want to limit its use to reflect our values. That assessment cannot happen if this face recognition is being arrogantly deployed in secret.

• Wal-Mart Stores - Refused to answer
• The Kroger Co. - Refused to answer
• Costco - Refused to answer
• The Home Depot - Refused to answer
• CVS Caremark - Refused to answer
• Walgreens Boots Alliance - Refused to answer
• Target - Refused to answer
• Lowe's Companies - YES
• Albertsons Companies - Refused to answer
• Royal Ahold Delhaize USA - NO
• McDonald's - Refused to answer
• Best Buy - Refused to answer
• Publix Super Markets - Refused to answer
• Rite Aid - Refused to answer
• Macy's - Refused to answer
• TJX Companies - Refused to answer
• Aldi - Refused to answer
• Disney - Refused to answer
• Dollar General - Refused to answer

What鈥檚 really needed is for retail use of face recogntition technology to be subject to sensible regulation to ensure it comports with basic norms of privacy and fairness 鈥� but until we have that, customers have no choice but to vote with their feet. Some Americans may disagree with the ACLU鈥檚 view that we should not allow this technology to become widespread and routine in American life鈥攂ut we can all agree that people should have the information they need as to whether they want to patronize stores that decide to use it in.

As far as Lowe鈥檚 goes, they deserve credit for at least being willing to answer our question, unlike most of the other companies we contacted, and for disclosing their practices in their online . More credit goes to Ahold Delhaize, which was not only transparent, but is not using face recognition on its customers. Lowe鈥檚 writes to us that 鈥渨e may use facial recognition technologies to identify known shoplifters,鈥� and says that they do not retain facial data on people for whom it does not match to their facial database of suspected shoplifters, which is good as far as it goes. Still, if they鈥檙e going to use face recognition in their stores they should post signs alerting their customers so those customers are meaningfully informed that they are being subject to a virtual lineup.

We don鈥檛 know how widespread facial recognition is in American retail. Shoplifter identification may be the first widespread use, but without meaningful restrictions, it won鈥檛 be the last. Companies are already selling 鈥淰IP recognition鈥� and all kinds of .

These retail applications of face recognition, like the technology鈥檚 unnecessary adoption by Customs and Border Patrol, risks a dangerous normalization of this technology in American life that will clear the path for truly nightmarish uses. These systems are the beginnings of an infrastructure for tracking and control that, once constructed, will have enormous potential for abuse, to create chilling effects, and to change what it means to be in public in the United States.