XPeng Motors Fined For Illegal Collection of Consumers’ Faces Using Facial Recognition Cameras

The Chinese electric vehicle (EV) firm XPeng Motors was fined by local market regulators for illegally collecting in-store customers’ facial images without their consent for six months.

Risk classification

• Primary risk domain: 2 Privacy & Security
• Primary risk subdomain: 2.1 Compromise of privacy by obtaining, leaking or correctly inferring sensitive information

The incident involved the unauthorized collection and processing of highly sensitive biometric facial data from over 430,000 store visitors without their consent.

Causal factors

• Entity: Human
• Intent: Intentional
• Timing: Post-deployment

The privacy violation arose from the human decision by XPeng Motors to deploy facial recognition cameras and collect customer data without obtaining consent.

EU AI Act risk tier

• Risk tier: 2 High Risk

Level 2: High Risk. The system utilizes facial recognition technology to process sensitive biometric data (gender and age) of individuals, which has significant implications for fundamental rights and privacy.

AI system and alleged parties

• AI system: facial recognition camera equipment (Ulucu)
• AI purpose: Face Recognition; Smart Surveillance
• Behaviour type: Autonomous
• Alleged developer: unknown
• Alleged deployer: XPeng Motors
• Alleged harmed parties: XPeng Motors customers

Harm severity

Severity ratings are based on this scale.

Highest direct severity in any category: Severe. Severity is scored from Negligible to Catastrophic in each harm category, for harm the reports describe as caused directly or indirectly by the AI system.

• Physical: direct Negligible, indirect Negligible
• Infrastructure: direct Negligible, indirect Negligible
• Property: direct Negligible, indirect Negligible
• Financial: direct Minor, indirect Negligible
• Environmental: direct Negligible, indirect Negligible
• Malicious content: direct Negligible, indirect Negligible
• Differential treatment: direct Negligible, indirect Negligible
• Civil rights: direct Severe, indirect Negligible
• Democracy: direct Negligible, indirect Negligible
• Privacy: direct Substantial, indirect Negligible
• Psychological: direct Negligible, indirect Negligible
• Epistemic: direct Negligible, indirect Negligible
• Child sexual exploitation and abuse: direct Negligible, indirect Negligible

Financial

Reported: Yes, the report describes a regulatory fine of 100,000 yuan (approximately $15,717) imposed on XPeng Motors.

Directly caused: XPeng Motors suffered a direct financial loss of 100,000 yuan ($15,717) due to the administrative penalty.

Civil rights

Reported: Yes, the report explicitly notes that the unauthorized collection of facial data violated consumers' right to know and privacy rights under Chinese law.

Directly caused: The privacy rights and right to know of 431,623 consumers were directly violated through unauthorized biometric data collection.

Privacy

Reported: Yes, the report explicitly describes the unauthorized collection of 431,623 facial images of store visitors.

Directly caused: The facial recognition system captured and uploaded 431,623 face photos of consumers without their consent or knowledge.

People affected

• Occurrences reported: 1
• People reportedly exposed: 431623

Potential causes

Management

• Prioritizing Metrics over Privacy: Focused on analyzing passenger flow metrics without assessing privacy risks.
• Inadequate Compliance Oversight: Management failed to review store-level technology procurement for compliance.

Technology

• Facial Recognition Cameras: Purchased 22 cameras with facial recognition functions to analyze visitors.
• Third-Party Software Integration: Used Ulucu software which automatically collected and processed facial images.

Data Inputs

• Unconsented Image Collection: Collected 431,623 facial photos without obtaining customer consent.
• Sensitive Biometric Data: Collected highly sensitive facial images capable of identifying individuals.

Human Factors

• Ignorance of Legal Requirements: Staff and buyers were unfamiliar with consumer privacy laws.
• Misjudgment in Procurement: Procured illegal third-party services due to lack of legal awareness.

Process and Methods

• Lack of Consent Process: No mechanism to inform consumers or obtain permission before collection.
• Deficient Third-Party Vetting: Failed to audit the third-party supplier's compliance with local laws.

Regulatory Environment

• Stricter Privacy Regulations: New laws like Consumer Rights Protection Law protect personal biometric data.
• Increased Regulatory Enforcement: Market supervision authorities actively inspect and penalize violations.

Information quality

• Classification confidence: High
• Reason for confidence: The reports are highly consistent across multiple sources regarding the key facts: the number of images collected (431,623), the fine amount (100,000 yuan), the purpose of the collection (passenger flow and demographic analysis), and the lack of consumer consent. There is no conflicting information about the core events.

XPeng Motors illegally collected over 430,000 facial images of store visitors in Shanghai using third-party facial recognition cameras. Regulators fined the company 100,000 yuan, and the data was subsequently deleted. The incident represents a minor commercial privacy violation with negligible national security implications.

• Overall national security impact: Minor
• Scope: Single nation
• Primary target: China
• Alleged perpetrator: XPeng Motors

Threat characteristics

• Imminence: Long-term. The incident is fully resolved, with equipment removed and data deleted, posing no active or near-term threat.
• Autonomy: Full autonomy. The facial recognition system automatically detected, captured, and analyzed customer biometric data without human intervention.
• Novelty: Established threat. Commercial use of unauthorized facial recognition and subsequent privacy regulatory actions are well-established occurrences globally.

Impact by dimension

• Physical security: Negligible. No impact on physical systems, kinetic weapons, or critical infrastructure.
• Information security: Negligible. No intelligence compromise, classified data theft, or foreign disinformation campaigns occurred.
• Sovereignty: Negligible. Standard domestic regulatory enforcement by Chinese authorities, with no threat to state sovereignty or government operations.
• Economic security: Negligible. Minor financial penalty of approximately $15,717 USD imposed on a commercial entity, with no strategic economic threat.
• Societal stability: Minor. Unauthorized collection of over 430,000 biometric facial images constitutes a notable privacy violation, though resolved through standard regulatory action and data deletion.