Australian Retailers Reportedly Captured Face Prints of Their Customers without Consent

Major Australian retailers reportedly analyzed in-store footage to capture facial features of their customers without consent, which was criticized by consumer groups as creepy and invasive.

Risk classification

• Primary risk domain: 2 Privacy & Security
• Primary risk subdomain: 2.1 Compromise of privacy by obtaining, leaking or correctly inferring sensitive information

The incident primarily involves the unauthorized collection and storage of sensitive biometric 'faceprints' from customers without their explicit consent.

Additional risk subdomains

• 4.1 Disinformation, surveillance, and influence at scale: The deployment of facial recognition across major retail chains was criticized by experts as creating a system of mass surveillance.

Causal factors

• Entity: Human
• Intent: Intentional
• Timing: Post-deployment

The privacy risks and unauthorized data collection were caused by the intentional decision of the retailers' management to deploy facial recognition technology in their stores.

EU AI Act risk tier

• Risk tier: 2 High Risk

High Risk: The system involves real-time biometric identification and facial recognition in public commercial spaces, which is classified as high risk due to its significant implications for fundamental rights and privacy.

AI system and alleged parties

• AI system: facial recognition technology
• AI purpose: Face Recognition; Smart Surveillance
• Behaviour type: Autonomous
• Alleged developer: unknown
• Alleged deployer: The Good Guys, Kmart, Bunnings
• Alleged harmed parties: The Good Guys customers, Kmart customers, Bunnings customers

Harm severity

Severity ratings are based on this scale.

Highest direct severity in any category: Severe. Severity is scored from Negligible to Catastrophic in each harm category, for harm the reports describe as caused directly or indirectly by the AI system.

• Physical: direct Negligible, indirect Negligible
• Infrastructure: direct Negligible, indirect Negligible
• Property: direct Negligible, indirect Negligible
• Financial: direct Negligible, indirect Negligible
• Environmental: direct Negligible, indirect Negligible
• Malicious content: direct Negligible, indirect Negligible
• Differential treatment: direct Negligible, indirect Negligible
• Civil rights: direct Substantial, indirect Negligible
• Democracy: direct Negligible, indirect Negligible
• Privacy: direct Severe, indirect Negligible
• Psychological: direct Negligible, indirect Minor
• Epistemic: direct Negligible, indirect Negligible
• Child sexual exploitation and abuse: direct Negligible, indirect Negligible

Civil rights

Reported: The report explicitly describes concerns raised by human rights and privacy experts regarding mass surveillance and breaches of the Privacy Act.

Directly caused: The unauthorized collection of sensitive biometric data violated customers' fundamental right to privacy.

Inferred additional harm: A broader erosion of civil liberties and privacy rights for millions of Australian citizens shopping at these major retailers.

Privacy

Reported: The report explicitly describes privacy violations concerning the collection of sensitive biometric information without adequate consent.

Directly caused: Bunnings, Kmart, and The Good Guys captured and stored unique biometric 'faceprints' of customers without their explicit knowledge or consent.

Inferred additional harm: Millions of customers had their highly sensitive biometric data collected, analyzed, and stored, violating their expectation of privacy.

Psychological

Reported: The report explicitly describes psychological discomfort and concern among customers, with respondents calling the technology 'creepy and invasive'.

Indirectly caused: Customers experienced distress and anxiety regarding the secure storage of their biometric data and the potential creation of customer profiles.

Inferred additional harm: Widespread mild distress and feelings of violation of personal space and privacy among millions of shoppers who visited these stores.

People affected

• Occurrences reported: 3
• People reportedly exposed: 1000

Potential causes

Management

• Prioritizing Security Over Privacy: Retailers prioritized loss prevention over customer privacy and consent.
• Creeping Use Without Discussion: Deploying invasive surveillance without widespread public consultation.

Technology

• Biometric Faceprint Capture: Technology captures and stores unique biometric data from retail customers.
• Potential Match Inaccuracy: Facial recognition technology is not perfectly accurate, risking errors.

Data Inputs

• Overcollection of Sensitive Data: Retailers collect sensitive biometric faceprints from all entering customers.
• Capture of Children's Biometrics: Systems capture highly personal facial data from infants and children.

Human Factors

• Low Consumer Awareness: Over 75 percent of customers were unaware that FRT was active in stores.
• Unread Privacy Policies: Customers do not search for or read online privacy policies before shopping.

Process and Methods

• Inconspicuous Store Signage: Entrance signs informing customers of FRT were small and easily missed.
• Inadequate Disclosure Processes: Relying on hard-to-find online policies rather than active notification.

Regulatory Environment

• Lack of Clear FRT Regulations: No clear regulations or guidelines exist on the appropriate use of FRT.
• Weak Biometric Consent Laws: Current laws do not sufficiently protect consumers from invasive data capture.

Information quality

• Classification confidence: High
• Reason for confidence: The reports provide clear, consistent details about the retailers involved, the nature of the technology deployed, the public reaction, and the regulatory investigations. The facts are well-documented by a reputable consumer advocacy group and major news outlets.
• Ambiguities identified: The exact number of customers whose data was captured is not specified, and Kmart's specific deployment details were not fully confirmed in their response.
• Alternative interpretations: Retailers interpret the technology as a standard, non-invasive security tool for loss prevention, whereas consumer advocates and experts interpret it as invasive mass surveillance.

Major Australian retailers deployed facial recognition technology to capture biometric data of customers without explicit consent. While raising significant privacy and mass surveillance concerns for millions of citizens, the incident remains a domestic regulatory issue with minor direct national security implications.

• Overall national security impact: Minor
• Scope: Single nation
• Primary target: Australia
• Alleged perpetrator: Bunnings, Kmart, and The Good Guys

Threat characteristics

• Imminence: Long-term. Represents an ongoing regulatory and strategic privacy concern rather than an active, imminent national security crisis.
• Autonomy: Human-supervised. The facial recognition system automatically scans and matches faces, but human staff supervise and act on the generated security alerts.
• Novelty: Established threat. Commercial use of facial recognition and the associated privacy concerns are well-established issues globally.

Impact by dimension

• Physical security: Negligible. No physical threats, kinetic attacks, or critical infrastructure disruptions were reported in connection with this retail technology deployment.
• Information security: Negligible. The incident involves domestic commercial entities and does not compromise national intelligence capabilities, classified models, or state information security.
• Sovereignty: Negligible. This is a domestic retail privacy issue managed under standard Australian regulatory frameworks, with no threat to state authority or government operations.
• Economic security: Negligible. No strategic technology theft, financial system attacks, or critical supply chain vulnerabilities were identified in this incident.
• Societal stability: Minor. The unauthorized biometric collection represents an erosion of privacy rights for millions of shoppers, but the impact is limited and manageable under existing privacy laws.