TL;DR: Most US states have no restrictions on retail facial recognition. Illinois leads with BIPA, allowing lawsuits against stores scanning customers without consent. NYC requires disclosure signs. Connecticut and New York are proposing outright bans. Erie County (NY) is drafting local legislation after Wegmans revelations. This guide maps where you're protected, and where you're being scanned.
The Retail Surveillance Landscape
Wegmans made headlines in January 2026 for admitting it uses facial recognition in a "small fraction" of stores.[1] But they're not alone. Target, Walmart, Rite Aid (before bankruptcy), and other major retailers have deployed or tested the technology.
Here's the ugly truth: in most of America, stores can scan your face without telling you, without consent, and without any restrictions on what they do with that data.
This guide covers:
- States with strong protections (you can sue)
- States with disclosure requirements (they must tell you)
- States with proposed legislation (protection coming)
- States with nothing (you're on your own)
🟢 Strong Protection: Private Right of Action
These states allow individuals to sue companies for biometric privacy violations, without requiring proof of harm.
Illinois – BIPA (Biometric Information Privacy Act)
Effective: 2008
What it requires:
- Written notice that biometric data is being collected
- Written notice of purpose and retention duration
- Written consent before collection
- Publicly available retention schedules
- Reasonable security standards for storage
Penalties:
- $1,000 per negligent violation
- $5,000 per intentional or reckless violation
- Private right of action: individuals can sue directly
Major Retail Lawsuits Under BIPA
Target
Status: Lawsuit proceeding (November 2024 ruling)
Allegations: Facial recognition for shoplifting detection without consent[2]
Walmart
Status: Multiple class actions filed
Allegations: Facial recognition surveillance; use of Clearview AI[3]
Roundy's (Mariano's)
Status: Lawsuits filed (2017)
Allegations: Fingerprint scanners for employee timekeeping without consent[4]
2024 Amendment: Illinois amended BIPA to potentially limit damages from per-instance to per-person in common scenarios, reducing class action exposure for companies.[5]
Washington – HB 1493
Effective: 2017
Prohibits commercial use of facial recognition for identification without consent. Does not apply to security cameras without facial recognition capability.
Texas – CUBI (Capture or Use of Biometric Identifier Act)
Effective: 2009
Prohibits capture of biometric data for commercial purposes without consent. However: only the Texas AG can enforce, no private right of action.
🟡 Disclosure Requirements
These jurisdictions require stores to inform customers about facial recognition use, but don't prohibit it.
New York City
Effective: July 2021 (Local Law 3)
Requirements:
- Conspicuous signage at entrances if facial recognition is in use
- Must be "clear and conspicuous"
- Applies to any business collecting biometric data
Penalties: $500 per day of violation
Limitation: Only disclosure: doesn't require consent or restrict use
Wegmans example: Wegmans posts facial recognition disclosure signs in NYC stores because the law requires it. In other states without disclosure laws, they don't post signs, even though the same technology may be active.[1]
Maryland – HB 33 (Limited)
Restricts facial recognition use by private entities in some contexts. Less comprehensive than Illinois BIPA.
Portland, Oregon (City)
Effective: 2021
Banned private use of facial recognition in places of public accommodation, one of the strongest local bans. But applies only to city of Portland.
🔵 Proposed Legislation (2026)
These states are actively considering retail biometric restrictions.
Connecticut
Status: Bill expected in 2026 legislative session[6]
Proposal: Ban facial recognition, retinal scans, and voiceprints in retail stores statewide
Trigger: Wegmans disclosure in January 2026 prompted legislative response
New York State
Status: Bill sponsored by Senator Rachel May (2025), advancing in 2026[7]
Proposal: Prohibit biometric surveillance in places of public accommodation, including supermarkets
Trigger: Wegmans disclosure about NYC stores
Erie County, New York (Local)
Status: County Executive Mark Poloncarz drafting legislation (January 2026)[1]
Proposal: Ban retailers from collecting customer biometric data
Trigger: Direct response to Wegmans, which is headquartered in Rochester (near Erie County)
🔴 No Specific Protections
The majority of US states have no laws specifically addressing retail facial recognition. General privacy laws may provide limited protection, but nothing specifically targets biometric surveillance in stores.
States with no retail biometric-specific protections include:
Alabama, Alaska, Arizona, Arkansas, Colorado, Delaware, Florida, Georgia, Hawaii, Idaho, Indiana, Iowa, Kansas, Kentucky, Louisiana, Maine, Michigan, Minnesota, Mississippi, Missouri, Montana, Nebraska, Nevada, New Hampshire, New Jersey, New Mexico, North Carolina, North Dakota, Ohio, Oklahoma, Oregon (outside Portland), Pennsylvania, Rhode Island, South Carolina, South Dakota, Tennessee, Utah, Vermont, Virginia, West Virginia, Wisconsin, Wyoming
What this means: In these states, retailers can:
- Install facial recognition without telling you
- Scan your face without your consent
- Compare your face to watchlists
- Keep the data indefinitely
- Share the data with third parties, including law enforcement
And you have no legal recourse specifically for the biometric collection itself.
Which Retailers Use Facial Recognition?
Retailers are notoriously secretive about surveillance capabilities. Here's what's been confirmed or alleged:
| Retailer | Status | Source |
|---|---|---|
| Wegmans | Confirmed in "small fraction" of stores | Company statement Jan 2026[1] |
| Target | Alleged in BIPA lawsuit (Illinois) | Court filings Nov 2024[2] |
| Walmart | Alleged in BIPA lawsuits (Illinois) | Multiple class actions[3] |
| Rite Aid | Confirmed (discontinued after FTC action) | FTC settlement 2024 |
| Albertsons/Safeway | Tested facial recognition technology | Industry reports |
| Amazon Fresh/Go | Palm scanners (biometric, not facial) | Company disclosures |
The unknown: Many retailers use security camera systems capable of facial recognition but don't disclose whether the feature is active. Absence of disclosure ≠ absence of surveillance.
What You Can Do
If You're in Illinois
Exercise your BIPA rights. If you believe a retailer scanned your face without consent, consult a privacy attorney. Class actions have paid out significantly.
Ask Directly
Ask store managers: "Does this location use facial recognition?" Their answer (or non-answer) is informative. Document the response.
Support Legislation
If you're in Connecticut, New York, or Erie County: contact your representatives. These bills need constituent support to pass.
Shop Elsewhere
In unprotected states, your only real power is your wallet. Tell retailers you'll shop at stores that don't scan faces. Make them choose between surveillance and customers.
Defeat the Technology
Glasses, hats, masks, and strategic makeup can reduce facial recognition accuracy. Not foolproof, but raises the barrier.
File Complaints
Even in states without specific laws, file complaints with your state attorney general. Pattern of complaints can trigger investigations.
The Bottom Line
Illinois is the only state where you can actually sue a retailer for scanning your face without consent. A handful of cities require disclosure. Connecticut and New York might ban it entirely. Everywhere else, you're unprotected.
The Wegmans revelation in January 2026 sparked a wave of legislative proposals. But legislation takes time. In the meantime, retailers are scanning faces in states with no restrictions, and there's nothing legally stopping them.
Monitor your state's legislation. Support biometric privacy bills. And consider whether the convenience of a particular store is worth becoming a data point in their surveillance system.
References
- CBS News - Wegmans Confirms Facial Recognition in Stores (January 2026)
- ID Tech Wire - Target Must Face BIPA Lawsuit (November 2024)
- Milberg Law - Walmart BIPA Facial Recognition Lawsuits
- Biometric Update - Roundy's/Mariano's BIPA Lawsuit (2017)
- Proskauer - Illinois BIPA 2024 Amendment Analysis
- GovTech - Connecticut Lawmakers Propose Retail Facial Recognition Ban (2026)
- Central Current - New York Biometric Surveillance Ban Bill (2025)
- NCSL - State Biometric Data Legislation