TL;DR: An ACLU investigation published January 20, 2026 reveals that major retailers including Wegmans, Macy's, and Lowe's aren't just scanning faces for shoplifters. They're running customers against law enforcement "BOLO" (Be On the Look Out) lists. Police submit photos; retailers scan every shopper; matches get flagged. At least 10 wrongful arrests from facial recognition errors have been publicly documented, primarily affecting Black individuals. The retailers refuse to disclose which stores use the technology, their accuracy rates, or how customers can challenge false matches.
What the ACLU Found
Jay Stanley, senior policy analyst at the ACLU's Speech, Privacy, and Technology Project, published findings on January 20, 2026 that go beyond the shoplifting narrative retailers have been selling.[1]
The investigation reveals:
- Law enforcement integration: Retailers scan faces against police-provided BOLO lists, not just internal shoplifter databases
- No consent required: Customers are scanned the moment they walk in, often with no signage
- Zero transparency: Companies refuse to say which stores use the tech, retention policies, or accuracy metrics
- Immigration concerns: The setup could facilitate federal immigration enforcement operations
This isn't stores protecting inventory. This is private businesses acting as surveillance infrastructure for law enforcement.
The Retailers Scanning You
The ACLU names specific chains:[1]
Wegmans
Confirmed facial recognition in "a small fraction" of stores. Admits scanning against law enforcement lists.
Macy's
Uses facial recognition technology in stores. Refuses to disclose details.
Lowe's
Has deployed facial recognition. Won't say which locations or what databases are accessed.
Madison Square Garden
Notoriously bans lawyers whose firms sue MSG, using facial recognition to spot them.
Previous reporting has also connected CVS, Home Depot, Target, and Walmart to similar technology deployments. The pattern is industry-wide.
The Wrongful Arrests
The ACLU documents at least 10 publicly reported cases of wrongful arrests tied to facial recognition errors.[1]
A pattern emerges: the technology fails more often on Black faces. The victims are disproportionately Black individuals who get detained, arrested, and charged for crimes they didn't commit, because an algorithm said they matched.
Cases include people held for hours, forced to post bail, and living with arrest records for things they never did. All because a camera at a store made a mistake.
And those are just the public cases. How many misidentifications happen and get "resolved" with a quiet release and no record? Retailers aren't saying.
The Police Pipeline
Here's how it works:
- Law enforcement provides photos of people they're looking for, the BOLO lists
- Retailers add these to their facial recognition databases
- Every customer's face gets scanned on entry
- If the algorithm finds a match, security is alerted
- Police may be called immediately
This creates a distributed surveillance network that police couldn't legally build themselves. No warrant required. No probable cause. Just walk into a store and get scanned against a police watchlist.
The ACLU raises a particular concern: immigration enforcement. If ICE submits photos to these systems, retailers become immigration checkpoints. Buy groceries, get flagged for deportation.
You Can't Challenge It
Say you're flagged as a match. What can you do?
Nothing, really.
Retailers don't have to tell you they scanned your face. They don't have to tell you about a false match. They don't have to explain why security approached you or why you've been banned.
There's no process to challenge your inclusion on a watchlist. No way to prove you're not the person the algorithm thinks you are. No appeal.
The FTC forced Rite Aid to stop using facial recognition in 2023 after finding the chain deployed the tech in mostly non-white neighborhoods and didn't have proper safeguards.[2] But that was one chain. The rest keep operating in the dark.
Protecting Yourself
Shop Elsewhere
Avoid chains known to use facial recognition. Support local businesses that don't scan faces.
Ask Directly
Ask store managers if they use facial recognition. Their answer, or refusal to answer, tells you something.
Look for Cameras
Face-height cameras at entrances are the giveaway. Regular security cameras sit high; face scanners need a clear shot of your face.
Support Legislation
Contact your state legislators. Erie County is drafting retail biometric bans. Illinois BIPA shows it works.
Wearing masks or sunglasses can reduce accuracy, but modern systems are getting better at partial-face matching. The only real solution is regulation that prevents this surveillance in the first place.
The Bigger Problem
Retailers frame facial recognition as a shoplifting solution. But shoplifting losses don't justify turning every customer into a suspect.
What we have is private infrastructure doing government surveillance. Police can't legally install cameras in every store and scan every shopper. But retailers can. And they're happy to share.
When you walk into Wegmans to buy milk, you're scanned. Your face is compared to a police watchlist. If the algorithm makes a mistake (and it makes plenty, especially on Black faces) you could end up in handcuffs.
That's not a grocery store. That's a checkpoint.