Stepping into a grocery store almost always entails dealing with surveillance cameras above one’s head. People generally assume that the cameras in the store record what goes on in there. One thing that people do not anticipate in such an environment is software capable of analyzing one’s face into data.
This issue has come to prominence in a privacy battle in western New York. In response, Erie County has now passed a law that blocks most private firms from using biometric data. County Executive Mark Poloncarz signed the Biometric Transparency and Privacy Act on May 26, 2026. The law took effect June 5. It makes Erie County the first county in New York to pass this type of ban.
The law covers face scans, fingerprints, voice prints and eye scans. It bars covered firms from collecting, keeping, using or selling such data in most commercial settings. Penalties in case of businesses that break the law may range from $1,000 to $5,000 per day.
Wegmans put the issue in the spotlight
The debate grew after reports showed that the American supermarket chain Wegmans had started using facial recognition at some stores. In January, Gothamist reported that Wegmans posted notices at its New York City stores. The signs told shoppers that the firm collected biometric data for security.
Wegmans later gave a more limited account of the system. The company stated that they use the technology only in a very few of its stores that have a very high security risk. They claim that this technology helps to identify those people who are known for any bad conduct before.
Wegmans also maintains that they do not gather information on retinal scans and voice prints. It says it keeps facial recognition data only as long as needed for security and then deletes it. The firm has not said exactly how long it keeps the data.
A January probe by Buffalo’s Investigative Post raised another question: Was Wegmans using the same tech in Western New York stores?
The firm did not answer the publication’s questions about local use. Investigative Post reported that Wegmans tracks shoppers through cameras and collects other data at its stores. The company’s lack of transparency regarding its data collection practices drew lawmakers’ attention. And that most likely motivated the passing of Erie County’s new law on biometric data collection.
From disclosure to a ban
Erie County lawmakers first looked at a notice-first plan. New York City already uses that model. New York City’s 2021 law asks some firms to post signs when they collect biometric data. It also bars firms from selling that data.
But Erie County chose a tougher path. The county law generally stops private firms from collecting, keeping, using or selling biometric identifiers. It does not ban normal security cameras. A store can still record video for safety. What the new rule is against is the use of face scans to identify people.
That difference matters. A camera can record what happens in a store. The new law targets the next step: using a person’s physical traits to identify them.
The federal privacy gap
The U.S. has no single federal law that broadly controls private use of biometric data. Instead, firms face a mix of state and local rules.
Illinois, Texas and Washington have laws focused on private biometric data. Other states protect this data through wider privacy laws. That mix gives shoppers different rights from one state to another.
The same privacy tensions are playing out in the digital space. Discord’s 2026 attempt to introduce mandatory age verification, requiring facial scans or ID uploads for users whose age it could not determine, sparked immediate user backlash over privacy concerns. Thousands threatened to cancel subscriptions and move communities to other platforms, forcing the company to delay its global rollout to the second half of 2026 and add alternative verification options like credit card checks.
The risks involved are not only an issue of controversy. For instance, in 2023, the Federal Trade Commission barred Rite Aid from employing facial recognition technology for the next five years due to the lack of reasonable safeguards in the protection of customer data.
The FTC said Rite Aid’s system produced thousands of false matches. The agency also said those errors led to customers facing harassment, searches, removal from stores and police calls.
Government access raises another concern
Privacy groups also worry about what happens when private surveillance data reaches public agencies. Erie County’s law does not bind government agencies when they act within their official work.
It also exempts financial institutions. That means the county law does not set rules for federal agencies such as Immigration and Customs Enforcement, or ICE.
Critics fear that private databases could give public agencies another source of information. They also worry that people may not know when firms share data or answer government requests.
A local model with wider impact
For Erie County Legislator Lawrence Dupre, the law is not the end of the debate. He sees it as a model other counties can consider while state and federal lawmakers debate wider rules.
The law does not stop stores from using cameras. It draws a line between filming what happens in a store and turning a shopper’s face into searchable data. That line could matter more as stores use new tools to spot suspected thieves and other safety threats.
For shoppers, the issue comes down to a simple question: Should walking into a store also mean giving the firm a digital record of your face?
