Which Stores Are Scanning Your Face? No One Knows.

In early February, I spent $171.59 to see the Rangers play the Canucks at Madison Square Garden. I had no plans to watch the hockey game. I just wanted to find out whether my guest, Tia Garcia, a personal injury lawyer, could get into the building.

We got in the security line and walked through the metal detector. Then, as Ms. Garcia turned to pick up her bag from the conveyor belt, a security guard asked her to step aside and show her driver’s license. “Am I in trouble?” she asked.

The guard told her that she would need to wait for management to come speak to her.

He didn’t explain why, but we already knew: Ms. Garcia is one of thousands of lawyers on a ban list because their firms are involved in litigation against the arena’s parent company. While we were in line, facial recognition technology identified her.

“Have you been here before?” the guard asked. When Ms. Garcia told him that she had seen the Cavaliers play the Knicks a few weeks earlier, he expressed surprise. That time, Ms. Garcia had worn a medical mask, a hat and glasses. This time, her face was clearly visible.

Five minutes later, the security manager arrived to officially kick Ms. Garcia out. Even though she had expected it to happen, Ms. Garcia found the deployment of facial recognition technology to punish corporate enemies alarming. So did local lawmakers. The City Council convened a hearing last month to discuss how Madison Square Garden and other local businesses were using the technology.

There were lots of questions to be asked: Who is using it? Who are the people they’re trying to keep out of their businesses? What do they do when the technology gets it wrong and flags a look-alike? Mayor Eric Adams had recently encouraged businesses to use facial recognition to fight shoplifting. Who answered his call? If you shoplift once, are you barred for life?

But the Council had a problem. Madison Square Garden hadn’t sent a representative, as requested. (A spokeswoman for Madison Square Garden said the organization thought its view — that the technology provides a safe and secure environment — was represented by others there.)

And no one at the hearing knew which other businesses were using the technology.

So I decided to find out. New York City has a quirky new law that makes it the only municipality in the country where a business scanning faces has to post a sign telling customers that it is doing so. After I left the meeting, I set off on a miles-long walk in search of those signs. They weren’t where I expected them to be.

A Privacy Walkabout

I left the hearing in Lower Manhattan and walked south, past the clothing retailer Zara and a CVS. Neither had a “biometric identifier information” disclosure, so presumably they weren’t using facial recognition technology.

“Biometric identifiers? What’s that?” an employee at the CVS door asked when I told him about the sign I was seeking. “Biometric identifier” is a fancy term for a unique physical trait, such as a fingerprint, a voiceprint or a scan of someone’s face.

Facial recognition software is typically trained on photos of millions of people, until it learns what to look for in an image to match one face to another. It is not perfect, but has grown more accurate in recent years thanks to advances in artificial intelligence.

Typically, a store using facial recognition technology isn’t trying to identify every customer who walks through the door but rather is looking for faces that have been put on a watch list, such as previous shoplifters. Madison Square Garden has said it created its lawyer watch list by collecting faces from the barred firms’ websites.

I walked a few more blocks south to what I thought would be a sure bet for such a sign: Amazon Go, a convenience store where customers can pay with a palm print. The store was awash in cameras, sensors and palm scanners, allowing shoppers to pick up items and simply walk out without needing to stop at a register. There was a prominent display about the “power in your palm,” with instructions on how to link one’s handprint to an Amazon account.

But even this store did not have what I was looking for. Amazon said that facial recognition technology wasn’t used and that it collected biometrics only from people who volunteered their palms. I bought some mediocre sushi and some water, but with a code from my Amazon app, as I wasn’t quite ready to give Jeff Bezos my handprint.

Only the human kind used here

I made my way north toward the New York Times building in Midtown Manhattan, crossing Canal Street to walk along the distinctive cobblestone streets of SoHo. I popped into a Ralph Lauren where a blue cotton blazer was $790, a Sunglass Hut selling Gucci glasses for $550 and a Louis Vuitton with a $990 sleeveless crop top. None of them had a biometric sign, only many employees who watched me closely.

At Coach, a greeter standing next to high-end purses said that the store didn’t use facial recognition technology, but that he and his fellow employees knew the regular shoplifters by face and would crowd the door when they tried to enter.

“Try Sephora,” he suggested. I did, but there was no sign there. Nor at the Apple, Target or Adidas stores nearby.

The Pew Research Center recently surveyed Americans about their views on facial recognition technology, but only its use by the police, which slightly fewer than half called a good idea. The New York City Police Department has been using the technology since 2011. Less is known about its use by the private sector beyond Madison Square Garden, which started using its system in 2018 to identify security threats.

I walked up the Avenue of the Americas toward Chelsea, passing Old Navy, T.J. Maxx, Marshalls, Trader Joe’s and Best Buy. None of them had a biometric disclosure sign.

The city law that requires the notice went into effect last year. The penalty for failure to post a sign is $500, but the law also prohibits businesses from selling or sharing the biometric information they collect, with damages of up to $5,000 per violation. Private individuals are responsible for enforcing the law; consumers would need to figure out that a business without a sign was secretly scanning their faces or sharing their faceprints with others, and then sue.

“We suspect many businesses are still unaware of the N.Y.C. biometrics law,” said Mark Francis, a partner at the law firm Holland & Knight who focuses on data privacy.

‘Stop grocery store violence and theft’

As I crossed 25th Street, and the pedometer on my iPhone hit nearly 14,000 steps, I finally spotted a sign at the gourmet grocer Fairway Market. A flimsy white piece of paper, titled “Biometric Identifier Information Disclosure,” was taped to a sliding-glass door.

“They use it for security, if people steal,” a Fairway employee told me. The store, he said, used a vendor called FaceFirst; its website promises to “stop grocery store violence and theft.” The employee, who asked not to be identified by name because he wasn’t authorized to speak to a reporter, said a man had been kicked out just that morning because he had previously stolen coffee.

Retail theft has been on the rise since the pandemic. Karen O’Shea, a spokeswoman for Wakefern, Fairway’s parent company, said the facial recognition system was put in place about a year ago.

“Retail theft and shoplifting has a high rate of repeat offense and drives up grocery costs for all customers,” she said. “Only trained asset protection associates use the system, which helps us focus attention on repeat shoplifters.”

After leaving Fairway, I ran into more signs just eight blocks away. When I walked into Macy’s on 34th Street, two fancy white signs were affixed to the gray marble wall, one in English and one in Spanish, informing customers that their “biometric identifier information” was collected for “asset protection purposes.”

A security guard said he didn’t know whether facial recognition was used there. “What signs? Where?” he said, looking around, seemingly confused.

Macy’s did not respond to requests for comment about the signs, but a spokesperson previously told Insider that the company used facial recognition “in a small subset of stores with high incidences of organized retail theft and repeat offenders.”

Help!

Macy’s was just a block from Madison Square Garden, so I swung by to confirm its signs were still on display on poles near the metal detectors. The last six blocks of my trek, past restaurants and retailers on Eighth Avenue, had no obvious biometric signage.

The findings from my four-hour walkabout were confounding. I had checked dozens of stores. The high-end retailers of SoHo apparently weren’t using the cutting-edge technology to protect their expensive apparel, but Fairway Market, with lemons on sale for 99 cents, was. Either we are in the early days of the technology’s deployment or it is not proving as popular with retailers as expected.

My journey was a limited survey of a vast city of many blocks. Walking the whole of it would take something like six years. So, dear reader, I request help. If you are wandering the streets of New York City and spot a biometric identifier information disclosure sign, I invite you to take a photograph, record the location and send it to me at [email protected]. My feet thank you.

Audio produced by Jack D’Isidoro.