Grocery Outlet Scans Your Face While You Shop. Critics Say It’s a Privacy Problem
This week, Lee Hepner rode his bike to the Grocery Outlet in the Mission District in San Francisco — but not to go shopping.
He was looking for a postcard-sized sticker on the front door that some might miss, alerting customers that the store was scanning the face of every person who walked in.
“Face Matching software is being used to prevent shoplifting,” the sign read, accompanied by a QR code with information about opting out of your data.
“Rarely do I have a situation where surveillance technology is popping up in my backyard,” said Hepner, senior legal counsel at the American Economic Liberties Project. In 2019, he helped write policy making San Francisco the first city in the country to bar its own agencies, including police, from using facial recognition.
Inside, he counted three cameras near the entrance and dozens more down every aisle and over every checkout.
“It is just blanketed with surveillance cameras,” he said.
Emeryville-based Grocery Outlet has rolled out software by an AI company called SAFR Guard at several Bay Area stores, including Pleasant Hill and the San Francisco location Hepner visited.
The technology is designed to identify people suspected of shoplifting, according to its privacy policy, and notifies employees if someone on a watchlist enters a store. SAFR Guard builds a database of “subjects of interest” across the retailers using it, Hepner said — meaning whoever lands on a watchlist at one store can follow them to another.
It’s part of a quiet spread of automated anti-theft tools into neighborhood groceries and retail businesses. As retail theft rates have increased in recent years — shoplifting in California was 47.5% higher in 2024 than before the pandemic, according to the Public Policy Institute of California — companies like Target, Walmart and grocers like Wegmans have introduced the software.
And it’s legal in California, according to the state’s consumer privacy laws. Businesses must notify customers that facial recognition is in use, and shoppers can “opt out” by petitioning the company to delete their data — or by not entering the store.
“This is a dragnet that scans everyone. Even if you’ve done nothing wrong, your face is being scanned,” said Mario Trujillo, a staff attorney at the Electronic Frontier Foundation.
Hepner said that opting out may not be a realistic financial option for many discount grocery customers.
“Grocery Outlet is one of the only, if not the only, grocery store that caters to low-income [people]” in the Bay Area, he said. “It’s not as if a lot of these shoppers have the choice to go shop somewhere else. It is essentially a tax on their privacy assessed every time they go to the grocery store to put food on the table.”
Civil-liberties advocates have long raised alarms over the risk of misidentification. In December 2023, the Federal Trade Commission banned Rite Aid from using facial recognition for five years after finding the chain’s system falsely tagged shoppers — disproportionately women and people of color — as shoplifters, leading employees to accuse innocent customers of wrongdoing.
Hepner said San Francisco banned the technology for government use precisely because research shows it “disproportionately misidentified people with darker complexions and faces of women.”
SAFR Guard defends the system as narrow and privacy-conscious. In a statement, company President Charisse Jacques said the software “is not a law enforcement system and has no connection with law enforcement,” and it does not build “a general-purpose face matching database of the public.”
The system only holds data on people a retailer has added to a security list after an incident, such as suspected theft, Jacques said. According to their privacy policy, records on suspected individuals are kept for up to 12 months, while encrypted images and general CCTV footage are automatically deleted after 30 days.
Shoppers who aren’t matched to that list are never stored at all: their biometric data “never leave the camera and are immediately deleted.” She said that SAFR has never shared retailer or shopper data with any government agency, including ICE, and has never received a court order or subpoena for it.
Grocery Outlet did not respond to requests for comment.
Hepner doesn’t dispute that the store’s current privacy policy is narrow. His worry is what would happen if the software is abused.
“Today it’s just facial recognition for the purpose of preventing crime,” he said. “But tomorrow, this technology, without changing the camera, with only tweaks to the back-end software, can be used to surveil workers, can be used to collect information from every shopper who enters the store.”
Major chains like Kroger are experimenting with dynamic pricing — or using personal data and tracking to adjust prices for each customer — and the ACLU reported in January that Wegmans shares information with law enforcement.
Beyond markets, bars in the Castro have begun scanning patrons’ faces at the door with ID-verification software, he noted — bars he said he now avoids.
A patron database “may not seem like a big problem” in San Francisco but carries real risk “under a broader federal regime that’s increasingly cracking down on trans rights and on gay rights,” he said.
Trujillo recommended a change to state law in line with what Illinois and Colorado are doing, requiring stores to seek out affirmative consent from consumers.
Hepner worries the drift is heading the other way. This week, the San Francisco Board of Supervisors gave final approval to a broad “code cleanup” ordinance that loosens the very oversight law he helped write by slashing the city-required audit of each department’s surveillance technology to at least once every five years.
“You make policy to address the risk of harm,” he said, “even if that harm is on the fringes of the use of that technology, because I can guarantee you it will be mainstream tomorrow.”