Wegmans Biometric Data: Facial Recognition Technology Risks

Harvey Murphy Jr. was in Sacramento, California, when a store robbery happened in Houston, Texas. He still ended up in jail. If you searched wegmans biometric data tonight, this is the worry underneath the search: what happens when a store camera decides it knows your face? (Murphy's case involved other stores, not Wegmans. Hold that thought, because it matters later.)

Wegmans biometric data: what that short sign at the door really says

Start with what is on the record. According to the NYCLU, Wegmans posted notices at stores in Manhattan and Brooklyn. The notices warn that anyone walking in could have data about their face, eyes and voice collected and stored. That is biometric data (body measurements that are uniquely you, like your face shape, your eyes and your voice).

The sign is short. Nobody reads it. You are carrying groceries, your kid is asking for a cookie, and the door is already open. The notice says collection may happen when you walk in.

Wegmans biometric data news: what has been reported

Here is the plain version of the news. A popular supermarket chain told shoppers, on a sign, that it may be collecting biometric information at some New York City stores. That is how reports like "wegmans collects biometric data" and "new york city are now collecting biometric data" started spreading. I can only tell you what the sign and the NYCLU describe. I cannot tell you how the chain uses it day to day, or how long it keeps anything.

What does facial recognition actually do with a face? Here is the basic idea, with no math degree needed. The software measures things like the distance between your eyes and the width of your nose, then turns them into a long string of numbers. Think of it as a "face fingerprint." To identify people, it compares that string against a list of other strings and says which ones look closest.

Notice the word closest. The software never says "this is definitely Harvey." It says "this is the nearest thing on my list." Hold on to that, because the rest of this article hangs on it.

---

How a facial recognition match turns into a jail cell

Murphy's lawsuit, covered by CNN, says a facial recognition system tied him to a retail robbery in Houston. He was arrested in October 2022. He says he was in Sacramento at the time. The lawsuit alleges he spent two weeks in jail and was sexually assaulted by three men there. These are allegations in a lawsuit, not court findings, but they show what a wrong match can cost.

The footage the system worked from was reportedly low quality. A low-resolution image can erase facial detail, a tilted camera changes the angle of features, and poor lighting can hide or shadow them.

A facial-recognition match is a lead, not proof: it still needs a person to check the image quality and the suspect's whereabouts. This article is part of a series, start with Deepfake Laws By State 8 States Push Chatgpt Id Checks.

The technology problem: why a high score is not proof

Here is the part that surprises people. The technology hands back a confidence score, like 95 percent. That sounds like "95 percent sure it's him." It is not. The score says how alike two sets of numbers are. It does not know the picture is grainy. It does not know the person lives 1,700 miles away. A confident wrong answer looks exactly like a confident right one.

Try this picture. Imagine a stadium with 100,000 people and a search tool that is wrong 5 percent of the time. That is an illustration, not a real test result, but the math is simple. Five percent of 100,000 is 5,000 people who look close enough to get flagged. The tool will always find someone who resembles the suspect. It cannot tell you if it found the right someone.

Can facial recognition in a store get the wrong person arrested?

Yes. It has happened. Murphy's case is one example. The Federal Trade Commission found another when it banned a pharmacy chain from using facial recognition for five years. The FTC said the retail chain falsely accused customers of crimes based on the facial recognition technology. Employees followed shoppers around, searched them, ordered them out and called police.

---

Wegmans biometric data and a driver's license breach

Now we reach the Wegmans part, and I want to keep it exact. The harm on record for Wegmans is a data breach, not a wrongful arrest. In 2022 the New York Attorney General secured $400,000 from the company after personal information on more than three million consumers was exposed. The New York Attorney General describes a cloud storage container left misconfigured (set up wrong, so it was open when it should have been locked). Exposed data included driver's license numbers, names, emails, addresses, usernames and passwords.

Security: what the 2022 breach exposed

The security gap lasted from January 2018 until April 2021, according to the researcher's summary of the settlement. That is more than three years. Think about what that teaches. A company that asks for your face at the door has also, on record, once left customers' ID details sitting open. Neither fact proves the other. Together they tell you to ask a plain question: how well is this place guarding what it already holds?

Here is why that matters more for faces than for credit cards. If your card leaks, the bank sends a new one. You cannot get a new face. Biometric data is permanent, so a leak is permanent too. The breach shows why protecting face data demands more care than protecting a password.

Review: what the three cases have in common

A quick review of the three cases shows one pattern: each involved a failure to verify or protect personal information before harm followed. Here is the side-by-side.

Case	What went wrong
Murphy v. retailers (Jan 2024 lawsuit)	Facial recognition allegedly matched him to a robbery while he was in Sacramento; he says jail followed
Pharmacy chain and the FTC (Dec 2023)	Retail customers falsely accused of crimes; five-year ban on facial recognition
Wegmans and the state attorney general (June 2022)	Breach exposed data on more than three million customers; $400,000 settlement

Here is the FTC's own announcement if you want the primary source on the pharmacy-chain case.

---

The misconception: "It's just a rare glitch that could hit anyone"

Most of us believe this, and for good reason. Companies advertise accuracy as a big friendly number: 95 percent, 99 percent. That sounds like "almost never wrong." And if errors were truly random, a few unlucky people would get hit and that would be that. Previously in this series: Deepfake Financial Fraud 40b Problem 1 Habit To Stop It.

But the FTC found the errors were not random at the pharmacy chain. The system disproportionately flagged women and people of color. According to the researcher's summary, false matches were more likely in stores in largely Black and Asian neighborhoods, and the technology was concentrated in stores where more shoppers were likely to be Black, Asian or Latino. One cause is the data the systems learn from, which skewed toward lighter skin. Another is where the cameras were placed and who got watched. A glitch that lands on the same people again and again is not a glitch. It is a pattern.

Why "wegmans monitors" is the wrong thing to fear first

It is natural to ask whether wegmans monitors you at the door. The better question is what happens after any store surveillance camera flags someone. Does a human check it? Does anyone look at where you really were? Murphy's case, as alleged, shows what it looks like when nobody does.

---

What to do now to keep your face and your ID safe

Here is the good news. Most of the useful moves are small, and they sit on your side of the counter.

Privacy: what to refuse to hand over

Your biometric privacy is partly a matter of saying no. Do not hand over your driver's license for a loyalty card, a coupon or a raffle. Do not agree to face or voice sign-ins when a plain password works. If you do not shop somewhere, you owe it nothing. If you do shop there, you still get to ask what it collects and to read its written privacy policy. A state attorney general's office takes data privacy complaints about stores that mishandle your information.

Tell your kids this one too. If a store worker stops them, they should stay calm, say they want a parent, and not argue about who they are.

Account: lock down the logins that matter

Sign in to your own account at your phone's maker or your main email provider, the ones you already have, and turn on two-step sign-in. Then change any password you reused. The 2022 exposure included usernames and passwords, and the researcher notes that reused passwords can open other doors.

Email: the quiet back door

Your email is the master key, because "forgot password" links land there. Check your inbox for notices about a breach that mentions your license. If your driver's license data may have leaked, IdentityTheft.gov is the federal place to report it and get a recovery plan, and your state DMV can tell you about flagging a license number. If you spot fraud, you can report it to the FBI at ic3.gov.

If it were happening to you tonight, where would you look first?

Write this down before you need it. Copy out where you were and when: receipts, a phone location history, a photo with a time stamp. Save the name of the store and the date. If police come, ask what evidence they have, ask for a lawyer, and do not argue the point on the sidewalk. Your alibi is the one thing a face match can never see.

Here is where CaraComp comes in. People who study facial recognition technology for a living make one rule: a match is a lead, never a verdict. A real investigator checks the picture quality, checks where the person was, and gets a second human to look. The Murphy case, as alleged, is what happens when that step is skipped. Up next: Wegmans Biometric Data Face Scans After 3m Customer Leak.

So when you see that short sign at the door, you are not really being asked about groceries. You are being asked whether you trust a machine that can only say "closest," and a person who may never check whether "closest" was you.

wegmans biometric data: Frequently Asked Questions