Your Face Got Scanned at Wegmans. Nobody Had to Tell You.

Wegmans — yes, the grocery chain that New Yorkers treat like a religion — admitted earlier this year that it had been using face-scanning technology at some of its stores. Not a huge announcement. No press release. Just a quiet acknowledgment that, yes, the system was running. Shoppers had no idea.

That Wegmans moment is exactly why Monroe County legislators are now pushing a bill that would require any retailer using biometric identification technology to say so — plainly, visibly, before you walk in. Not buried in a terms-of-service document. Not footnoted on a website. A real, honest heads-up.

This sounds obvious, right? Of course you should know if a store is scanning your face. And yet, in most of the country, nobody has to tell you anything.

What "Biometric Data" Actually Means Here

Let's be precise, because this word gets thrown around loosely. Biometric data is information that comes from your body — your face, your fingerprints, the pattern of your voice. The kind of data that's uniquely, permanently you. You can change a password. You cannot change your face.

When a retailer uses a face-scanning system at the entrance or inside the store, it doesn't just take a photo. It converts your face into a mathematical template — a string of numbers that represents the specific geometry of your features — and then stores that template. For future comparison. For matching against a database. Potentially for sale to a data broker, depending on what the retailer's contract allows.

That last part is the piece that makes this categorically different from a regular security camera. A standard camera records footage and, in most cases, deletes it after a few weeks. A biometric system builds a file on you. There's a meaningful difference between "we recorded you walking past the dairy section" and "we created a permanent mathematical identity signature from your face and kept it." This article is part of a series — start with Your Face Was Scanned Saturday Nobody Asked If That Was Lega.

Illinois passed a law called BIPA — the Biometric Information Privacy Act — that lets you actually take a company to court if they collect your biometric data without consent. It has teeth. It has produced real lawsuits and real settlements. The rest of the country? According to BCLP's U.S. biometric laws tracker, most states have general privacy laws that offer limited, often untested protection — and nothing specific to what happens when a retailer scans your face on a Tuesday afternoon while you're picking up milk.

What Monroe County Is Actually Proposing

The Monroe County bill, as reported by 13WHAM, has three core requirements. First: businesses must tell customers they collect biometric data, clearly and at the point of entry. Second: they cannot sell or transfer that data to third parties. Third: any stored data must be destroyed after two years.

That two-year destruction requirement might be the most important part of the whole thing, and it's also the part getting the least attention. Permanent data retention is where the real risk lives. A shoplifter database that gets breached next year is one problem. A shoplifter database that's been accumulating for a decade, sold to an insurance company or an employer, is a fundamentally different problem.

"Constituents were extremely concerned that biometric data was being collected without their knowledge and consent." — Legislator Rachel Barnhart, as reported by Rochester First (WROC)

Barnhart is the legislator pushing the bill. She's not calling for a ban. The word "ban" doesn't appear in this proposal. The ask is genuinely minimal: be honest with the people walking through your door.

Not everyone agrees that even this is reasonable. Sean McCabe, who leads the Legislature's Republican caucus, called the measure more of a hindrance to businesses than a protection — arguing it could get in the way of fighting shoplifting and fraud, which has become a serious and growing problem for retailers. That concern deserves to be taken seriously. Organized retail theft is real, the costs are real, and these systems do catch people.

But here's the thing: if a face-scanning system truly only flags known shoplifters, a sign at the door doesn't stop it from working. The sign doesn't disable the camera. It just tells the truth. Previously in this series: That Urgent Video From Your Boss Watch How The Face Moves No.

The Spectrum From "Tell Us" to "Absolutely Not"

Monroe County's proposal sits in the middle of a rapidly forming range of local responses to retail face-scanning, and understanding where it sits helps you understand what's actually being debated.

On one end: Erie County, New York, which didn't just require disclosure — it banned the collection of biometric data by retailers outright. That's the hard stop. No scanning, period. According to ID Tech Wire, Monroe County legislators are watching what Erie did and considering whether disclosure is a sufficient first step or just a placeholder until a harder rule becomes politically possible.

On the other end: most of America, where there is currently no requirement to disclose anything, to anyone, at any time.

Monroe's bill is the middle position. Disclosure, not prohibition. And it matters precisely because it's the middle position — it's the kind of rule that can actually pass in places where an outright ban would stall. It's the version of this fight that could spread.

What "Just a Sign" Actually Unlocks

Here's something that doesn't get said enough about disclosure requirements: they're not the endpoint. They're the starting gun.

Right now, if you're a shopper and you suspect a store is scanning your face, you have almost no way to confirm it, challenge it, or opt out of it. The technology is invisible by design. Once disclosure is required — once that sign has to appear at the door — something shifts. You know. And knowing changes the dynamic entirely. Up next: Your Face Got Scanned At Wegmans Nobody Had To Tell You.

Suddenly, reporters can ask: "Your sign says you collect biometric data. Who's your vendor? How long do you keep it? Have you ever had a breach?" Legislators can ask the same. So can lawyers. The sign doesn't solve the problem, but it makes the problem visible. And visible problems get fixed faster than invisible ones.

If you've ever wondered whether a store, an app, or a service is really who — or what — it claims to be, that's the exact instinct this kind of transparency rule is designed to support. The practical thing you can do right now: next time you walk into a large retail store, look for any notices near the entrance about security systems or data collection. They're not required in most places yet, but some stores post them voluntarily. The absence of any notice, given how widely these systems are being deployed, is itself information.

As State of Surveillance's state-by-state guide makes clear, the patchwork of laws here is not an accident — it reflects genuine, ongoing disagreement about who owns your face in a commercial space. Is it you? The store? The vendor the store hired? The answer right now is: whoever gets to it first, with the best lawyers.

Monroe County is trying to change that calculation by one small, specific degree. Enough to make the technology visible. Enough to let the next question get asked out loud.

Here's the question worth sitting with: a store posts a sign that says they scan faces for security. Does that sign make you feel informed — or does it make you wonder, for the first time, who else has been looking at your face for the past two years without one?