Facial Recognition Surveillance Cameras: Australia's Retail Rules

Picture this: you walk into a hardware store to grab a box of screws. Before you even touch a cart, a camera above the door has already scanned your face, compared it to a database, and logged that you were there. You didn't sign anything. You didn't press "agree." You just... walked in.

That's not a dystopian movie plot. That's what two major Australian retailers, Kmart and Bunnings, the kind of stores you'd find in any suburb, were doing. And last week, Australia's privacy watchdog finally drew a hard line in the sand.

The Office of the Australian Information Commissioner, the government body that enforces privacy rules there, published fresh, specific guidance for retailers who want to use facial recognition in their stores. The short version: you can't just point a camera at everyone and call it security. You have to prove you actually need it. You have to tell people. And you have to have real protections in place so the wrong person doesn't get flagged as a shoplifter.

This might sound like far-away news. It isn't. Because the same technology is quietly showing up in stores near you, right now, with far fewer rules attached.

---

How Facial Recognition in Retail Became Widespread

Facial Recognition Surveillance Cameras: The Basics

Facial recognition surveillance cameras work differently than the security cameras you grew up with. A security camera just records; a facial recognition system takes that footage and runs it through recognition software that maps points on your face and checks them against a stored list. That single extra step, the matching, is what turns an ordinary security camera into something regulators now treat as a data collection tool, not just a safety device.

Retail facial recognition, cameras that scan your face when you walk in and compare it against a list of known shoplifters or banned individuals, has been creeping into stores for years. For a long time, it lived in a legal gray zone. Stores treated it like a security camera with extra features. Privacy advocates treated it like a surveillance dragnet. Regulators mostly looked the other way.

Then Kmart and Bunnings got caught. Both retailers had been scanning the faces of every single customer who walked through their doors, not just people they suspected of anything. Every shopper. Every day. A retired teacher picking up a lamp. A dad buying a garden hose. All of them scanned, matched, logged. The Australian privacy authorities investigated and found both companies had broken the law.

Those cases set the legal ground rules. Now the regulator has turned that case-by-case enforcement into written guidance, a playbook that tells every retailer exactly where the line is. This article is part of a series, start with Face Detection Before Identification How Facial Analysis Act.

That jump, from 27% to 45%, is not small. That's almost half the population moving from "meh, it's fine" to "actually, this worries me." And public opinion tends to drag regulation behind it, which is exactly what happened here.

---

What the New Rules Actually Say (In Human English)

The guidance from the Office of the Australian Information Commissioner boils down to four tests that any retailer must pass before they can legally run a facial recognition system on shoppers.

How Security Cameras Differ From a Security Camera With Face Recognition

A plain security camera watches an area and stores video for later. A security camera equipped with facial recognition does something more: it identifies specific people in that video, in real time, and compares faces against a watchlist. That difference is exactly why regulators started treating cameras with face recognition as their own category, separate from ordinary security cameras, and why the necessity test exists at all.

The piece that matters most for regular shoppers is the necessity test. It kills the lazy approach. Stores can't just say "facial recognition helps our security" and call it done. They have to prove no simpler option would work. That's a high bar, and deliberately so.

As SC Media reported, the guidance makes clear that regulators acknowledge how hard it is to get consent from every single customer walking through a door. But that friction, the inconvenience of asking, cannot be used as a reason to skip asking entirely. Retailers must either find a narrow legal reason they don't need consent, or they need to actually get it.

"Retailers cannot collect broad watchlists of all faces for fraud prevention; they must prove the system is proportionate and that less intrusive alternatives don't exist." Analysis of OAIC guidance, GRC Report

Surveillance, Not Just Security

Calling this "security" undersells what's actually happening. Surveillance means ongoing, systematic watching, and when a system logs faces of everyone who walks past, that's surveillance, whether or not a crime ever occurs. The word matters because surveillance carries different legal weight than a one-time security check, and the new guidance treats it that way.

---

Australia's New Privacy Protections Explained

What "System" Means in This Context

When people say "the system flagged me," they mean the whole pipeline: the camera capturing your face, software converting it into a facial recognition template, and a database comparing that template to a watchlist. Each piece of that system has to meet the necessity and safeguards tests on its own, a camera alone isn't the problem, but the system built around it can be.

Australia has rules now. Most of the United States does not.

According to data tracked by State of Surveillance, most U.S. states have no specific laws covering how retailers can use facial recognition on shoppers. A handful of states have moved toward banning it or restricting it. Most have done nothing. That means retailers in those states are largely operating on their own judgment, and their own business interests.

Your Rights When You Walk Past a Camera

Even without a federal law, you still have practical rights worth knowing. You can ask a store, in plain language, whether its cameras use face recognition rather than plain video. You can ask what happens to your image after you leave, and you can walk out and shop elsewhere if the answer is vague, a choice that, in Australia, regulators are now trying to make meaningful rather than symbolic.

Here's the scale of what we're talking about: according to National Retail Federation data reported by The Spokesman-Review, 18% of retailers were already piloting or had implemented facial recognition by 2025, up from 12% just three years earlier. That's not fringe tech anymore. That's one in five retailers, growing fast, in an environment where most consumers have no idea it's happening. Previously in this series: Your Kids Id Photo Just Became Someone Elses Database.

The retailers have a real argument, by the way. This isn't made up. Shoplifting has gotten genuinely worse and genuinely more dangerous, Biometric Update noted that 73% of retailers reported shoplifters becoming more violent in 2024, and by 2025 that number had climbed to 83% saying violence was as bad or worse than before. Loss prevention is a real problem. Nobody's pretending otherwise.

But here's the thing. Scanning every single person who walks into a store, innocent parents, confused retirees, bored teenagers, all of them, is a different thing than having a system that checks known offenders against a specific watchlist. The Australian ruling actually protects the second approach while banning the first. Targeted and purposeful: fine. Dragnet on everyone with a pulse: not fine.

(The difference matters a lot if you've ever been incorrectly flagged for anything. These systems make mistakes. The question is who bears the cost of those mistakes.)

---

What You Can Do About It

Facial Recognition vs. Face Recognition: Same Thing, Different Words

You'll see both "facial recognition" and "face recognition" used interchangeably in guidance documents, news coverage, and store signage. They describe the same technology, software that maps and matches facial features, so don't assume a sign using one term instead of the other means something different is happening. What matters is whether matching is happening at all, not which phrase the sign uses.

If you've ever squinted at a sign in a store and thought "wait, are they doing something with cameras?", that instinct is worth trusting. Your face is biometric data. That means it's in the same category as your fingerprints or your medical records: the body stuff that's uniquely yours, that can't be changed if it's stolen or misused.

Treat a store asking for your face more like handing over your driver's license than tapping a loyalty card. Ask yourself three questions before you walk in anywhere that posts notices about "advanced security technology" or "image capture for safety purposes":

What are they actually capturing? A camera that records footage is not the same as a system that runs facial matching, comparing your face against a database in real time. The sign should say which one.

Why do they need it? "Safety" is a reason. "Safety that requires scanning every single customer's face rather than using any other method" is a much harder thing to justify. Up next: Before Facial Recognition Names You It Has To Find You And T.

Can you say no without consequence? The Australian rules explicitly say you can't be punished for opting out. If a store tells you the face scan is "required" to enter, that's worth questioning, and worth reporting to your state's consumer protection agency.

At CaraComp, the question we keep coming back to is the same one regulators in Australia just turned into law: if you've ever wondered whether an image, a profile, or a scan is being used in ways you didn't agree to, that's not paranoia. That's the exact question that privacy law is slowly, finally, catching up to answer. Knowing what questions to ask is the first real protection you have, long before any rule gets written.

Australia's watchdog just answered a question that most countries haven't gotten around to asking yet: does walking into a store mean you've agreed to give a corporation your face? The answer, finally, is no. Not automatically. Not by default. Not just because it's convenient for them.

So here's the question worth sitting with: the next time you see a small sign near a store entrance mentioning "security imaging" or "loss prevention technology", will you know what it means? Or will you tap your rewards card, grab your cart, and walk right past it?

Because that sign? It might mean more than you think.

---

Would you shop somewhere that required a face scan if the store said it was for safety or fraud prevention? Drop your answer in the comments, we read every one.

Facial recognition surveillance cameras don't just capture a picture; they generate facial images that get converted into a mathematical template for comparison. Understanding facial identification at that technical level helps explain why regulators focus on the matching step rather than the camera itself. A camera recording video is treated very differently in law than a camera feeding recognition systems that produce a match.

Recognition technologies used in retail today are more advanced than the systems from even five years ago, which is part of why old assumptions about "it's just a security camera" no longer hold up. Newer recognition systems can process video in real time, across multiple entrances, and cross-reference results instantly. That speed is exactly what makes necessity and safeguards testing so important, mistakes now happen faster and at greater scale than before.

Privacy laws in most countries were written before this kind of facial surveillance was common, which is part of why Australia's move stands out. Lawmakers elsewhere are watching to see whether clear rules around facial recognition surveillance cameras actually reduce harm without gutting legitimate loss-prevention efforts. Retailers, meanwhile, are watching to see how much it will cost them to comply.

Law enforcement use of facial recognition is a related but separate issue from retail use, and it's worth keeping the two apart. Police use of facial recognition surveillance cameras typically involves different legal standards, different oversight, and different consequences than a retailer scanning shoppers for loss prevention. Conflating the two can make both conversations less clear, even though the underlying recognition software is often similar.

Artificial intelligence is the engine behind most modern facial recognition surveillance cameras, it's the part of the system that actually learns to recognize faces rather than just detect that a face is present. That distinction, between detecting a face and recognizing whose face it is, is exactly where the legal risk lives. A store can point a camera at its entrance; the question the new guidance asks is what happens to that video after it's captured.

Access to the data collected by facial recognition surveillance cameras is another area the guidance addresses. Who gets access to the watchlist? Who gets access to the video after a match is made, and how long is it kept? Limiting access is one of the practical safeguards regulators expect stores to have in place, alongside the human review process already required when a system flags someone.

If you want a simple gut check next time you see a camera near a store entrance, ask whether it's just a security camera or a security camera doing facial identification. If a sign mentions "recognition," "matching," or "biometric," treat it as a facial recognition system and ask the three questions above. If it just says "video surveillance" or "security cameras in use," it's more likely a standard camera recording footage without face matching, though it's always worth asking to be sure.