Wegmans recently expanded its biometric data collection program across its New York City locations, capturing facial geometry, eye scans, and voiceprints from anyone who walks through their doors. While the grocery chain frames this as a security measure to protect customers and employees, from a compliance and risk management perspective, this decision represents a textbook case of what businesses should avoid doing in today’s regulatory environment.
The Broken Promise That Should Alarm Every Business
Here’s what should concern any business owner, chief privacy officer, data protection officer, compliance officers, or legal counsel: In 2024, Wegmans piloted a similar program and promised to delete any biometric data inadvertently collected from shoppers. Fast forward to 2025, and those assurances have vanished. The new signage makes no mention of data deletion, retention policies, or even basic safeguards. The company has remained silent on critical questions about data storage, encryption standards, and whether this information could be shared with law enforcement.
This isn’t just poor communication—it’s a compliance red flag that signals inadequate data governance.
Understanding the Legal Landscape: A Patchwork of Penalties
New York City’s Biometric Framework
New York City enacted its Biometric Identifier Information Law in 2021, which currently requires businesses to post conspicuous signage when collecting biometric data. While this law doesn’t require advance consent like Illinois’ statute, violations still carry significant penalties ranging from $500 to $5,000 per violation, with a private right of action allowing affected consumers to sue directly.
What makes this particularly dangerous for businesses is the per-violation structure. If 10,000 customers enter a Wegmans store during the violation period, that’s potentially 10,000 separate violations at $500-$5,000 each—we’re talking about exposure ranging from $5 million to $50 million for a single location over a limited timeframe.
New York State’s Proposed BIPA: The Sword of Damocles
New York State has repeatedly considered enacting a Biometric Privacy Act modeled after Illinois’ punishing statute. While not yet law, the proposed legislation would impose:
- Up to $1,000 per negligent violation
- Up to $5,000 per intentional or reckless violation
- Uncapped actual damages
- Attorney’s fees for successful plaintiffs
- No requirement to prove actual harm
The bill has been introduced multiple times (most recently as Assembly Bill 1362-A in 2023) and continues to gain momentum. Any business collecting biometric data in New York should operate as if this law will eventually pass.
The Illinois Warning: Why BIPA Should Terrify Retailers
Illinois’ Biometric Information Privacy Act has become the nuclear option of privacy litigation, generating over 1,500 lawsuits since 2019 and producing settlements that should make any CFO’s blood run cold:
- Facebook: $650 million (facial recognition in photo tagging)
- TikTok: $92 million (face and voice data collection)
- Google: $100 million (facial recognition in Google Photos)
- Clearview AI: $51.75 million (web scraping for facial recognition database)
Even routine workplace applications have resulted in massive payouts. A fingerprint timekeeping system at Speedway resulted in a $12.1 million settlement after eight years of litigation. Trampoline park employees in Illinois received settlements of approximately $718 per person for fingerprint scans at work.
In 2024 alone, BIPA-related settlements totaled $206.85 million. The cases continue to proliferate, with 427 new BIPA lawsuits filed in 2024—more than one per day.
Why BIPA is So Dangerous
The Illinois Supreme Court’s 2019 Rosenbach v. Six Flags decision fundamentally changed the risk calculus. The court ruled that plaintiffs don’t need to prove actual harm—merely failing to obtain proper consent or provide required notices is sufficient to establish liability. More recently, the court ruled that each scan constitutes a separate violation, not just the first collection.
Though Illinois amended BIPA in 2024 to cap damages at one violation per person (rather than per scan), businesses still face $1,000-$5,000 per person in statutory damages, plus attorney’s fees and potentially uncapped actual damages.
Other State Privacy Frameworks Creating Compliance Headaches
California’s Evolving Standard
The California Consumer Privacy Act (CCPA), as amended by the California Privacy Rights Act (CPRA), treats biometric information as sensitive personal information requiring enhanced protections. Key penalties include:
- Up to $2,500 per unintentional violation
- Up to $7,500 per intentional violation or violations involving minors under 16
- $100-$750 per consumer per incident for data breaches involving biometric data
- Adjusted for inflation in 2025, with no 30-day cure period under CPRA
California doesn’t require advance consent like Illinois, but businesses must provide detailed privacy notices, honor opt-out requests, and maintain reasonable security. The California Attorney General has demonstrated a willingness to pursue major enforcement actions, including an $8.5 million settlement with Wells Fargo for privacy violations.
The Growing State Patchwork
Other states with biometric privacy provisions include:
- Texas: $25,000 per violation, but only enforced by the Attorney General (no private right of action)
- Washington: Similar enforcement-only structure
- Colorado: Extended consumer privacy law to cover biometric data used by employers
- Connecticut, Utah, Virginia: Include biometric protections in broader consumer privacy laws
The Five Critical Risks Wegmans (and Others) Face
1. Data Breach Exposure
Biometric data is immutable—you can’t change your facial geometry or iris scan if it’s compromised. Privacy advocates warn that storing customer biometric data exposes them to risks from hackers or immigration enforcement. A single breach could expose Wegmans to class action litigation under multiple state frameworks, with potential damages in the tens or hundreds of millions.
2. Inadequate Consent and Notice
Wegmans appears to rely solely on posted signage, which may satisfy current NYC requirements but falls far short of what Illinois and proposed New York State law would require. The signage provides no information about:
- Data retention periods
- Specific purposes beyond vague “safety and security”
- Third-party access or sharing
- Deletion procedures
- Security measures
This creates enormous risk if New York State passes its BIPA-style law with retroactive application.
3. Mission Creep and Purpose Limitation
The stated purpose—”safety and security”—is dangerously vague. Will this data be used for:
- Loss prevention and shoplifting detection?
- Targeted marketing or customer profiling?
- Employee monitoring?
- Sharing with law enforcement upon request?
Without clear purpose limitation and use restrictions, Wegmans leaves itself vulnerable to claims of unauthorized use under virtually every privacy framework.
4. Discriminatory Impact and Civil Rights Concerns
Facial recognition technology has documented bias issues, particularly in misidentifying people of color. If Wegmans’ system contributes to discriminatory loss prevention practices or wrongful accusations, the company faces not only privacy violations but potential civil rights litigation.
One shopper stated he would avoid the store because “I don’t want no one to think I’m stealing anything or doing anything illegal”—highlighting how surveillance systems create a chilling effect that may disproportionately impact certain communities.
5. Reputational Damage and Customer Erosion
Multiple shoppers have publicly stated they’ll take their business elsewhere due to the biometric collection. In a competitive retail environment, the reputational cost of being seen as invasive or untrust worthy can dwarf legal penalties. Customer trust, once lost, is extraordinarily difficult to rebuild.
What Businesses Should Do Instead: A Compliance Roadmap
Assess Whether Collection is Truly Necessary
The first question any business should ask: Do we actually need to collect biometric data? For most retail operations, the answer is no. Traditional security measures—cameras without facial recognition, security personnel, inventory tracking systems—can achieve similar objectives without creating massive legal exposure.
Implement Privacy by Design
If biometric collection is deemed essential:
- Minimize data collection: Collect only what’s strictly necessary
- Pseudonymization: Where possible, use hashed or anonymized identifiers rather than raw biometric data
- Clear retention policies: Establish and publicize specific timeframes for data deletion
- Robust security: Implement encryption at rest and in transit, access controls, and regular security audits
- Third-party vetting: If using vendors, ensure they have appropriate security certifications and contractual protections
Obtain Meaningful Consent
In jurisdictions requiring advance consent (or where such laws are proposed):
- Provide clear, separate consent forms explaining data collection
- Detail specific purposes and retention periods
- Allow granular opt-outs where feasible
- Maintain documented proof of consent
- Make consent mechanisms easily accessible
Establish Governance and Oversight
Create internal accountability:
- Designate a data protection officer or compliance lead
- Conduct regular privacy impact assessments
- Implement data inventory and mapping
- Train employees on handling biometric data
- Establish incident response procedures
- Monitor regulatory developments across all operating jurisdictions
Consider the Total Cost of Ownership
Factor in:
- Legal review and compliance costs
- Potential litigation defense costs
- Insurance premium increases (if coverage is even available)
- Regulatory investigation costs
- Remediation costs if violations occur
- Reputational damage and customer loss
For most retailers, these costs far exceed any security benefits.
The Broader Lesson: Technology Isn’t Always the Answer
Wegmans’ expansion of biometric surveillance reflects a dangerous trend: deploying invasive technology first and addressing legal and ethical implications later (if at all). This approach creates enormous enterprise risk.
The lesson for businesses is clear: just because you can collect biometric data doesn’t mean you should. The regulatory environment is rapidly evolving toward stricter protections, plaintiff-friendly private rights of action, and substantial penalties. The smart play is to implement privacy-protective alternatives that achieve business objectives without creating existential legal risk.
The Compliance Calculus Has Changed
Wegmans’ biometric program represents exactly the kind of compliance risk that keeps data privacy consultants busy and general counsels up at night. The company has:
- Scaled a program without addressing privacy concerns raised during the pilot
- Failed to provide transparency on critical data handling practices
- Created exposure across multiple regulatory frameworks
- Generated negative publicity and customer backlash
- Positioned itself for potential class action litigation under current and proposed laws
For businesses evaluating similar technologies, the message should be unmistakable: the era of “collect now, ask permission later” is over. With BIPA settlements averaging millions of dollars, proposed state laws creating additional private rights of action, and plaintiffs’ attorneys actively seeking new targets, biometric data collection without robust compliance frameworks is a business risk few companies can afford to take.
The hidden cost of convenience may well be measured in the tens or hundreds of millions of dollars.
Get a free privacy audit and see if you have Wegman level risks and if so we can help.
