The self-serve is frustrating, but it’s not the biggest supermarket privacy concern

Supermarket checkouts are becoming increasingly technologically sophisticated, as retailers prioritise self-serve units with AI-powered shoplifting deterrents. But while Coles and Woolworths say the techniques do not use facial recognition or collect biometric data, privacy advocates are still watching the situation closely.

Most supermarkets are filled with CCTV cameras, and have been for decades. A Woolworths spokesperson said the average number per store is 62. Footage filmed from these is stored in Australia for at least 30 days, and is accessed by store members and investigation teams (or passed to police) as required, the spokesperson said.

Overhead cameras at Woolworth checkouts keep tabs on your items, but not your face.

But while shoppers largely accept the presence of CCTV, the introduction of new cameras and sensors at self-serve checkouts has been met with a lot of resistance.

Coles and Woolworths have installed self-serve checkouts at a large number of their stores. They have barcode scanners, and digital scales within the bagging area that can detect when you add or remove items. They often have cameras and show you an image of your own face. Some have overhead cameras that can detect your groceries as you scan them, or your trolley.

The terminals are designed to make checking out quick and efficient, but leave the supermarkets open to an increased risk of theft, and so will also call an attendant if something doesn’t match up. The latest technology, which is only being trialled in a small number of stores, links the self-serve terminals to a smart gate or to an individual trolley’s wheels, and will prevent customers leaving if they haven’t paid.

Yet while all this technology may put customers in mind of a Minority Report style nightmare where their face and actions are constantly being collected and processed, spokespeople for Coles and Woolworths said that was not the case. There was no facial recognition in any cameras in their stores, no collection of biometric information, and no technological method of tracking customers around the store, they said.

The Woolworths spokesperson also said there was no matching of footage to loyalty cards or credit card numbers.

“The purpose of the technologies is to streamline our customer’s experiences, assist our in-store team members with checkouts, keep our in-store team members safe and inform investigations,” they said.

“We do not use facial recognition and other biometric identification technology on our customers at self-service checkouts.”

The Coles spokesperson said the technology was there to reduce theft.

“Cameras used by Coles do not record personal information or have facial recognition,” they said.

“Any footage that is recorded, is done so in line with all relevant laws and Coles’ privacy policy.”

Interestingly, both Coles and Woolworths said that the cameras embedded in the self-serve units were not recording at all. The footage is not saved anywhere and can’t be viewed by anyone who isn’t looking directly at the unit. They’re effectively digital mirrors. Neither spokesperson explained the purpose of these cameras, though they likely serve as theft deterrents.

As for the overhead cameras, the Woolworths spokesperson said they were capable of tracking objects, but they didn’t capture people’s faces or any personal information. In fact, if a person happens to look up, the cameras automatically blur their faces. It also blacks out the pin pad. The system is capable of detecting if a customer weighs one type of object (such as peaches) but says they’re weighing a different type (such as potatoes), or if they try to leave with items still in their trolley.

Rafi Alam, senior campaigns and policy adviser at consumer rights organisation Choice, said the technology made customers feel uncomfortable and as though they were being constantly scrutinised, regardless of whether it collected personal data.

“At the moment we’re really just having to take what the major grocery chains say at face value,” he said, adding that the technology could increase the risk of personal details being inadvertently captured.

“After a year of data breaches and scams, we understand why consumers are concerned about what bad actors can try to breach, even if precautions are taken against this by businesses.”

Even if a retailer doesn’t use facial recognition, Choice has heard reports of certain stores employing body cameras, as well as AI algorithms applied to CCTV that can identify individual shoppers. Coles and Woolworths are known to use Australian crime intelligence platform Auror, which doesn’t use facial recognition but can analyse CCTV footage of thefts and track individuals across stores, integrating with law enforcement agencies.

Alam said that more stringent regulations and laws were required because the technology for invasive surveillance does exist and we shouldn’t rely on retailers choosing not to use it.

“A fair and reasonable use test would put the obligation on businesses, not consumers, to ensure that the way they collect data, how long they keep it, what they do with it, is safe and fair,” he said.

“And the definition of personal information in the privacy act is quite outdated, only referring to information explicitly about a person, so their name or address. But we’re in a digital age, and information relating to a person by technical data is also identifiable.”

While cameras and scanners at checkouts have become a hot-button topic for the privacy-conscious, owing to the fact that they’re new and literally in shoppers’ faces, in some ways we have as much to worry about from much more established surveillance techniques. CCTV for one, but also loyalty card programs.

“There are so many different ways that supermarkets are tracking consumers. Loyalty cards collect your consumer behaviour, trading it internally and sometimes externally, depending on what services you’re subscribed to,” Alam said.

“That information can create very accurate, potentially invasive profiles on you, that can be used to target advertising.”

Data from cards is also collated with various personal details from web browsing information to purchase history, and can even link grocery purchases to you if you don’t scan the card at checkout by comparing to your payment method. This information is leveraged by the supermarkets to make money, for example by selling it to data brokers.

Woolworths said all data sold to or shared with third parties from its Everyday Rewards card is de-identified. Coles also passes de-identified and aggregated data to third parties as part of its Flybuys program, but in some cases also provides identifiable information such as your email address.

For the time being, those who really don’t like the self-serve can continue to use staffed checkouts, but this arguably doesn’t change the situation from a privacy point of view. You’re still in view of CCTV cameras, and the degree to which data is collected from you and shared is still largely dependent on what the store does with that footage and whether you use a loyalty card.

“Data collection and surveillance technology is in store and online. That’s the reality of it,” Alam said.

Get news and reviews on technology, gadgets and gaming in our Technology newsletter every Friday. Sign up here.