In-Store Facial Recognition - results within guardrails

In-store facial recognition is moving from experimental pilots to mainstream retail use, but success depends on how it’s executed and the guardrails that retailers and governments develop.

Colin Peacock and Eveline discuss reported benefits including around 25% shrink reduction in one retailer, improved staff safety, and productivity gains, alongside stronger collaboration with police in some markets.

They unpack the practical sticking points—watch lists, database ownership, notification handling, and the vital role of human verification to avoid harmful false positives—before calling for an industry code of practice and noting that many retailers take two to three years to move from interest to live deployment.

Cleaned transcript

In-store facial recognition: why it’s back on retailers’ agendas

COLIN:

In this podcast, we’ll be looking at in-store facial recognition technology and the barriers to successful adoption, deployment and execution.

Facial recognition is something we’ve been tracking at ECR for over 10 years.

Over that time, we’ve had numerous questions: is it legal, is it within GDPR, is it possible, does the technology work, is it accurate enough?

A lot of those questions have now been answered.

We’ve had case studies too.

Rite Aid have been very generous; Bob Oberosler shared his programme in 100 stores.

Sadly, that then collapsed under the weight of a Reuters article that was not particularly in favour of the use of the technology – where the technology came from and where they put the facial recognition cameras.

Although that particular programme went quiet, we’ve been gradually picking up that this is now hot news again.

We’ve increased the cadence from talking about it maybe once a year to around three times a year, and we had a meeting just recently in June.

It seems to be really picking up.

Every time we speak to retailers – from Australia, New Zealand, Europe, America, Canada and the UK – the ones that have used it, whether proactively (someone walks into the store and you do something with that information) or retrospectively for investigations, all report really positively on productivity or shrink savings.

One retailer reported a 25% shrink saving.

These are big numbers.

People are saying this is the single most important intervention in loss prevention for decades, if not ever.

So it’s a really big deal.

But, like with all things in retail, it comes down to detail.

Retail is detail: how facial recognition is executed, and how you win the hearts and minds of the public so they get behind it – and, before all that, the board of directors.

It’s this execution piece that keeps coming up.

I know you’ve been following this as long as I have, Eveline.

What are some of the points you’ve picked up in terms of execution and how you do facial recognition?

Global deployments and different legal frameworks

EVELINE:

You and I have now sat through so many use cases and case studies of how this is being deployed internationally.

What’s interesting about that is the different legislative frameworks that govern its operation, which sometimes force retailers to deploy it in slightly different ways.

Overall, I absolutely agree the case is compelling.

We see a strong impact on shrink and theft, reassurance for staff and customers, and greater collaboration with the police, who are also utilising these systems.

It just seems to have so many benefits.

However, I think there are still some sticking points.

At the beginning, facial recognition was almost seen as a simple plug-and-play solution: you install the system, it monitors faces, you check if it’s accurate and, if it is, you get a match.

But actually, there is so much variance in how it works in practice, and that’s where it gets quite interesting.

In-store facial recognition watch lists and database ownership

EVELINE:

First of all, it’s about the watch list.

What is the database of known or suspected individuals, and who owns and manages that database?

Is it the vendor, where they are the data controller?

We’ve seen examples of that.

Is it a database shared among different retailers using the same system, so an offender who has never targeted your store but has targeted someone else’s will still ping on your system?

In some cases, such as in New Zealand, the Privacy Commissioner has said you can only have a store-based database.

Even if an offender has been stealing from your same brand up the road, they won’t ping in your other store.

It’s a store-only database.

So there is huge variation there, and that has big implications for how effective the system will be – particularly with travelling offenders and organised criminals who might take advantage of that geographic dispersal.

The other key area, where I’m surprised by how much variance there still is, is notification.

Who actually gets the ping when there’s a match?

Is it an internal staff member or security guard, or is it managed externally by a remote LP or security operating centre, who then has to contact the store to say somebody has just walked in?

That obviously introduces a time delay.

What’s your thought on this database and notifications point?

Store-only vs shared databases: effectiveness and fairness

COLIN:

It’s a really interesting point.

As you say, with shared data, we’ve heard of countries where you can only have a database in one store.

The consequence is that the person only triggers in that one location, so they just come back to that store.

Then you’ve got greater concerns with shared databases.

Someone could be effectively banned from every single store in the UK, or whichever market it is.

Then you get into the issue of: where can I buy my shopping?

I can see all the issues.

I don’t have a great answer; I can just see the problems.

If you’re borrowing a shared database, you have to trust the data other retailers have put on there.

We’ve already seen questions around things like store managers putting ex-partners on the list, for example.

It’s tricky.

In-store facial recognition alerts: notifications and response speed

COLIN:

Where there’s still variation – but where we can see best practice emerging – is around verification.

Even though many retailers and vendors talk about over 99% accuracy, I think we still need human intervention to make sure the person it’s suggesting really is that person.

Most retailers now are moving towards that human verification.

Sometimes two people are required to do that verification, though not all are doing it yet.

Of course, that assumes the person is on the database in the first place, so you have something to compare them to.

It also depends on the consequence.

Are you going to eject them from the store, or simply say, “Welcome, can I help you with your shopping?”

I think you need different levels of accuracy depending on what you plan to do.

Human verification, accuracy and consequences

EVELINE:

And that response is so varied as well.

We’re seeing a lot of retailers moving into the space of simply giving excellent customer service when someone pings.

They might hand the person a basket, make it clear they’ve been noticed, and stay visible without necessarily following them around the store.

Other stores use it more as a heads-up that someone is in the store who has been flagged as potentially violent or aggressive.

In those cases, you don’t want staff to approach them, but having the forewarning that someone potentially challenging is present is really useful for deciding how to handle it.

Store responses, false positives and media risk

EVELINE:

We’ve also seen quite a few media incidents, particularly in the UK, where the response has been to eject the person from the store.

Unfortunately, that has sometimes happened without any human verification process in place.

Lo and behold, it’s splashed across the media: somebody being thrown out quite aggressively, and it was a false positive.

That is really damaging for this whole space, and there are ways around it.

It doesn’t have to be that way.

Again, I think we’re beginning to see some best practice emerging.

In-store facial recognition and the case for a code of practice

COLIN:

You’ve been really vocal about the need for a sort of code of practice – guidelines that retailers can adopt.

Privacy groups are likely to latch on to any bad news very quickly, and they’re less likely to highlight the good news: that staff feel safer, are safer, that there are fewer incidents of violence, and that shrink is down.

That’s probably not a story Big Brother Watch will cover.

So this code of practice – what do you have in mind for that, and how do you think it could happen?

EVELINE:

The industry is absolutely crying out for a code of practice.

That goes for vendors as well as the retailers looking to deploy these systems.

You mentioned Big Brother Watch, the civil liberties campaign group here in the UK.

I interviewed them on my podcast, and they are also very supportive of the idea of a code of practice.

Such a code would outline the minimum standards a vendor must reach: how they’ve tested their product, how they can answer questions about accuracy, data storage, who the data controller is, and so on.

It would also set a number of principles for retailers: being privacy-safe, having a standard approach, and building in that human touch, which I think is so important.

A code of practice would give confidence to retailers and customers that the technology is being used sensibly, with a clear use case.

It would make it clear this is about identifying known offenders and protecting employees and customers from potential violence, abuse or theft.

It gives everyone a safer space, but that confidence that it’s being deployed sensibly is really key.

COLIN:

As you say, when we’re talking about prolific offenders, this is the best loss prevention person you can have in a store.

They’re not on their phone, they’re not distracted, they’re not off sick or on holiday.

It is the best loss prevention tool you can have.

But the detail points are absolutely critical, and a code of practice like the one you describe would be really helpful.

Adoption timelines and closing remarks

COLIN:

This is fantastic.

It’s not over, of course.

We’ll be doing another podcast on this in six months’ time, and hopefully there will be more learnings from around the world.

This is a big topic for many retailers.

Hopefully, one of these days some of the retailers will be able to share results publicly.

For now, this is a technology with huge potential, but we’ve got to win over the board and the court of public opinion.

One of the big highlights from our recent discussions has been just how long it takes.

It’s taking retailers two to three years to move from “I think we need to do something on facial recognition” to actually starting a deployment in store.

There are so many hoops, so many procedures and so many things to think through with different people internally and externally, that you need that long runway.

I’m sure we’ll be able to report more progress when we next discuss it.

Until then, thank you very much indeed.

EVELINE:

Brilliant, thank you, Colin.

COLIN:

Well, that’s all we have time for this week.

Thank you for joining us, and thanks to all the ECR Retail Loss community for sharing their knowledge, research and latest learnings to ensure that we truly become a global platform for learning.

My name is Colin Peacock.

This is the Sell More and Lose Less podcast.

If you liked it, please subscribe so you automatically get all future episodes.

If you think your colleagues and friends might like it, please ask them to follow ECR Retail Loss on LinkedIn and tune in to our next podcasts.

If you didn’t like it, let us know and we’ll try to fix it.

Either way, see you next time.

Thank you again.