New Surveillance Tools in Retail Stores Pose Legal Risks

Quick Hits

• Artificial intelligence, facial recognition systems, and body cameras on security guards are some of the newer methods retailers are using to prevent crime in stores.
• Recording audio without consent may be prohibited under federal and state laws.
• Employees and customers have certain privacy rights where there is a reasonable expectation of privacy.

Retailers are under pressure to balance security concerns, such as preventing theft, with the privacy rights of customers and employees. Some retailers have begun using facial recognition technology, surveillance cameras with artificial intelligence capabilities, and/or security guards with body cameras. These technologies may implicate privacy laws, depending on the state and how they are used.

The Federal Wiretap Act prohibits the intentional interception or procurement of any wire, oral, or electronic communication without at least one party’s consent. It applies to audio recordings, but not video-only recordings.

California, Delaware, Florida, Illinois, Maryland, Massachusetts, Michigan, Montana, New Hampshire, Pennsylvania, and Washington State require consent by all parties to legally record audio of a conversation. Other states allow one-party consent, meaning one party in a conversation can record audio without the other party’s consent.

In general, video recordings without audio are permitted in retail environments, except in places where there is an expectation of privacy, such as bathrooms and dressing rooms. Certain states expressly prohibit hidden cameras in places where there is an expectation of privacy. Video recordings, however, are permitted in public places like store aisles, parking lots, entranceways, and checkout counters.

In particular, facial recognition systems may increase liability for employers because some states, including California, Illinois, Texas, and Washington, restrict the collection of sensitive biometric data without notice and consent. Likewise, in 2024, the Federal Trade Commission (FTC) settled a case against a pharmacy retailer with the court ordering the pharmacy retailer to cease using facial recognition technology for security or surveillance purposes for five years.

Depending on the state, retail stores may be required to inform customers and employees if audio and video are recorded, or if facial recognition tools are used. This can be accomplished with posted signs, onboarding paperwork, and employee handbooks.

Furthermore, the Federal Trade Commission Act prohibits ‘‘unfair or deceptive acts or practices in or affecting commerce.’’ This includes practices that are likely to cause substantial injury to consumers and cannot be reasonably avoided by consumers.

Next Steps

Employers may wish to review their written policies and practices to ensure they comply with state laws on video and audio surveillance. Privacy laws vary greatly by state, making the situation complicated for multistate and multinational retailers. Posting conspicuous disclaimers about video and audio recording may help reduce liability for employers, even when it is not legally required.

Ogletree Deakins’ Retail Industry Group will continue to monitor developments and will post updates on the Cybersecurity and Privacy, Multistate Compliance, and Retail blogs as additional information becomes available.

Brandon R. Sher is a shareholder in Ogletree Deakins’ Philadelphia office and co-chair of Ogletree Deakins’ Retail Industry Group.

This article was co-authored by Leah J. Shepherd, who is a writer in Ogletree Deakins’ Washington, D.C., office.

Follow and Subscribe
LinkedIn | Instagram | Webinars | Podcasts