Shoppers at the Chinook Centre, a mall in Calgary, Canada, have been unwittingly scanned by face recognition software.
Canadian outlet CBC reports that the mall’s parent company, Cadillac Fairview, has admitted to using the software without shopper consent, but the company claims they only collect limited data. The software has been in use since June.
Stunningly, Cadillac Fairview never actually disclosed the surveillance, which was used at two malls in Calgary and others in Canada. A shopper simply happened to notice a window accidentally left open in one of the center’s directories. The recognition software was seemingly running the background. The shopper posted a photo of the window to Reddit.
It doesn’t appear that the mall actually identified anyone. Face recognition usually works by scanning a person’s face, then matching that against a database of facial images. This appears to be more facial analysis, where people’s faces are scanned and, based on measurements, the people identified as male or female and sorted into certain age categories. It’s worth noting that on both gender classification and age estimates, face recognition is less accurate on women and darker skinned people.
But the issue here isn’t accuracy, it’s that people’s faces were scanned without their knowledge or consent. In a statement to CBC, Cadillac Fairview said that it does not capture or store images of shoppers.
“We don’t require consent, because we’re not capturing or retaining images,” a Cadillac Fairview spokesperson told CBC.
While Cadillac Fairview says the software simply counts shoppers, privacy experts tell CBC the company may not be telling the full story.
“There’s no way to verify the alleged purpose, and they [could] start using it for other purposes. From a civil liberties perspective, from a privacy perspective, from the perspective of being able to exercise our rights, it’s a huge concern,” said Sharon Polsky, president of the Privacy and Access Council of Canada.
Gizmodo was unable to reach Cadillac Fairview for comment.
As Polksy explained, even “anonymized” face recognition data could be linked to other security footage, purchase history, or even wifi connections to re-identify people. Sadly, Cadillac Fairview has a point: They aren’t legally required to obtain consent to use face recognition because it does not store people’s images.
U.S. privacy advocates are increasingly in support of treating facial identification as a type of “search.” Cases where consent could be dubiously obtained after the fact, evince why.