Walmart Is Scanning Your Face, License Plate, and Data. Here’s How They Are Rolling Back Privacy, Not Prices

You went in for paper towels. Maybe some cereal. Before you reached the dairy aisle, cameras may already have logged your facial geometry. That's not paranoia — that's Walmart's own privacy policy, written plainly enough that anyone willing to read past page one can find it.

Walmart's Customer Privacy Notice and Visitor Privacy Notice describe a broad range of biometric and surveillance data the company says it may collect across physical stores and digital platforms. Here's what the documents actually say.

What the Policy Lists, Word for Word

Straight from Walmart's own legal language — and it covers more ground than most shoppers expect.

According to Walmart's Customer Privacy Notice, the company may collect:

• Biometric data:face geometry, iris and retina imagery, voiceprints, palm prints, and fingerprints

• Camera and automated technology data:images and information captured during checkout, theft deterrence, and store layout analysis, from systems used both inside and outside store locations

• Automated License Plate Reader (ALPR) data:from vehicles on Walmart property, used for security, fraud prevention, parking enforcement, and safety purposes — a practice explored in detail in coverage of San Jose's Flock Problem

The retention schedule adds unusual specificity: Walmart says biometric data will be permanently destroyed when its purpose is fulfilled, within three years of your last interaction, or as the law requires — whichever comes first.

One important qualifier on voice data: Walmart's notice lists voiceprints as a biometric category it may collect, but also states it does not use voice data for biometric analysis. Any voice or audio collection appears context-dependent — tied to specific customer service interactions or voice-activated app features, not ambient recording during a standard store visit.

What "May Collect" Is Actually Doing Here

The two most consequential words in this entire document aren't "face geometry" — they're "may collect."

Walmart's policy describes authorized categories of data collection, not a guarantee that every shopper gets biometrically catalogued on every visit. The conditions that trigger collection matter enormously: which store, which state, which service, which technology is actually deployed. "May collect" means the infrastructure and authorization exist. Whether any of it is actively pointed at you depends on details the policy doesn't fully spell out — a reminder of how apps have been caught secretly tracking users in ways their disclosures barely acknowledged.

Think of it like facial recognition moving from airport security into the self-checkout lane — the technology clearly exists, but deployment is neither confirmed nor uniform across every location.

Several U.S. states, including Illinois under its Biometric Information Privacy Act (BIPA) , treat biometric data as a legally protected category with strict collection and retention requirements. Walmart's explicit retention schedule suggests awareness of those obligations. But protections vary sharply by state, and what applies in Illinois may offer no parallel coverage where you shop.

What This Means the Next Time You Park at a Supercenter

Practical clarity beats existential dread — here's where to start.

Read Walmart's full privacy notices directly at corporate.walmart.com. Know your state's biometric privacy laws, because they determine how much legal protection you actually have — not Walmart's policy language alone. The notices describe what the company is authorized to collect under certain conditions; they don't map out exactly when or where each technology is running. Knowing how to stay safe in an environment of pervasive data collection starts with understanding what you're consenting to simply by showing up.

That ambiguity isn't accidental. It's worth sitting with.