About face: Shopping and technology meet privacy concerns with facial recognition technology virtually unregulated in Washington

In a building in downtown Spokane, everyone who walks in has their face scanned. The distance between their eyes, their shape and size, the width of their lips and tilt of their brow – this and more is captured and converted into a unique string of code.

The tech company that powers this system claims it cannot be easily fooled by masks or crowds and boasts a 99.8% accuracy rate for general use out in the real world, claims vetted by the National Institute of Standards and Technology.

The building in which it’s used isn’t an airport, a casino or a high-security federal facility.

It’s a discount grocery store.

Sometime in the past year, the independently owned downtown Grocery Outlet contracted with SAFR, a Seattle-based AI-powered facial recognition company that launched a retail security product, SAFR Guard, last year. Sage Dunaway, who co-owns the Grocery Outlet franchise with her husband, Jack, declined an interview at the direction of the national corporate headquarters.

In a flash, the front-facing security cameras take a detailed scan of the faces of every customer, employee and otherwise who steps through the front door. That biometric data is then fed into a database and compared against the faces belonging to people accused of shoplifting, assault or other crimes.

The crimes don’t necessarily need to have occurred in the store; one of SAFR’s key marketing pitches is its network effect, where its clients can share their watch list within a geographical area with other retailers using the SAFR Guard product. It’s not clear if there are any other customers in Spokane yet, however, as SAFR President Charisse Jacques declined to provide numbers or names of clients. Asked to generalize their footprint, she simply reiterated that SAFR Guard is a new product.

If an employee’s phone buzzes, SAFR Guard’s system has detected a match. If not, a person’s biometric data is instantly deleted, according to SAFR.

Facial recognition is a powerful tool that has become increasingly widespread in recent decades, from Facebook’s longstanding ability to identify people in photos and videos (discontinued in 2021, citing privacy concerns and the lack of nationwide regulatory protections), to the ability to unlock a phone without a password (requiring users to opt in), or the recent expansion of biometric scanners at Transportation Security Administration checkpoints (which travelers can decline).

Even Disneyland has rolled out facial recognition, though it allows visitors to opt out by using a different line; the company is currently facing a lawsuit for the practice.

Ring cameras, a home security company owned by Amazon, rolled out a facial recognition system late last year that the company claims can identify people from up to 13 feet away without their knowledge or consent. While Washington state law does not appear to forbid this practice, a class-action lawsuit was filed in June with the U.S. District Court for the Western District of Washington, alleging the technology violates Federal Trade Commission policy.

But relatively few retailers use facial recognition in their stores, and some chains that have tested the technology have since abandoned it for the time being.

Rite Aid introduced an early facial recognition system into its stores in 2012. Employees would take photos of people shoplifting or committing other crimes, enter the photos into a database, and the facial recognition system would cross-reference everyone who entered the store with that database.

But the system was faulty, and in 2020 the FTC sued Rite Aid over the thousands of false positives generated by the system, leading particularly to women of color being falsely and publicly accused of crimes. In a settlement, the chain was banned from using the technology until 2029.

“Rite Aid’s reckless use of facial surveillance systems left its customers facing humiliation and other harms, and its order violations put consumers’ sensitive information at risk,” said Samuel Levine, director of the FTC’s Bureau of Consumer Protection, in a 2023 news release.

Walmart experimented with the tech in 2015 and filed a 2012 patent to use facial recognition to monitor customer emotions, according to Forbes. A spokesperson said the technology is in use today.

Target was sued in 2024 for allegedly using facial recognition in Illinois because of that state’s laws on the practice, but the lawsuit was dismissed after it was shown in court that the company didn’t use the technology at all. A spokesperson confirmed this is still the case.

The online privacy policy for Albertsons, which owns Safeway, clarifies that “in some states, our cameras may capture biometrics,” but does not clarify whether that includes Washington. The grocery giant did not respond to multiple requests for comment.

Hardware company Lowe’s told the American Civil Liberties Union in 2018 that its stores “may” use facial recognition software to screen for shoplifters. The company did not respond to multiple requests for comment.

That leaves the downtown Grocery Outlet as the only retail location in the city that The Spokesman-Review could confirm uses the technology, in part because SAFR requires client disclosure. It’s not a prominent notice, just a relatively small sticker next to the front door, which is more than state law requires.

“Today, AI and biometrics are regulated by states, and we do think it’s really important to have clear, strict guidelines around the use of the technology to ensure it’s responsible, to ensure people are held accountable,” Jacques said. “We take the strictest standards and apply that to what we do, over and above any individual state law.”

Washington state has virtually no restrictions or guardrails for the use of facial recognition for private security purposes. Companies can’t capture customer biometrics for commercial purposes (such as identifying someone for targeted advertisement) without providing notice and obtaining consent, and in 2020 the state heavily regulated facial recognition use by law enforcement. These regulations explicitly carve out private security uses, however.

“There was a lot of to-ing and fro-ing over the legislation that eventually got passed, and there were some versions that did regulate private use as well,” said Jon Pincus, a software developer and tech activist who lobbied for the 2020 bill. “But the lobbying against them was just too intense, and that got abandoned fairly early on.”

The toughest restrictions on facial recognition are almost all found at the county or city level; Bellingham voters approved a ban on government use of facial recognition in 2021, while Portland officials in 2020 approved the strictest regulations in the nation, prohibiting both government use and private use in public spaces, which includes the inside of restaurants, stores and other public accommodations.

While there has been some pushback to the growth of facial recognition, its use in retail security appears to be growing. A 2025 survey from the National Retail Federation found 18% of retailers were piloting or already implemented facial recognition technology, up from 12% in 2022 (though another 28% said they had researched the technology and decided against it).

The technology has also improved dramatically in recent years. Just between 2014 and 2018, facial recognition became 20 times better at matching photos to a database, according to the National Institute of Standards and Technology

Jacques points to growing concerns about retail crime.

“One, crime is increasing. It’s increasing across retail,” Jacques said. “The second thing I’d say is offenders are getting more aggressive. And the third thing I’d say around that is that we’re seeing more and more reports of retail workers feeling unsafe at work.

“So when you have those three things, along with the evolution of technology, which has made it really easy to get early awareness, I think that’s why we’re seeing what we’re seeing now,” she continued.

The data on Spokane’s long-term shoplifting trends is a bit fuzzy. Reported cases did see a sharp increase after plummeting during the COVID-19 pandemic (dropping from 1,877 reported cases in 2019 to 1,239 in 2020 before doubling to 2,451 cases last year).

Even at last year’s high, this appears roughly comparable to the 2,127 cases of reported shoplifting in 1981, when the city’s population was 25% smaller, though Spokane police officials caution that data collection methodology changes periodically.

But retailers nationwide are expressing growing concerns with crime in their stores, with 73% of retailers surveyed by the National Retail Federation in 2024 expressing that shoplifters were becoming more violent. In 2025, 83% of respondents expressed that violence was as bad or worse than the prior year.

Like any powerful surveillance technology, facial recognition poses serious privacy and civil rights challenges, Pincus said. Law enforcement, including immigration officials, could request grocery stores and restaurants to scan their customers to search for a person of interest – and not always for a legitimate law enforcement purpose, he noted.

“We’ve just seen examples with (automatic license plate readers), for example, where law enforcement personnel have put their girlfriends or their former girlfriends or their former girlfriends’ new boyfriends on the hit list,” Pincus noted.

Companies could also directly abuse the technology. In 2023, the New York Times reported that MSG Entertainment, the owner of Madison Square Garden and Radio City Music Hall, was using ubiquitous facial recognition to exclude lawyers representing people suing the company. An April story from WIRED suggests the company used facial recognition to track the minute-by-minute movements of at least one person, who posed no discernible security threat, because she was a trans woman who frequented Knicks games.

Even when a face is added to a database legitimately, false-positives can result in public shaming or even arrests.

AI-powered facial recognition is only as good as the data it was trained on, and performance in the real world can still be significantly less reliable than in the labs where they were initially developed, said Shanchieh Jay Yang, professor and director of Gonzaga University’s Institute for Informatics and Applied Technology. No system is 100% accurate, and even a small error rate can have serious consequences.

“Even if the error is 0.1%, what if I’m the victim of the error?” Yang said. “It doesn’t matter that it’s .001%, I’m still the victim.”

SAFR’s certification by the NIST is a good sign, he added, but not foolproof.

“A few years ago, Boeing, they’re supposed to pass all the tests, but their airplane door fell off,” he said. “No matter how you stress-test anything, you just cannot guarantee for everything.”

SAFR claims to be one of the most ethical, privacy-conscious businesses in this space, maintaining strict criteria that must be met before a new face is added to the database – no jilted lovers will be using the system to stalk a former lover on SAFR’s system, said Chris Ochs, director of product management for SAFR.

Clients have to submit detailed reports to SAFR before they can be added to a watch list, and the person submitting it both has to identify themselves to SAFR and sign a perjury statement, Ochs said.

Under no circumstances can law enforcement, whether local police or federal immigration officials, ask to add someone to a SAFR watch list, as has been allowed by other companies, he added.

And the company claims to have much more racially diverse testing data to prevent the biased false positives that Rite Aid’s system experienced – a high priority, said Jacques, who is herself a woman of color.

“We take privacy and responsible use so seriously, which is why we go through all of the steps that we do to make sure that this solution is being used in a way that, again, gives people the protections they need, but enables retailers to take advantage of the great technology available to them,” she said.