Why detecting an event and identifying a shopper are different risks

Mike Mitchell has a test for any camera system a retailer wants to switch on: what happens to the good customer it gets wrong. Speaking in a MarketScale Studio segment, Mitchell, of Telaid, a technology integrator that installs and manages store systems for retail chains, put the cost in the retailer's own terms before he put it in anyone else's.

The argument lands at a specific moment. In February 2026, the law firm Wood Smith Henning & Berman LLP (WSHB) published an analysis of biometric signage at a large grocery chain and argued that the compliance question for retailers has moved past whether a sign was posted to whether the system actually worked. Two months earlier, in a December 2025 year-in-review, Squire Patton Boggs counted at least 100 new class actions filed in 2025 under Illinois' biometric privacy law, with a $47.5 million settlement and one worth roughly $51.75 million approved during the year.

Retailers are buying cameras while that litigation grows. In a survey of 70 retail companies published in October 2025, the National Retail Federation (NRF) and the Loss Prevention Research Council (LPRC) reported that exterior security, interior security and merchandise protection were the measures retailers most often said they increased over the prior year, with cameras and license plate readers among the tools named. Mitchell's point is that the pace of purchasing should not set the pace of the decision.

An alert describes a behavior; a match asserts an identity

Mitchell says retailers need to "separate between detecting an event and identifying a person," and that the distinction is the one their internal teams most need to grasp. A missed-scan alert says what happened at a lane; a facial match says who the shopper is. The first is a claim about an action, the second is a claim about a human being, and the law treats them differently.

Event detection works by pattern. Everseen, a computer vision vendor, describes on its own site in a September 2026 article how cameras already in a store connect to software that distinguishes ordinary shopping from loss patterns such as a missed scan, a product switch or an item left in the basket, then triggers a soft nudge or an audio alert inside the transaction window. SeeChange, another vendor, lays out the underlying logic in an October 2025 explainer on its site written by its principal AI solutions engineer, Andrew Smith: every self-checkout event lands in one of four boxes, a correct alert, a correct non-alert, a false alert, or a missed event.

Identification works by measurement. Squire Patton Boggs describes the tools at issue in biometric litigation as those that collect biometric information and identifiers, giving facial geometries, fingerprint scans and voiceprints as examples; a biometric identifier is a measurement of the body itself, converted into a template that can be matched against a database later. The Federal Trade Commission (FTC) described that kind of database in its December 2023 Rite Aid complaint: images of people the retailer considered persons of interest, stored alongside their names and, in some cases, criminal background data.

For the asset protection director evaluating a platform, the operational question follows directly. Does the tool store anything that could single out the same shopper again next week? If it does, the retailer has crossed from detection into identification whether or not the purchase order used that word.

Illinois law attaches at collection, not at the accusation

The governing statute is Illinois' Biometric Information Privacy Act (BIPA), 740 ILCS 14/1 et seq. According to WSHB's February 2026 analysis, BIPA requires notice and informed written consent before a biometric identifier is collected, plus a publicly available retention and destruction policy that deletes the data when its purpose is satisfied or within three years of the person's last interaction with the company. BIPA sets statutory damages of $1,000 per negligent violation and $5,000 per willful or reckless one, with no proof of harm required.

Two Illinois Supreme Court rulings make that bite real, per WSHB. In Rosenbach v. Six Flags Entertainment Corp. in 2019, the court held a person is aggrieved, and may sue, on the statutory violation alone. In Tims v. Black Horse Carriers in 2023, the court applied a five-year limitations period to BIPA claims. Squire Patton Boggs adds that a 2024 amendment now limits an aggrieved person to one recovery against a company for repeated use of the same biometric, which trims the damages math without removing the exposure.

None of these statutes uses the phrase "identifying a person." BIPA keys on the act of capturing the identifier, which is why Mitchell's line between an event and an identity matters before the first camera is mounted rather than after a shopper complains. Connecticut's Data Privacy Act (CTDPA), effective July 1, 2023, generally requires consent to process sensitive data that can include biometrics, according to WSHB.

Here the thesis meets a complication. WSHB notes that privacy statutes often carry carveouts for security, fraud and crime prevention, and retailers lean on exactly those when they deploy facial recognition against repeat theft. The firm's answer is that plaintiffs and regulators then shift the fight to whether the collection was proportionate, transparent, accurate and bounded by retention rules, which puts the retailer back in front of the same questions Mitchell wants settled internally.

Federal enforcement runs on a different statute. WSHB describes the FTC's authority under Section 5 of the FTC Act, 15 U.S.C. § 45, which bars unfair or deceptive practices and which the agency used against a retailer's facial recognition program. The vendor side has felt the Illinois law too: the ACLU of Illinois announced a settlement resolving a lawsuit it filed in May 2020 against Clearview AI under which the company is permanently banned nationwide from making its faceprint database available to most private entities, subject to narrow exceptions in BIPA.

What the FTC found when one retailer merged the two

The FTC's December 2023 order bars Rite Aid from using facial recognition for surveillance for five years. In its press release, the agency said the retailer deployed the technology in hundreds of stores from 2012 to 2020 to flag people who might have shoplifted, and alleged it failed to take reasonable measures to prevent harm when the system produced false matches.

The FTC's account reads like a checklist of the seats Mitchell wants filled. The agency said the database held tens of thousands of images, many of them low quality, drawn from security cameras, employee phone cameras and news stories, which is an accuracy question. It said employees acting on false alerts followed shoppers, searched them, told them to leave and called police, sometimes accusing them in front of friends or family, which is a store process question. It said the company did not tell consumers the technology was in use and discouraged employees from revealing it, which is a legal, privacy and internal communications question.

The FTC also said the program disproportionately affected people of color, and the release's subhead names women as well. The order requires the retailer to build safeguards before deploying any automated system that uses biometrics to flag people as security risks, and to stop using such a system if it cannot control the risk. A separate charge, that the company violated a 2010 data security order by failing to oversee its service providers, now requires an information security program overseen by top executives.

Mitchell's rule covers the gap the FTC described: human review has to come before any action involving a customer or an employee. The FTC had warned the sector in May 2023 that it would be watching biometric misuse closely, according to the same release, so the Rite Aid order is the agency following through rather than a one-off.

Eight more seats than AP and IT usually fill

Mitchell's list adds eight business groups to the two, AP and IT, that usually make the decision. He names operations, legal, privacy, cybersecurity, customer experience, internal communications, HR and store leadership, and says the earlier they are in the conversation the better. HR matters, in his telling, whenever a new system could affect employees, which an alert system at a staffed checkout always can.

Store leaders earn their seat because they know the edge cases. In beauty, Mitchell says, they understand consultations, testers and how customers work with advisors. In grocery, they understand checkout, pickup, and what a team can realistically handle in a rush, which is the moment an alert queue is most likely to overflow.

He adds a seat most governance lists skip: whoever owns customer data, such as a beauty client profile or a grocery rewards account. Mitchell wants clear boundaries on whether security data connects to those records at all, because a detection tool joined to a loyalty database becomes an identification tool by plumbing rather than by design. For a pharmacy, he says, the people responsible for that operation's own privacy requirements belong in the room as well.

Mitchell's roster is a practitioner's working version drawn from deployments rather than a formal committee charter. WSHB's description of what the FTC now examines, whether accuracy and bias were validated, whether staff were trained, whether foreseeable confrontations were prevented, maps onto his seats one by one.

Test against produce, testers and moving bags before alerts go live

Mitchell would not start with a product demo. He says to start with the problem: are investigations taking too long, is the store missing safety issues, and what would a better result look like in soft or hard value. Then test the system against how people actually shop in that chain's stores, because beauty customers use testers and compare products, and grocery shoppers handle produce and move items between carts and bags.

SeeChange says a system tuned to eliminate false positives may miss many real incidents and defeat its own purpose. In its October 2025 explainer, the vendor argues that the false positive rate retailers ask for, often calculated as false alerts divided by all alerts, reflects one store's conditions and cannot fairly compare two vendors unless both are tested on identical stores, checkouts and timeframes. It recommends two measures instead: precision, the share of flagged incidents that were correct, and recall, the share of real incidents the system caught.

That bounds Mitchell's warning in a useful way. He wants to avoid normal shopping becoming a stream of suspicious alerts; SeeChange's framing says the fix is a clear human process for the alerts, since squeezing them to zero means letting theft through. SeeChange does not publish a store-level false positive rate of its own, and its argument is that no such number travels between retailers anyway.

The pressure to accept more alerts is real. Everseen writes on its own site that stores with self-checkout report 33% higher losses on average than comparable stores without it, citing an ECR Retail Loss self-checkout report, and that removing the cashier removed the human oversight older loss prevention relied on. For the operations lead, Mitchell's test is whether the team can actually manage the output, and he says evaluating that capacity, along with accuracy, fair outcomes and data security, is part of the integrator's job.

Shoppers will ask who can see the footage, and store teams need the answer first

Mitchell expects questions and calls them fair. What personal information is being captured, who can see it, what it is used for inside the retailer, whether it stays with the retailer or an outside party can reach it, and how long it is kept. He says the integrator's job is to help the retailer answer each one accurately and briefly, including what the technology provider itself can do with the data, and that none of it works as a communications exercise if the controls behind the answers are not real.

The process around alerts needs the same precision. Mitchell wants it written down who receives an alert, how employees respond safely when one fires, and who handles questions about outside access, including requests from law enforcement.

Signage that omits retention periods can leave a retailer exposed where state law requires consent, WSHB wrote in February 2026. The firm's analysis of one large grocery chain's biometric notices found they met local posting requirements but did not state how long data would be held or how consent was obtained, which the firm said could open the door to regulatory action or private suits in states where a sign alone is not enough. A posted notice answers the first of Mitchell's shopper questions and none of the rest.

The measure Mitchell sets before the first alert fires

Mitchell's closing standard is the one he opened with: judge the system on safety, customer confidence and how well the store runs, and treat a good customer wrongly singled out as a brand cost rather than a rounding error. The outside signals point the same way. Squire Patton Boggs says BIPA litigation still presents a significant risk to businesses going into 2026 and beyond, and WSHB expects the gaps in biometric and AI rules to prompt more legislation.

The practical sequence he describes is short. Name the problem, decide whether solving it requires knowing who a person is or only what happened, bring the eight additional groups in before the vendor is chosen, test against real shopping, and put a human between every alert and every confrontation. A retailer that can answer a shopper's five questions on launch day has done the governance work; one that cannot has bought a camera and inherited the risk.