It is deeply concerning that facial recognition technology is increasingly being presented as an ordinary and reasonable part of everyday Australian life. We are not talking about technology confined to airports, high-security facilities or extraordinary police operations. We are talking about supermarkets, hardware stores, shopping precincts and public streets: the ordinary places people move through every day to buy food, get to work, meet friends, access services or simply exist in public.
Last week it was revealed that Coles and Woolworths have both tested facial recognition technology while considering ways to respond to theft, aggression and violence in their stores. Coles has been careful to describe what it conducted as a small, controlled “proof-of-concept” rather than a trial, stressing that customer and staff information was not used and that no decision has been made about deployment. Woolworths reportedly tested the technology in its New Zealand office and has similarly stopped short of saying it will introduce facial recognition into Australian supermarkets.
Those qualifications matter. Neither company is currently saying that every person walking into its supermarkets is about to have their face scanned. However, the significance of the story is bigger than whether Coles conducted a “test” or a “trial”. Two corporations through which millions of Australians access one of the basic necessities of life are actively investigating technology capable of identifying people through their faces. They are doing so at the same time that police are expanding the use of similar technology in public spaces and other major retailers are pushing to establish the circumstances in which biometric surveillance can lawfully be used.
Taken separately, every development can be made to sound limited. Taken together, they tell us something much more important about the surveillance infrastructure being constructed around us.
From the hardware store to the supermarket
The pathway for retail facial recognition has already been partially cleared by Bunnings. Between 2018 and 2021, Bunnings used facial recognition technology across dozens of stores, scanning the faces of huge numbers of customers as they entered. In 2024, the Privacy Commissioner found that Bunnings had breached Australian privacy law through its use of the technology.
Bunnings challenged that decision and earlier this year won an important part of its appeal. The Administrative Review Tribunal accepted that, in the particular circumstances considered in the case, facial recognition could be used for the purpose of responding to serious retail crime and protecting staff and customers from violence and abuse. The decision immediately raised the prospect that other major retailers could attempt to follow.
Importantly, the Privacy Commissioner has warned against interpreting the Bunnings decision as blanket permission for retailers to deploy facial recognition. The decision considered the particular circumstances confronting Bunnings, including violence and theft in stores selling products that could themselves potentially be used as weapons. Facial recognition involves the collection of sensitive biometric information, and Australian privacy law continues to set a high threshold for collecting that information without consent.
That distinction matters, particularly now that Coles and Woolworths are exploring the technology. A legal decision concerning a particular retailer operating in particular circumstances should not quietly become the doorway through which biometric surveillance enters Australian retail generally. Once the infrastructure exists and customers become accustomed to seeing signs announcing facial recognition at shop entrances, the exceptional has a way of becoming ordinary.
That is how surveillance frequently expands. It does not arrive with a government announcement that Australia is becoming a biometric surveillance society. It arrives through exceptions, pilot programs, trials, proofs-of-concept and carefully limited deployments. Every individual expansion is presented as reasonable because it is small. The larger question: what kind of surveillance environment are all these individually “reasonable” decisions creating together? receives far less attention.
Of course, retail workers deserve to be safe
Retail workers are experiencing serious levels of violence, harassment and abuse, and there is no reason to minimise that reality in order to criticise facial recognition. The SDA’s recent survey of almost 3,000 workers found 88 per cent had experienced verbal abuse during the previous 12 months, 25 per cent had experienced physical violence, 19 per cent sexual harassment and 10 per cent had been spat on. Around a third said they did not feel safe at work.
Workers should not have to accept assault, threats, racial abuse or sexual harassment as part of their jobs. Acknowledging that reality does not require us to accept every surveillance technology corporations propose in response. The framing of this debate as a choice between facial recognition and worker safety is itself something we should resist.
There are questions that deserve to be asked before we accept the claim that biometric surveillance is necessary. Will facial recognition stop someone with no previous history from assaulting a worker? Will it prevent a customer abusing a teenage checkout operator? Will it prevent sexual harassment or racial abuse? What workplace conditions contribute to workers being left exposed to aggressive customers? What role do staffing levels, store design, security arrangements and increasingly automated retail environments play? What other measures have been considered before moving towards technology capable of identifying every person entering a store?
There is also an enormous difference between identifying someone who has repeatedly entered a store and threatened workers with a weapon and identifying someone suspected of repeatedly stealing groceries. Yet both can easily disappear into the language of “retail crime”. If facial recognition becomes established as an acceptable response to serious violence, we should be asking what prevents the category of people placed on corporate watchlists from expanding later.
Worker safety cannot become the phrase that ends the conversation rather than begins it.
The question isn’t only whether the technology recognises you
Much of the public debate about facial recognition focuses on accuracy. This is important. Facial recognition systems have generated serious concerns internationally about false identification and differential accuracy across demographic groups. A false match can have significant consequences when the person responding to the alert is a police officer or security worker who has already been told that the individual in front of them may represent a threat.
However, accuracy is only one part of the problem. Even a facial recognition system that worked perfectly would leave enormous political questions unanswered.
A perfectly accurate system could correctly identify every person who walks through its field of vision while still operating from an unjust watchlist. It could accurately identify someone whose information should never have been retained. It could accurately identify people disproportionately targeted by policing and criminalisation. It could accurately recognise someone who committed an offence many years ago and is nevertheless treated as an ongoing security risk. It could accurately identify a protester, activist or organiser if governments eventually decided those were the people they wanted to find.
The question therefore cannot simply be whether the machine gets the face right. We also need to ask who creates the list, who gets put on it, what behaviour qualifies someone for inclusion, how long they remain there, whether they know they are listed, whether they can challenge their inclusion, who can access the information and what prevents the purpose of the database expanding over time.
For criminalised people, Aboriginal people, young people, people experiencing homelessness and other communities already subjected to disproportionate policing, security intervention and institutional surveillance, these questions are particularly important. Surveillance does not begin from a neutral social landscape. It is layered onto systems that already decide some people are more suspicious, more risky and more deserving of monitoring than others.
Meanwhile, police are scanning public streets
At exactly the same time that Australian retailers are considering the future of facial recognition, WA Police is trialling Live Facial Recognition technology in public spaces.
The language used to introduce the technology is telling. WA Police presents it under the heading “Working to keep you safe”. According to police, a marked van carrying facial recognition equipment is deployed to a particular location. Cameras detect faces in real time, create biometric templates and compare those templates against a predetermined list of people police are seeking. Where the system identifies a potential match, officers review the alert and decide whether to approach the person. Police say that when there is no match, the biometric information is immediately deleted.
The reassurance is that most people’s information is not retained. But that reassurance can obscure what has already happened before deletion occurs. A person has walked through a public space without being suspected of any offence and their face has been detected, processed into biometric data and compared against a police watchlist.
The surveillance occurs first. The determination that police are not interested in you comes afterwards.
This matters because police have rejected characterisations of the technology as mass surveillance. Yet a system designed to locate a relatively small number of people necessarily works by processing much larger numbers of people who are not being sought. The watchlist may be targeted, but the camera cannot know who is on the watchlist until it examines everybody passing through its field of vision.
This changes the relationship between the individual and public space. Historically, simply walking down a street did not mean presenting yourself for automated identification against a police database. Live facial recognition makes that technically possible at scale.
When corporate surveillance meets state surveillance
This is why the Coles and Woolworths story should not be considered separately from what police are doing. The bigger issue is the gradual construction of a society in which biometric identification becomes embedded across multiple spaces of ordinary life.
The supermarket scans people entering to buy food. A hardware store scans customers coming through its doors. Police scan people walking through a city precinct. Shopping centres already contain extensive CCTV networks. Other retailers continue to monitor developments and consider whether facial recognition might become useful to their businesses.
Each system may have different rules. Each database may initially remain separate. Each organisation may promise strict limitations. But surveillance infrastructure matters because infrastructure creates possibilities that did not previously exist.
Once cameras capable of identifying people become normal, arguments inevitably emerge for using them for additional purposes. Technology introduced to identify people accused of serious violence can be expanded to other offending. Systems introduced overtly can create pressure for covert deployment. Information collected for one purpose becomes valuable for another. Watchlists expand. Retention periods change. New governments inherit technologies established by previous governments.
This process is often described as function creep, but there is nothing accidental about recognising that infrastructure built for one purpose can become politically useful for another. The question is not whether every current operator intends to misuse facial recognition. The question is what capabilities we are collectively building and what future institutions will be able to do with them.
What happens when the place being surveilled is where you buy food?
Supermarkets also raise a particularly difficult question about consent.
A person can reasonably choose not to enter some highly surveilled environments. They can decide not to visit a casino or attend a major sporting event. It is considerably harder to opt out of buying food.
Coles and Woolworths hold an enormous share of Australia’s grocery market. If facial recognition were eventually introduced across major supermarket chains, the argument that customers can simply choose not to enter becomes increasingly meaningless. A sign at the door announcing biometric surveillance does not magically create meaningful consent when the person entering needs groceries.
That should make us especially cautious about allowing surveillance technologies to become normal in essential or near-essential spaces. The fact that something can potentially be done lawfully does not mean it should become socially acceptable. Legal permission and democratic legitimacy are not the same thing.
The question should never be limited to whether corporations can satisfy the legal requirements necessary to scan people’s faces. We should also be asking whether corporations should have this capability at all.
Surveillance does not become harmless because the sign says “safety”
Perhaps the most important thing connecting all of these developments is the language used to justify them.
Safety.
Retail worker safety. Customer safety. Public safety. Protecting vulnerable people. Finding dangerous people. Preventing violence.
These are powerful arguments precisely because the harms they refer to are real. Nobody wants retail workers assaulted. Nobody wants people threatened with weapons. Nobody opposes finding someone who poses an immediate danger simply for the sake of opposing police technology.
However, “safety” cannot become a word that places technologies beyond political scrutiny. Some of the greatest expansions of policing, imprisonment, border control and surveillance have historically been justified through promises of keeping particular populations safe. The relevant question is always what powers are being created in the process, who those powers will be used against and whether they can later be expanded.
We can demand safer workplaces without demanding biometric surveillance. We can oppose violence without agreeing that everyone entering a supermarket should become identifiable by a corporation. We can want vulnerable people protected while remaining deeply sceptical about allowing police to routinely process the faces of thousands of unrelated people in public spaces.
These positions are not contradictory. They are what serious scrutiny of state and corporate power requires.
Your face should not become a permanent identity card
There is another reason facial recognition deserves particular concern. Unlike many other identifiers, our faces cannot simply be replaced.
Passwords can be changed. Bank cards can be cancelled. Phone numbers can be replaced. If biometric information is compromised, the person whose body produced that information cannot simply request another face.
Facial recognition also fundamentally changes what cameras are capable of doing. Traditional CCTV may capture an image of someone moving through a particular place. Facial recognition attempts to establish who that person is. At scale, that creates the possibility of connecting identity to movement through physical space in ways that previous generations of surveillance could not easily achieve.
That is not a minor technological improvement. It represents a qualitative change in surveillance capacity.
That is why we should stop treating each new facial recognition story as an isolated controversy. Bunnings is connected to Coles and Woolworths. Retail surveillance is connected to police surveillance. Public facial recognition trials are connected to broader questions about databases, watchlists, artificial intelligence, policing and the future anonymity of public space.
The danger is not necessarily that tomorrow morning Australia wakes up as a fully integrated biometric surveillance state. The danger is that we build the components gradually enough that we never have a meaningful democratic conversation about the whole thing.
One trial. One proof-of-concept. One legal exception. One police van. One retailer. One watchlist.
Eventually the extraordinary becomes administrative, and the administrative becomes normal.
We should be asking these questions now, while there is still something to argue about, rather than years from now when walking into a supermarket, shopping centre or public square and having our face automatically examined against somebody’s database has become simply another condition of participating in public life. The fundamental question is much bigger than whether Coles or Woolworths decides to introduce facial recognition.
It is whether we are prepared to allow the human face to become a checkpoint, a biometric identity document we are required to present, without ever taking it out of our pocket, everywhere we go.
