By Tom Simonite
The law that took effect January 1 says businesses must â€œinformâ€� consumers that they are collecting personal information â€œat or before the point of collection.â€� The attorney generalâ€™s draft regulations, due to be finalized in time for enforcement to begin in July, suggests physical premises distribute paper notices or display â€œprominent signageâ€� with a web link.
B8ta declined to explain how it reasoned that knee-high notices might inform customers or count as â€œprominent.â€� The companyâ€™s stores, which resemble Apple stores, feature quirky consumer gadgets such as an e-ink typewriter alongside products from names like Asus and Google. The retailerâ€™s pitch to lure new partners cites its storesâ€™ ability to provide live data on how customers engage or linger near products on display.
Other companies collecting data from customers in stores have taken different approaches to disclosure.
One patron of Brazilian steakhouse Fogo De ChÃ£o received a printed CCPA notice when he visited the chainâ€™s San Francisco restaurant in early January. It informed him that the company collects personal information during purchases and reservations, uses security cameras, and mentions the restaurantâ€™s guest Wi-Fi. That, too, according to the companyâ€™s updated online policy, collects personal information.
Inside the Macyâ€™s store in San Franciscoâ€™s Union Square this week, the camerasâ€”potentially using facial recognitionâ€”were obvious, but no privacy notices were visible, even at knee level. The company did not respond to multiple requests for comment.
Californiaâ€™s new privacy regime could help reveal how use of facial recognition is spreading in stores and other semipublic places as the technology becomes more accessible. Loweâ€™s says it previously tested the technology in three stores, but ultimately decided not to use it.
Peter Trepp, CEO of facial recognition provider FaceFirst, declined to say whether he is telling retail customers to post notices in California informing shoppers their faces might be analyzed. The company claims to work with airports, sports teams, and Fortune 500 retailers, who use the software to alert staff when shoplifters known to a store return.
â€œItâ€™s still a new law and hasnâ€™t really been tested yet,â€� Trepp says of CCPA. The company or its customers already post notices in places where local laws require it, he says, but declines to specify them. â€œWe err on the side of providing notification if we need to,â€� Trepp says.