Coles tests facial recognition as privacy law bites

By Alex Mercer · 2026-08-18

The scan at the checkout

Retail loss prevention has one persistent weak point: the door. Self-checkouts can be hardened, staff trained, body-worn cameras installed, and shrinkage still climbs. Facial recognition technology promises to close that gap by matching every face entering a store against a watchlist of known offenders. The engineering logic is clean. The legal and ethical architecture around it is not.

Coles disclosed in an ASX announcement that it had conducted a "small, one-off, controlled proof-of-concept test" of facial recognition technology, stating it did not use customer or team member information or data, and that no deployment decision has been made.^[1] The disclosure is careful and minimal: it confirms the technology was evaluated but declines to specify where, by whom, or what the test measured.

Woolworths has made no equivalent disclosure. What each retailer is actually trialling, and where, remains largely opaque, which sits uneasily with the transparency obligations regulators say the Privacy Act 1988 already imposes on collectors of biometric data.

Why retailers want the technology

The retailers' case for facial recognition runs through a familiar set of pressures: rising shoplifting rates, increasing aggression toward staff, and the inadequacy of existing deterrents. Self-service checkouts have reduced friction for customers and for thieves simultaneously, and incidents of violence at registers have climbed across the sector.

Bunnings has already moved from trial to rollout on the back of a favourable tribunal ruling. Its corporate statement frames the decision explicitly around that legal clearance: "Our decision to roll out FRT follows a finding by the Administrative Review Tribunal (ART) in February 2026, which found Bunnings was entitled to use FRT to combat very significant retail crime and protect team members and customers from violence, abuse and intimidation in our stores."^[6] For Coles, that ruling provides a template, but not a guarantee.

What the law actually requires

The legal situation is genuinely complex. In November 2024 the Office of the Australian Information Commissioner determined that Bunnings had breached Australian privacy law by collecting personal and sensitive information through facial recognition technology across 63 stores between November 2018 and November 2021, finding that facial images constitute sensitive information under the Privacy Act 1988 and that their collection ordinarily requires consent.^[2]

On 4 February 2026, the Administrative Review Tribunal partially set aside that determination. The tribunal found Bunnings was entitled to use facial recognition to combat very significant retail crime and to protect team members and customers from violence, abuse and intimidation.^[3] That finding turned on a specific condition: the retailer had to demonstrate a serious threat. The tribunal did not open the door to general retail surveillance.

Australian Privacy Principle 3.4 is the operative mechanism. It permits collection of sensitive biometric information without consent only in a permitted general situation, primarily preventing a serious threat to life, health or safety, and requires a formal risk assessment and strong safeguards before collection begins.^[4] In practice that means documented evidence of threat level, a proportionality analysis, staff training protocols, and clear public notice, not a camera quietly running above the entrance.

Privacy Commissioner Carly Kind has said the position plainly: "Facial recognition technology may have been an efficient and cost effective option available to Bunnings at the time in its well-intentioned efforts to address unlawful activity… However, just because a technology may be helpful or convenient, does not mean its use is justifiable."^[2] That framing is already relevant to Coles. A proof-of-concept test is not deployment, but the direction of travel is clear enough that the Commissioner's warning applies now.

The bias problem built into the hardware

Even if a retailer clears the legal bar, the technology itself carries a structural fairness problem that no risk assessment has yet satisfactorily resolved. Independent academic research has documented substantial demographic accuracy disparities in commercial facial recognition systems, with error rates reaching 34.7% for darker-skinned women compared to under 1% for lighter-skinned men.^[5]

That gap is not an edge case. A system deployed for loss prevention is systematically more likely to misidentify a specific demographic group, generating false alerts, triggering unwarranted staff attention, and exposing shoppers to biometric profiling on the basis of race and gender rather than behaviour. No corporate policy around proportionate response corrects for an underlying model that errors at 35 times the rate for one group compared to another.

The OAIC's own guidance on facial recognition risk assessment identifies demographic bias as a primary factor in any proportionality analysis, meaning retailers who ignore the accuracy gap cannot claim to have completed a compliant risk assessment.^[4] Civil liberties organisations have pointed to this disparity as evidence the technology cannot be deployed equitably at present, regardless of whether the legal threshold for serious threat is met.

What shoppers can actually do

Under the current framework, shoppers do not have a general right to opt out of facial recognition scanning at a retail premises. If a retailer has legitimately cleared the APP 3.4 threshold, demonstrating a serious threat, completing a formal risk assessment, and providing transparent notice, collection can proceed without individual consent. That is the central asymmetry the February 2026 tribunal ruling created.

Shoppers who believe a retailer has not met those conditions can lodge a complaint directly with the OAIC. The complaint process is free, and a determination in the complainant's favour can require the retailer to cease collection and destroy existing data. If a retailer cannot produce documented threat evidence or has not displayed notice of facial recognition use, that failure may itself constitute a breach of the Privacy Act 1988.

For Coles specifically, the situation remains in a disclosed-but-not-deployed state. The ASX announcement establishes that a test occurred; it does not establish that any biometric data from customers was collected.^[1] Any move toward deployment would require Coles to satisfy the same documented serious-threat assessment and proportionality review that Bunnings pursued, and which still took years of regulatory and tribunal proceedings to resolve.

Alex Mercer

Alex Mercer writes about technology, energy and infrastructure. He likes the physical end of the story: the plants, the grids and the machines that everything else depends on.