Retailers are turning to facial recognition software (2018)
buzzfeednews.com
buzzfeednews.com
I don't want to be informed when my face are being scanned, in the same way that I don't want to be informed when a website is about to sell my data. What I want is for the law not to allow such things.
This dimension of privacy is still open for debate.
As a sibling comment notes, this is how general store customer interactions used to be done. The "facial recognition" system in question was the store owner themselves.
I don't see your point. It's an ethical discussion. Is the goal is to maximize your personal convenience or is the goal is to maximize ethics, while still allowing your extreme convenience?
> As a sibling comment notes, this is how general store customer interactions used to be done. The "facial recognition" system in question was the store owner themselves.
I disagree with the statement in general, but rather than dissecting it, I'll point out that the issue is "spying", not the particular action of recognizing your face.
Positioning "maximize your personal convenience" vs "maximize ethics" begs the question of whether the two are opposed. I don't think they are because I don't think it's unethical for a company to use facial recognition (as the OP seems to assume).
As the other child comment mentioned, there are many ways to identify yourself to a store that don't require facial recognition. The YMCA for example has a system that lets users track their exercise history; there's no reason Macy's couldn't do the same for your purchases. If indiscriminate ID'ing is the default position, then you have decided that _your convenience is more important than the freedom of every other person in the store._ It should be the responsibility of the person who wants this convenience to opt in, not the responsibility of the rest of us to opt out.
The desire to not have PiD stored by anyone should be reason enough to close the debate. But if it's not, we fortunately have hundreds (thousands?) of cases of corporate consumer abuse and irresponsible data storage to point to.
It seems to be getting largely positive reviews from its users.
> The desire to not have PiD stored by anyone should be reason enough to close the debate.
Why? There is an open question of societal benefit versus personal benefit regarding how PID is tracked and used, to say nothing of the actual ownership of that PID (if you walk into a store's private property and their security cameras record an image of your face while you're standing in their private property, do you own that image? Why should you? You're in their property and it was recorded with a camera they own on to media they own).
Cheers - where everybody knows your name.
With facial recognition being able to query a face against a number of databases, and payment information able to be queried as well, it just takes a matter of some SaaS subscriptions to be able to know someone's: name, address, email/phone/social media, wealth, education, employment history, what they look like, where they go, who they associate with, when they go places, what they buy/own, etc, etc.
It's like having a stalker behind your back all the time letting subscribers know someone's life history in exchange for trying to extract as much money and value out of person as possible until they are completely used up.
We might as well just back to feudal society and slavery because the game may be different but the motivations are the same.
With a focus on quality, peace of mind, and best value for money products, focus on minimizing SEO plays and fake reviews.
The infrastructure exist and is rentable from many(although a bit pricy).
Maybe all of those, together, would offer enough value to enough people to make prices reasonable.
Privacy is a concern that really doesn't matter much, until it does. For other concerns like this it seems like regulation is the only thing that works. For example, insurance companies are highly regulated because the default risk of an insurer is something so amorphous for the average consumer to determine that it's basically impossible for them to judge on their own. So that's when government steps in and says there are basic standards an insurance company must adhere to to operate at an acceptable level of risk. I feel like that's the same for privacy. The average user isn't really able to comprehend, or value, the gradual long term effects of privacy erosion, so that's where the government steps in to demand all players must have basic standards.
This is currently because the internet treats data collection as an "opt-out" feature, if you're even allowed to do that. Changing the law so that it is "opt in", and via a mechanism that is clear to a layman, might significantly change that for people. Wasn't that the point of GDPR, anyways?
Cookie tracking is transparent and doesn't bother most of the populace; In fact, what bothers them is being annoyed by nagging cookie tracking notifications.
We take precautions to prevent unauthorized access to or misuse of data about you.
We do not run ads, other than the classifieds posted by our users.
We do not share your data with third parties for marketing purposes.
We do not engage in cross-marketing or link-referral programs.
We do not employ tracking devices for marketing purposes.
We do not send you unsolicited communications for marketing purposes.
We do not engage in affiliate marketing (and prohibit it on CL).
We do provide email proxy & relay services to reduce unwanted email.
Please review privacy policies of any third party sites linked to from CL.
They offer ads users either browse or search by keywords.
It wouldn't solve the privacy issue but I think if companies are compelled to hold a record from whom they purchased/obtained data, it would help. It would help to determine if the originator had informed consent to share it and also if that included every company in the chain.
Currently if a company 'loses' their data then people who never even interacted with this company gets their data exposed without them knowing. If you're dealing with personal data, why not keep a record how, where and when you obtained it from?
No but, ever since "the Schneier piece" [0] I've been thinking differently about this whole issue. It's about identifying you, and well, the store already knows exactly who you are as soon as you use your credit card. So does Amazon.com of course, though ironically they might not have an image of your face.
If you were going to that physical store and planning to use cash (or shoplift), THEN this affects you. Although even without "AI," you would still get captured on security cameras. So if your presence there became a matter of interest - let's say for example, to corroborate or debunk your alibi for a more serious crime elsewhere - someone would invest the time to identify your face the old-fashioned way. Like probably a subordinate of the senior detective on the case, watching hours of camera footage looking for you.
You can see how it was a series of small, slow, incremental steps, each one not necessarily big enough to create an uproar, that got us here.
[0] https://www.nytimes.com/2020/01/20/opinion/facial-recognitio...
There's an interesting related issue here for brick & mortar businesses with CCPA and GDPR in effect: you can do some useful analytics, personalization, and fraud prevention work with probabilistic identity info, but if someone verifies they actually are Person X and wants to download or delete whatever data you have on them, what can you confidently say is actually their data?
Will companies be held to different standards based on how much money they've invested and success they've had in identity resolution, in which case this might be a factor dissuading them from doing more identification and personalization? Or if they haven't invested millions in trying to figure out who people are, but it's possible to do so, are they liable for some kind of misconduct if they don't produce all the data they have that could have been tied together for that person? Is the choice binary, i.e. either invest big in identity resolution and take it as far as possible (with parallel governance investment) or de-identify everything you can? A privacy advocate might think on first pass that it's as simple as choosing the latter, but that's mostly not possible due to requirements we face related to other regulation and business realities: fraud, anti-money laundering, age-related laws, shoplifting, intense competition in a razor thin margin industry, etc.
Data privacy is complicated.
We are wringing our hands over the issue when in reality we can solve it like the Gordian Knot.
I was going to question if we'd reached the point where it is not only impossible to avoid handing over intimate identifiable data, but necessary to participate in society - and I realized that we probably passed that threshold a few years ago, although this does make things seemingly worse.
I wonder how long before they'll ban adversarial masks or hats in the name of safety or some other such nonsense...
You'd also need to get the fake ID delivered somewhere other than your home, so it couldn't be trivially tied back to you.
Except that a fake ID will have your picture on it.
First ask them why they need this system. If it's reasonable then implement rules and laws so it can only be used for this specific purpose.
If the reason for installing it is to prevent theft then they shouldn't have any problems with rules limiting them to this one specific usage and a fine if they used it for anything else (eg. marketing).
We can also make up rules where it is acceptable to use it for marketing (informed consent being the bare minimum).
These things, like face recognition of customers, have a tendency of spinning out of control. They say they originally used it for purpose X but because they have the data... Why not use it for purpose Y and Z?
In all seriousness, it does open a business opportunity to create proxies to do your shopping for you, essentially hiding your identity through third parties. I don't think that's the real solution. We need to legislate these issues.
Years ago these were clearly possible options. It's only a matter of time before we start to see dynamic pricing based on identity as well. Consumers need to stop allowing these practices to happen. Spend more and shop at smaller shops if you have to. Elect people who will stop letting corporate greed interests take over at the detriment of our shared society and living conditions.
Online, you're screwed. They link you with your phone number and/or email address and those are often necessary for purchase.
For some sorts of purchases, particularly larger purchases, the benefits of a credit card become more important. But for most casual day to day purchases? Not so much in my opinion.
My main point is that the finance companies don't provide enough value to warrant a % of every dollar I spend. Not to mention that the % is most likely already baked into the price of everything I buy, so that charge is actually being paid by me the consumer, rather than by the retailer. I don't think there's ever been a time throughout history where finance companies have been paid on so many separate occasions throughout a single product purchase lifecycle: e.g. finance charges trickled throughout the supply chain before it arrives at the retailer, finance charges paid to/from retailer vendors, the % collected being discussed here, the extra % charged if the purchaser doesn't pay their CC bill on time, etc. The best and easiest way to begin taking power away from these companies is to simply start paying cash at all times, especially for the more expensive items considering they charge a percentage. Then switch to paying with personal check once your cash-holding-amount discomfort exceeds your retailers-will-have-my-personal-info-and-might-use-facial-recognition discomfort.
Closer to 2% to 3%.
In the US it's long been illegal to wear masks in public. From what I understand, this was done as a response to KKK members wearing masks to intimidate their victims and hide their identity.
However, I've personally never seen or heard of the anti-mask laws enforced, and I see Asian people wearing surgical masks in public relatively often, without any legal consequence that I'm aware of. People wearing masks on Halloween also seems to be not only tolerated but encouraged. And, while concern about the Wuhan coronavirus lasts, I expect to see a lot more masks worn in public.
Of course there are certain locations like banks, jewellery stores, courthouses and other government buildings, where wearing a mask probably won't be looked upon too kindly.
If challenged, I wonder if arguing that the mask was your way of expressing your wish not to be tracked would be successful. Of course this is all irrelevant since it likely won't be law enforcement you have to contend with - presumably businesses that cared would simply refuse entry to those with face coverings.
Walking into a store with other sorts mask on in America runs a not insignificant chance of getting you shot, or at least held at gunpoint. But more importantly, you'd be traumatizing everybody else in the store. When somebody walks into a store with a mask on, more people expect 'robber' than 'privacy enthusiast'.
I know that security through obfuscation is not a valid method for storing bitcoin keys. But privacy via idiocy is more common than not (exceptions do apply: https://en.wikipedia.org/wiki/History_of_the_Jews_in_the_Net...)
It makes me want to move to Illinois. How tone deaf is this company?
I also noticed that they couch their losses in “lost sales”, as if the shoplifters would have purchased the items had they only been caught.
How often is a desired product unavailable because some of the inventory was shoplifted?
Lots of maybes there. A sale at sticker price can't be assumed just because the product exists in a store. Had the story used the cost of the item, not imagined sales, I wouldn't have brought it up.
[1] https://en.wikipedia.org/wiki/Amazon_Go
PS - Illinois also prohibits discrimination against employees that do not consent to biometric-based tracking and thus all of the systems for sale in Illinois have traditional methods that can be used at all times.
Even if you had to sign a EULA when you entered the store, there's no way to meaningfully consent to submitting your biometric data into a legally unlimited universe of analysis, cross-referencing, marketing, credit reporting, law enforcement, and whatever else ingenious minds can invent. This just isn't a consent problem. It's a regulatory problem.
Under a proper regulatory regime, you shouldn't need to consent to a computer recognizing your face any more than you should for an employee to recognize your face, because the laws constrain what the computer can do with that recognition, and you can reasonably expect those limits to be in line with what the employee could do.
The casinos all have facial recognition, and share the data.
The card sharks and other troublemakers are greeted at the door and shown the exit.
source: have a friend who works in las vegas.
I'm sure I'm far from alone in assuming you're out to commit violent crime.
https://www.veneto-explorer.com/history-of-the-venetian-mask...
Facial recognition is processing of biometric data, which belong to the "special categories of personal data", which are protected under Article 9 GDPR [1].
Customers would need to give explicit consent to this.
Contrast this with normal security cameras, which don't use biometric data: these do not necessarily require consent. For example, security cameras filming a cashier's desk are usually lawful because of legitimate interests (see Article (6)(1)(f) [2]).
But legitimate interests don't work with Article 9 data.
The other image of a violent offender is more along the Ted Bundy type. Less a victim of traditional bias but a total serial killer stereotype - white, inconspicuous male.
It's usually a slippery slope with these kinds of biases being perpetuated at the software design level - "stoner" types, minorities, and other marginalized groups often getting the short end of the stick.
I understand retail wanting to reduce shrinkage (the term for stock loss via theft). I guess that's one concern as a whole, how is it ethically being handled?
You've also got a GPS becon in your pocket, and are probably paying with a card attached to your name and government ID number.
So unless you're paying in cash and not carrying a phone, you're already a big red dot.
Pew, 2015
https://www.pewresearch.org/internet/2015/05/20/americans-at...
Unfortunately time-series data on perceptions and sentiments is difficult to find. But the very fact we're discussing this on the grounds of it being or not being an Edward Snowden-related awareness speaks to Snowden's impact. As does the the fact that the matter hasn't been considered notable enough to warrant tracking over time as part of a sentiment study.
Writing as someone who has been long aware of the issue, well before Snowden. But who has also noted that the nature and tenor of discussions with others since has changed markedly.
Why are we allowing people to go around society being this ignorant of what's going on?
Take the opportunity to gently inform the guy of all the information the government has on him.
I don't. My phones are rooted. GPS access is limited to a few apps and only on demand. So is app-access to IMEI and other identifying markers.
Not by design but I also get a new SIM each month ($18 unlmtd talk/text+10GB).
These measures are all technologically & economically cheap, btw.
But they're locked away from consumers because the compulsion to control end users is a sickness that corporations can't regulate on their own.
Can you tell me more about this?
You walk past my house, I see you have connected to direct-roku-845-7e16d8. Great! I can go do a reverse lookup of that (say, based on information collected by SkyHooks or WiGLE), and I now know that you've at least authenticated to a network in downtown SF one time.
With a good sampling of these (many pieces of software send the last 4+ networks), I can get an idea of where you live, where you work, and where you've traveled. From your device details I can tell what brand of device you have, from the times of day I see you I can work out what your patterns and behaviors are, from your bluetooth connections I can get an idea of what sort of devices you own. I can even match this with real time video and directional antennas to match this with a picture of your face.
This is all things that an individual can do right now with off the shelf software, not something you need to be a company or a government agency to pull off. This is absolutely receive only, and does not interact with anybodies devices in any way. It is not illegal and you can not detect that someone is doing this sort of attack. Your only defense against this is to have as bland and as generic of a wifi point name as possible.
And once all major stores link up and you get banned from everything, how do you survive once you can't buy anything anymore?
High quality selfies might be sufficient to build a database. But since faces are larger features that don't need close-ups they're commercially more useful.
I do mind when the line is crossed and my information is shared with unrelated external entities to monetize me
I feel like that use of facial recognition would have a far greater ROI than loss prevention.