7-Eleven breached customer privacy by collecting facial imagery without consent | Hacker News Reader

7-Eleven breached customer privacy by collecting facial imagery without consent

zdnet.com

204 pointsBender67 comments

I've noticed not only the local 7-11 PoS terminals now have embedded cameras, but also Home Depot's newer all-in-one computers at the self-checkout include an embedded camera.

It's obnoxious and rude. You wouldn't be OK with anyone shoving a camera point-blank in your face while doing business with them. That's exactly what these businesses are subjecting their in-person retail customers to.

Except that's not what 7-11 did here. They took photos from a tablet, as select customers were taking a survey.

Doing that without consent is still obnoxious, but a far cry from embedding a camera in the PoS terminal that captures everybody as they check-out. 7-11 might also do that, but it wasn't reported here.

Ok. Firstly, whoever did that is one sick creep. Secondly, Why!? What value is added?

the laziness of it all would be funny, if it didn’t indicate that people have to now be on the lookout at this casual of a level.

They did it with consent.

The issue is that regardless of whether the users gave consent, their actions still ran afoul of Australian law.

There was no consent. I've done that "survey". No idea my photo was being taken or that there was even a camera.

This is something I've noticed recently and I'm actually glad that masks are socially acceptable in public now for this very reason.

I think facial recognition may be fairly accurate in some cases even when wearing a mask. Somewhat anecdotal, but saw this article recently:

https://onezero.medium.com/you-can-fool-a-popular-facial-rec...

I've read the article and it's about facial detection - it detects that there is a face on the picture.

Haven't read anything about identifying the person wearing the mask.

Systems are getting pretty good at working around masks, but the error rate is still greater when masked than when unmasked.

With most systems, if you want to maximize the error rate then you should wear a solid black mask that covers the entirety of your lower face.

Having actually worked in the space, no one cares about identifying you*

They're trying to do sentiment analysis and maybe some sort of classification on age/gender

*Yes, I'm sure if you Google for an anecdote of a system that did identify users you'll find one, but it really gains nothing in the space. They already have your card data and rewards programs, usually what they care about it sentiment and demographics at a specific spot in the store

Perhaps that's true in the retail space, but I was really addressing all uses and not just retail. However, if wearing such a mask can increase the error rate when it comes to sentiment analysis and age/gender classification as well, that's gravy.

OK a mask with someone else's face

Every single ATM has done this since Moses was kneehigh to a grasshopper.

The ATM gives you money though…

7-11 takes your money for yucky hot dogs and apparently also your face long enough to satellite it to Azure. That’s weird.

You're the one buying the yucky hotdog, so you kind of deserve to have your face scanned and posted on a "hotdog of shame" website. I mean, if we can have a People of Walmart site, why not one for 7-11?

Home Depot's newer all-in-one computers at the self-checkout include an embedded camera.

Makes me glad I never - ever - use self-checkout.

I'm not interested in helping replace human jobs with robots just so a bean counter in a boardroom somewhere can buy a second boat.

Occasionally, the self-checkout "team member" will come over to me while I'm standing in line and offer to help me use the self-checkout. I tell her, "I'd rather not help {$company} replace your job with a robot."

I expect a lot of times they think I'm a kook. But every once in a while they pause and I can see the realization washing over their faces. Then I feel like I've accomplished a small thing that day.

Some highly repetitive jobs are better left to machines if we can. Every programmer is a farmer that has been automated out.

As someone who used to have that job, the only thing I was thinking when someone said that was: well it’s going to happen eventually, and I’m glad retail is not my career

Every line of code you write is a job automated.

The cameras that are certainly watching you at checkout are the same ones you know or should know are watching you in every retail establishment in the country. The ones overhead. Retailers use a relatively small number of cameras mounted overhead in order to have broad coverage of a large area that is hard to obscure.

I do not know for absolute certain, and couldn't divulge it if I did, but I am about 99% sure that the cameras mounted in the all in one systems are part of the standard equipment included with that model of computer NOT part of store surveillance coverage which is more than adequately served by existing cameras. That is to say that it would be a waste of resources to watch the other cameras watch you.

The key is that they include user facing sliding camera covers designed for users to secure their privacy. This wouldn't be true if they were intended to watch you.

The reason you are being watched is that people steal and people steal MORE when dealing with a machine because they feel less guilty about doing it perceptibly to a machine rather than cheating in front of an actual cashier.

The Atlantic did a piece on it where it was found that around 1 in 5 people stole from SCO and about 4% of merchandise that went through SCO wasn't paid for.

https://www.theatlantic.com/magazine/archive/2018/03/stealin...

>I've noticed not only the local 7-11 PoS terminals now have embedded cameras, but also Home Depot's newer all-in-one computers at the self-checkout include an embedded camera.

Starbucks card readers too. Pointed right up at your face. I emailed the local store manager about it, who said he'd get back to me but never did.

Starbucks card readers too. Pointed right up at your face

Here's your act of civil disobedience for the day: Try to remember to bring a tiny strip of Scotch tape with you the next time you're at Starbucks. If you do remember, and if nobody's looking, put the tape over the lens. Hopefully the piece of tape is small enough to be inconspicuous, and fuzzy enough from being in your pocket that it ruins the camera's view.

Yep i don't visit enough Starbucks that often anymore but that's not a terrible idea

What did you expect the local store manager was going to be able to say or do?

Get me a policy or some sort of response in writing from their corporate overlords.

Edit: just got an update. Here's what he said:

>So sorry for never responding! We are not using the cameras on the POS card readers. You will see when it asks you to swipe the card that it has an eye crossed out to signify that it is not actively using the camera to look at the customer.

Sounds like someone at Starbucks saw your HN comment and ran a search for your email to ping the relevant manager. Impressive if not just a coincidence.

Ha that would be cool but actually I just followed up on my old email

Every single store today is doing that, and you never know when you're getting recorded for some AI training.

Even after Covid is over, I'd feel comfortable continuing with the mask!

Based on the animosity of the masks, I would not be surprised where you will not be allowed to wear a mask in public just so some people can prove a point. Buisness owners are already refusing service to people wearing masks in some places (you can probably guess where if you're not already familiar).

Yes, it's terrible. I do the only thing that's really possible for an individual to do -- I stop entering those businesses entirely.

Walmart and Target do it too. Insert card, supply an identity to go with the frames the camera is capturing. Do that a few times and you've got a training set to identify an individual.

When's the last time retail didn't have cameras, the 60s?

There's a substantial difference between areal cameras for loss prevention and a camera literally inches from your face in terms of invasiveness and hostility.

You do not know what zoom level they are in the shop, most likely they have microphones on and their resolution:

http://www.ltsecurityinc.com/citysurveillance

The only difference is that in one case, you are conscious on being filmed. In another case you know you are being filmed, but you prefer not to think about it...

What's your point? The areal cameras in the shop, regardless of zoom level, are not being replaced by the cameras in your face and only in your face; it's an additive situation.

The cameras in your face are only effective for capturing your face/person in detail, and they are presumably being applied to every customer wholesale, automatically during checkout, and probably associated with your purchase and payment information.

You're arguing as if this isn't any different than the status quo, when it obviously is.

Now we not only have the areal cameras that were presumably only zoomed-in on suspicious behaving customers for loss prevention, we also have every single in-person purchase being captured zoomed-in, regardless of behavior, with a camera lens right in your face.

It's as if retail has decided to actively encourage everyone with any shred of self-respect to stop shopping retail and buy everything from Amazon. If you treat me like a presumed criminal I'm going to take my business elsewhere. What's next, metal detectors and armed guards at the doors?

Installation of cameras at face level is nothing new. Equipment like self checkout kiosks and ATMs have had (usually discrete) cameras in the user's eyeline for decades. Higher theft targets like banks and convenience stores install (often hidden, sometimes not) cameras at eye level at the entrance and exit doors. Hidden in the height stick is common in banks, grocery stores tend to just install normal domes at head height. This is all in response to the simple fact that wearing a baseball cap is enough to prevent ceiling-mounted cameras getting your face, and your face is exactly what the police want to be able to see after a theft.

I don't intend to defend the use of facial recognition in these applications, just saying that cameras for face capture date back to the early days of continuous video surveillance in the '80s, and although I haven't seen it myself I assume there were some users that installed hold-up cameras at eye level in the '60s - certainly the importance of getting a clear view of the face was discussed in articles about hold up cameras, but in that time it was less common for people to wear hats indoors (and bank security would typically require people to remove them).

Here's the thing about the entire argument thread.

It not being new is not reason enough for it to continue.

It already existing does not mean we should never revisit this decision.

The technology on the other side of the feed is new and it has changed tremendously.

Has it, though? While much discussed, facial recognition on surveillance is very expensive in practice and so uncommon to a degree I think many here would find surprising. The article here discussed facial imagery captured by handheld cameras, not involving the surveillance system. That's why I think it's important to split these hairs: video surveillance recording of faces for post-incident use is very different from proactive use of facial recognition. The former has been accepted for decades as a practical necessity for investigation of crime. The latter is new. I think that framing the discussion around cameras at face level, which is not new, misses the point and starts from a premise that will be wholly rejected by the industry. We need to focus instead on the use of automated technology to process this data, which is new and not yet widely practiced.

That is changing. Newer self checkout terminals correlate video from both cameras with purchase history, primarily as a short-term local aid to staff when figuring out discrepancies. But this can obviously be extended to a long-term retention business intelligence application. The time is now to put pressure against this kind of data collection. But saying "there should be no cameras pointed at the face" will not apply that pressure. It will be dismissed because the use of cameras for face capture is a universally accepted anti-crime practice, and arguing against it as a way to object to mass surveillance ignores the differences between short term retention of data for post incident use and mass collection.

I hope then you dont mind I point my camera at you? :-)

https://youtu.be/AQgiLK5HuiA

Maybe the article has missed detail but it seems to imply that 7-Eleven was only asked to stop and to destroy the inappropriately collected data and was not given a fine nor any other punishment. Is that correct?

Isn't that the benefit of being a large company. You do something bad, you get a slap on the wrist and they politely ask you to stop. You do it again, same slap.. and they say pretty please. Eventually, you just realize that as long as you keep paying the politicians you can do pretty much whatever you want with little to no consequence?

Depends on the country. For instance in Europe, GDPR enforcement is way more lenient towards small companies, to the point where it makes no strategic sense for a startup to invest anything but the bare minimum required to feign "good intentions". Striving for actual compliance with the letter of the law is something only huge companies do.

Same with Rite Aid stores around my school. The auto checkout machine has been equipped with cameras since pandemic (about one yr ago). It gave me a sense of intrusion.

That’s the point. The self checkout cameras are just there to let you know you’re being watched; why else would they make them as in-your-face as they are?

Now do the rest of the corporations who have installed cameras in their stores.

Another reason to wear Reflectables on the daily.

Walmart is bound to be collecting facial images - but I don't know if they have a consent clause somewhere in store / receipt.

They are and they share those images and data with other retailers in order to build up dossiers on "problem" customers.

Except in Illinois, where that is illegal.

If it's not illegal in your state, it's time to start petitioning your elected officials.

If you don't, then you're part of the problem and shouldn't complain about the situation on the internet.

Another fun fact of Illinois protecting its citizens with that law is that schools like DePaul and Northwestern are currently being sued for violating Illinois' biometric laws with the use of facial recognizing proctoring software.

https://dailynorthwestern.com/2021/02/18/campus/nu-faces-law...

https://depauliaonline.com/52893/news/depaul-sued-over-facia...

Their self-checkout systems have an insane number of cameras per station, including one pointed right at your face. I don't doubt it's being saved for expression analysis as each product is swiped.

All I wanted was a Pepsi!

> https://soundcloud.com/deivid-dos-santos-fernandes/8-2-insti...

  song lyrics :D

This occurs in America routinely, dating to 20+ years ago.

I don't see an issue with learning the age of the customers who come into the store.

I think a much bigger issue with tech is censorship and surveillance of political opposition, not the recording of someone's age and gender.

Am I breaching the privacy of the people I saw at the grocery store yesterday because I can remember what their faces look like?

Are you a corporation going around asking for answers, photographing them and storing the images for long term storage without informing them about this? If not, then no, you are not breaching the privacy of anyone.

I know in the US corporations are basically the same as humans, but the rest of the world haven't gotten than dystopian yet.

No. It was wonderful when the person who worked the deli at a customer site where I worked for a few weeks learned my face and remembered what I liked to order. If I wanted privacy, though, I could get it.

However, scale matters. An action being condoned between two individuals does not imply that it's acceptable when repeated millions of times.

It shouldn't generate any outrage if a police officer tailed a suspect from a vehicle description and (publicly visible!) license plate number. It should generate outrage if the police department installs automated license plate readers at intersections throughout the city, and it becomes impossible to drive anywhere without being tracked.

>and it becomes impossible to drive anywhere without being tracked.

Might want to start with the mobile networks saving your phone’s location history. I do not mind the use of license plate readers on cops’ cars, if cops are actually going to start pulling over people who have not paid car taxes or are not displaying license plates or do not have insurance.

I would also like automated variate rate congestion tolling with license plate readers. That would help manage road capacity and grid lock, and make the costs of commuting more transparent.

> Am I breaching the privacy of the people I saw at the grocery store yesterday because I can remember what their faces look like?

You remembering faces is fine as it doesn't allow you to share with others what your mind "recorded". The amount of detail is questionable and you'd probably not remember everyone and everything but what strikes you as unusual/suspect etc..

Second, since you're not a machine you wouldn't be able to run algorithms on the data you recorded, you'd make a few inferences here and there and that is normal but you wouldn't be able to study the psychology of every customer that entered your store and use it against them.

> you wouldn't be able to study the psychology of every customer that entered your store and use it against them.

Is that not the role of the greeter that hounds you at the door?

No, and neither would the corporation be if they were doing that.

But you are not a corporation, nor are you a computer, nor are you storing that data in any appreciable amount or manner in which it could be referenced for the purposes of operating a corporation.

As much as I dislike this line of argumentation, I think it is important to address it, because people seem to be applying wrong standards and comparisons, when it comes privacy.

If a bit of mayo falls off my sandwich while I'm at the beach, have I created an oil spill?

Scale and context matters.

no, nor are you doing it at a massive country wide scale into a datacenter.

more than one country-wide; side note, Southland Corp was convicted of slavery-related charges at a US location.. no similarity to stores in Asia of course!

source: daily news, details on request

Reply on news.ycombinator.com