Jenna Bitar, ACLU Speech, Privacy, and Technology Project & Jay Stanley, Senior Policy Analyst, ACLU Speech, Privacy, and Technology Project

Are American retail stores using face recognition on their customers without telling them? We asked some of America’s biggest retailers and, with a few exceptions, they refused to tell us.

We do know that most major retailers have video cameras in their stores. We know that at least one face recognition vendor is pushing the use of the technology for identifying shoplifters, and claims to have several Fortune 500 retailers among its clients. We know the technology’s use is rapidly growing in the UK. We know the New York Times reported recently that the use of face recognition is being “explored” at Madison Square Garden. We know that Walmart tested the technology in its stores for several months in 2015. And now we know that at least one major American retailer, Lowe’s hardware, has begun using the technology without informing visitors to its stores.

We also know that a government-run “multi-stakeholder” process attempting to craft voluntary standards for the use of face recognition fell apart in 2015 because not a single company or corporate trade association would agree to the principle that people shouldn’t be subject to face recognition without their permission.

At this point, customers may understand intellectually that their movements in stores are captured on video — although most stores place them in domes made of smoked glass for no reason other than to hide the cameras from customers (who might find the swiveling, zooming lenses therein to be spooky and actually gain a realistic sense of the extent to which they are being watched). Most customers also probably expect that most camera feeds, most of the time, are not being monitored — and that if they are, nothing is done with the video footage that is collected, so long as nothing dramatic is captured.

But I think it’s fair to say that most customers do not think that they are being subject to a perpetual lineup, scrutinized by face recognition technology to see if they resemble anyone that a company security service has decided to put on a watch list. They do not expect that their faces are being captured, retained, connected to their real-world identity (for example when they use a credit card at checkout), and combined with information about their income, education, demographics, and other data. They do not expect that their every footstep, hand motion, and gaze will be analyzed by computers and filed away to give insight into their shopping habits, patterns, and preferences, and shared among different companies, data brokers, and advertisers. They do not expect that they are subject to the risk of being misidentified as someone in a database of suspected criminals, fugitives, terrorists, or whatever other blacklists stores may be using or begin using in the future. They don’t expect that all these intimate details about their behavior will become accessible to government agencies through legal demands or voluntary sharing.

And if those things are happening, I think most customers would want to know about it.

We don’t know how many of those things are being done by how many American retailers. We do know that the technology already exists, and that stores have a strong financial incentive to collect as much information about their customers as they can get. And we do know that when it comes to this kind of cutting-edge technology, which is taking the human race to places it’s never been before, the public has a right to know what stores are doing with it, if anything, so they can vote with their feet if they don’t like it.

Now we also know that most top retail companies are not willing to be transparent about even the most basic uses of face recognition today.

We decided to start with a simple question for some of the top American retailers: “Are you using face recognition with cameras on your customers?” Last month we took a list of the top 20 retailers published by the National Retail Federation, subtracted Amazon because of their minimal brick-and-mortar presence, and added Disney because it deals with many millions of people at its theme parks. We then sought answers to our simple question from those companies’ chief privacy officers, press contacts, or whatever other contacts we could find.

Of the 20 companies we contacted, only one was willing to tell us that they don’t use it: the company Ahold Delhaize, whose U.S. brands include the supermarkets Food Lion, Stop & Shop, Giant, and Hannaford. And one company, the hardware company Lowes, said that it does use face recognition technology — to identify shoplifters.

All the other companies we contacted refused to answer our question. Target and McDonald’s said the answer was “considered proprietary.” Rite Aid and TJX Companies (whose brands include T.J. Maxx and Marshalls) responded to us but would neither confirm nor deny the use of biometric face scans. Lowes’s competitor Home Depot, which told Fortune in 2015 that it did not use the technology, now told us that the answer to our question was confidential for “competitive reasons.”

Thirteen of the companies we contacted refused to give us an answer at all. Even Walmart, which told a reporter from Fortune in 2015 that it had experimented with the technology but stopped using it, wouldn’t say that it was not using it now.

It is unacceptable that so many companies refused to respond to our request. Customers should not have their faces scanned without their permission—and they certainly shouldn’t be scanned without their knowledge. Companies using face recognition should inform their customers — not only by answering queries from groups such as the ACLU and journalists such as those from Fortune, but by providing notice to customers in their stores.

If companies don’t think their customers will care, then why won’t they tell us exactly how they are using face recognition? If companies are afraid that their customers won’t like hearing that their face prints are being taken, and yet are doing it anyway, then there is a word for that: unethical.

The security wings of these companies may be accustomed to operating in the shadows — doing everything they can to watch customers without making them feel they are being watched. But face recognition is a brand-new, rapidly evolving technology that has enormous implications for the privacy of individuals in America. It is also a technology that has been found to have racially differential impacts. We have to decide whether we want our way of life to be significantly altered by this technology, or whether we want to limit its use to reflect our values. That assessment cannot happen if this face recognition is being arrogantly deployed in secret.

What’s really needed is for retail use of face recogntition technology to be subject to sensible regulation to ensure it comports with basic norms of privacy and fairness — but until we have that, customers have no choice but to vote with their feet. Some Americans may disagree with the ACLU’s view that we should not allow this technology to become widespread and routine in American life—but we can all agree that people should have the information they need as to whether they want to patronize stores that decide to use it in.

As far as Lowe’s goes, they deserve credit for at least being willing to answer our question, unlike most of the other companies we contacted, and for disclosing their practices in their online privacy policy. More credit goes to Ahold Delhaize, which was not only transparent, but is not using face recognition on its customers. Lowe’s writes to us that “we may use facial recognition technologies to identify known shoplifters,” and says that they do not retain facial data on people for whom it does not match to their facial database of suspected shoplifters, which is good as far as it goes. Still, if they’re going to use face recognition in their stores they should post signs alerting their customers so those customers are meaningfully informed that they are being subject to a virtual lineup.

We don’t know how widespread facial recognition is in American retail. Shoplifter identification may be the first widespread use, but without meaningful restrictions, it won’t be the last. Companies are already selling “VIP recognition” and all kinds of analytical capabilities.

These retail applications of face recognition, like the technology’s unnecessary adoption by Customs and Border Patrol, risks a dangerous normalization of this technology in American life that will clear the path for truly nightmarish uses. These systems are the beginnings of an infrastructure for tracking and control that, once constructed, will have enormous potential for abuse, to create chilling effects, and to change what it means to be in public in the United States.

It’s a scene out of a dystopian police state: Your bus pulls into the station after a long ride, but before you can get off, law enforcement agents board and make their way down the aisle, peering at passengers. They see brown skin, or hear a foreign accent, and stop to demand identification, then proof of citizenship. Those who don’t satisfy their questions are escorted off the bus.

All across the country, Customs and Border Protection agents are boarding buses — with Greyhound’s consent — and subjecting riders to interrogation and detention based on nothing more than the color of their skin or the sound of their voice. This is not an entirely new tactic but under the Trump administration, it’s on the rise. With deportation arrests soaring and the mandate that everyone is a target, CBP’s enforcement actions have moved inland and are increasing in intensity.

Riders in Vermont, California, Washington, Arizona, and Michigan have all reported Border patrol boardings. Unfortunately for the passengers, Greyhound has been complicit, electing to give CBP access to their buses and enabling the agents to harass and violate the rights of the people on board.

Bus riders, however, have rights. The Constitution protects everyone in this country, regardless of immigration status, from racial profiling and arbitrary searches and detentions. Rather than acquiescing to CBP’s bully tactics, Greyhound can protect its customers from discrimination and suspicionless searches. Last week, ACLU affiliates in 10 states sent Greyhound a letter urging it to deny Border Patrol agents consent to board its buses and search its passengers without a warrant.

TELL GREYHOUND TO PROTECT PASSENGERS

The Fourth Amendment protects both private businesses like Greyhound and individuals like its riders. To access the nonpublic areas of a business — like a Greyhound bus, where one needs a ticket to board — immigration officials must have a warrant or Greyhound’s consent. And to detain and question passengers, the Constitution makes it clear that CBP agents need to reasonably suspect a person is subject to deportation. Crucially, Border Patrol can’t base this suspicion solely on the color of a person’s skin or on the language she speaks.

In past public statements, Greyhound has justified its cooperation with CBP with reference to a federal statute stating that, within a reasonable distance of the border, CBP agents may board vehicles without a warrant. But Greyhound has it wrong: This statute doesn’t require Greyhound to grant CBP free rein over its property.

As the Supreme Court has made clear with reference to this very law, “no Act of Congress can authorize a violation of the Constitution.” The Fourth Amendment protects Greyhound from unreasonable government searches. In other words, statute or no statute, agents still need a warrant or Greyhound’s consent to board its buses. Nothing compels Greyhound to enable Border Patrol agents’ violation of bus riders’ constitutional rights.

Greyhound can and should assert its Fourth Amendment rights and decline CBP officers consent to board its buses. It should protect families like the 12-year-old arrested on a bus in Miami or the father and his DACA-recipient son questioned as they rode from Seattle to Montana. It should uphold the principle that, in this country, we are all free to ride the bus without fear of discrimination — or deportation.

This past weekend, hundreds of thousands of protestors from around the country took to the streets to demand action against gun violence. The movement has been energized by young people who turned out en masse in response to the horrific shooting in Parkland, Florida, in which 17 people — most of them teenagers — lost their lives. We applaud the many students who have exercised their speech rights to seek change. This moment calls on us to act not only to ensure that massacres like Parkland do not recur but to end the everyday gun violence that takes exponentially more lives from our communities. It also demands that we do so in a manner consistent with our most cherished civil liberties and constitutional rights.

Lawmakers across the country are currently considering a range of gun control measures. The American Civil Liberties Union firmly believes that legislatures can, consistent with the Constitution, impose reasonable limits on firearms sale, ownership, and use, without raising civil liberties concerns. We recognize, as the Supreme Court has stated, that the Constitution does not confer a “right to keep and carry any weapon whatsoever in any manner whatsoever and for whatever purpose.” But some proposed reforms encroach unnecessarily on civil liberties.

When analyzing gun control measures from a civil liberties perspective, we place them into one of three categories. First are laws that regulate or restrict particular types of guns or ammunition, regardless of the purchaser. These sorts of regulations generally raise few, if any, civil liberties issues. Second are proposals that regulate how people acquire guns, again regardless of the identity of the purchaser. These sorts of regulations may raise due process and privacy concerns, but can, if carefully crafted, respect civil liberties. Third are measures that restrict categories of purchasers — such as immigrants or people with mental disabilities — from owning or buying a gun. These sorts of provisions too often are not evidence-based, reinforce negative stereotypes, and raise significant equal protection, due process, and privacy issues.

Many of the options now being considered raise no civil liberties concerns. That includes bans on assault weapons, high-capacity magazines, and bump stocks. Raising the minimum age for all gun ownership to 21, currently the legal age for purchasing a handgun, also raises no civil liberties issues, as research on brain development shows that young people’s impulse control differs from that of adults.

So-called “red flag laws,” which provide for protective orders to remove guns from people who pose a significant risk to themselves or others, can also be a reasonable way to further public safety. To be constitutional, however, they must at a minimum have clear, nondiscriminatory criteria for defining persons as dangerous and a fair process for those affected to object and be heard by a court.

Other gun control measures may also be justified, such as laws that keep guns out of sensitive places like schools and government buildings; requirements that guns include smart technologies (like password protection) that ensure that only the lawful owner of the gun may use it; and requirements that gun owners first obtain a permit, much like a driver’s license, establishing that they know how to use guns safely and responsibly. There would also be no constitutional bar to lifting the existing limits on Center for Disease Control-funded research into guns and gun violence.

Extending background checks, which cover federally licensed gun stores, to gun shows and other unlicensed transactions, is also a reasonable reform. There is no civil liberties justification for the “gun show loophole.” We do not object to universal background checks if the databases on which they rely are accurate, secure, and respect privacy.

But the categories of people that federal law currently prohibits from possessing or purchasing a gun are overbroad, not reasonably related to the state’s interest in public safety, and raise significant equal protection and due process concerns. Any number of the categories, for example, require no proof of dangerousness, and they often serve to further bias. For example, the list of those barred includes: anyone convicted of a crime punishable by imprisonment for more than a year, whether or not the crime has any connection to violence; people with mental disabilities and many noncitizens who have not been shown to be dangerous in any way; and those who have used substances on the federal controlled substance list, including marijuana in states in which it is legal.

Other proposed gun regulations also raise civil liberties concerns. The proposal to ban individuals listed on the No-Fly List from purchasing weapons, for example, is constitutionally problematic, because that list lacks basic due process protections and its standards are unconstitutionally vague.

Proposals to arm teachers and install metal detectors in schools also raise significant civil liberties implications. Introducing more guns to schools will not make them safer and may especially endanger children of color, who already bear the brunt of teachers and administrators’ racial biases. The solution to gun violence is not more guns, but less.

The Supreme Court has said that the Constitution permits reasonable regulations of firearms in the interest of public safety. We agree. But those regulations can and should be crafted to respect fundamental rights to equal protection, due process, privacy, and freedom from unlawful searches. Lawmakers should have the moral courage to act and to do so consistent with our most cherished liberties.