The policy states that Walgreens collects biometric information including facial scans for safety, security, and product feature purposes, and commits to permanently destroying that information either when the original collection purpose is satisfied or within three years of the consumer's last interaction with Walgreens, whichever comes first.
This analysis describes what Walgreens's agreement states, permits, or reserves. It does not constitute a legal determination about enforceability. Regulatory applicability and practical outcomes may vary by jurisdiction, enforcement context, and individual circumstances. Read our methodology
This provision establishes a specific biometric data retention and destruction schedule consistent with requirements under statutes such as the Illinois Biometric Information Privacy Act, which mandates destruction within a specified period. The collection of facial scans for product feature purposes alongside security purposes broadens the stated collection scope beyond traditional loss prevention use cases.
Interpretive note: The breadth of 'product feature purposes' as a stated basis for facial scan collection is not defined in the document, and whether this purpose satisfies applicable state biometric consent requirements may vary by jurisdiction.
Under this provision, Walgreens may collect facial scan data from customers for security, operational, and product feature purposes and retains that data for up to three years from the consumer's last interaction unless the original collection purpose is satisfied sooner. The agreement states that biometric information is permanently destroyed upon the earlier of purpose fulfillment or the three-year retention limit.
Cross-platform context
See how other platforms handle Biometric Data Collection and Destruction Schedule and similar clauses.
Compare across platforms →"Biometric Information: such as facial scans for safety, security, and product feature purposes. [...] Biometric Destruction Schedule: We permanently destroy your biometric information when the first of the following occurs: (i) the initial purpose for collecting or obtaining such biometric information has been satisfied; or (ii) within three (3) years of your last interaction with us.Excerpt from Walgreens's Privacy Policy
1.
Enforcement risk, jurisdiction flags, contract triggers, and due diligence action items.
Search "[your state] attorney general consumer complaint" to find your state's direct complaint form
Get the research letter
Companies change their terms quietly. We read every version and catch what actually changed. One email a week on the changes that matter and what they mean.
This provision establishes a specific biometric data retention and destruction schedule consistent with requirements under statutes such as the Illinois Biometric Information Privacy Act, which mandates destruction within a specified period. The collection of facial scans for product feature purposes alongside security purposes broadens the stated collection scope beyond traditional loss prevention use cases.
Under this provision, Walgreens may collect facial scan data from customers for security, operational, and product feature purposes and retains that data for up to three years from the consumer's last interaction unless the original collection purpose is satisfied sooner. The agreement states that biometric information is permanently destroyed upon the earlier of purpose fulfillment or the three-year retention limit.
No. ConductAtlas is an independent monitoring service. We are not affiliated with, endorsed by, or sponsored by Walgreens.