Walmart states it collects biometric identifiers such as facial geometry through in-store camera systems in certain locations, and retains this data for a limited period before destroying it in compliance with applicable state laws.
This analysis describes what Walmart's agreement states, permits, or reserves. It does not constitute a legal determination about enforceability. Regulatory applicability and practical outcomes may vary by jurisdiction, enforcement context, and individual circumstances. Read our methodology
Biometric data collection is subject to strict consent, retention, and destruction requirements under state laws including Illinois BIPA, and the policy's disclosure of this practice requires consumers in covered jurisdictions to be aware of their rights to consent or object.
Interpretive note: The exact scope of biometric collection (which store locations, which systems) is not fully specified in the available document text; application of BIPA consent requirements depends on whether collection occurs in Illinois and whether signage constitutes adequate written notice under BIPA's specific standards.
The policy states that Walmart may collect facial geometry and other biometric identifiers from in-store camera systems; in Illinois, this triggers BIPA's written informed consent requirement before collection, and consumers have the right to request information about how their biometric data is stored and used.
How other platforms handle this
At Ledger, earning and maintaining our users' trust is a top priority. That's why we are deeply committed not only to protecting your privacy and securing your personal data, but also to being fully transparent about how we handle it.
If we collect health information from these integrations (such as heart rate), we will not sell or use it for advertising or other similar purposes; we do not disclose it to third parties without your prior consent; and we will only use it for the specific purposes described in this Policy.
window.GLOBAL_SN_OEST.init({ ssrOest: "OUVCMDQyfDE3Nzg1MjI0NDc5OTN8QzJfQTIyRF9GMjU0X0RCRTlfQjMwQkU2OTVCNThC", shouldSetCC: true, useCC:true, i18nKey: "Curve + Plus" }); ... key:updateOest ... fetch(r,{method:"POST",headers:i}).then
Monitoring
Walmart has changed this document before.
Receive same-day alerts, structured change summaries, and monitoring for up to 25 platforms.
"We may collect biometric information, including facial geometry or other biometric identifiers, through in-store camera and security systems in jurisdictions where permitted by law. We retain biometric data only for the period necessary to fulfill the purpose for which it was collected, after which it is destroyed in accordance with applicable law.— Excerpt from Walmart's Walmart Privacy Policy
1) REGULATORY LANDSCAPE: This provision implicates the Illinois Biometric Information Privacy Act (BIPA), which requires written informed consent prior to biometric data collection, a publicly available written retention schedule, and destruction of biometric data within three years or upon fulfillment of the initial purpose. Analogous statutes apply in Texas (CUBI) and Washington. The FTC has also addressed biometric data collection under its Section 5 authority. 2) GOVERNANCE EXPOSURE: High. BIPA has been the basis for significant class action litigation, with Illinois courts having found statutory damages of $1,000 to $5,000 per violation available to private plaintiffs. Walmart's operation of in-store camera systems across thousands of Illinois locations creates material aggregate exposure if consent and retention procedures do not comply with BIPA's specific requirements. 3) JURISDICTION FLAGS: Illinois creates the highest exposure due to BIPA's private right of action. Texas CUBI and Washington's biometric privacy law do not provide private rights of action but are enforced by their respective Attorneys General. Other states are considering or have enacted biometric-specific provisions. The notice's applicability is limited to US operations. 4) CONTRACT AND VENDOR IMPLICATIONS: Vendors providing facial recognition, loss prevention, or security analytics services to Walmart should have contractual obligations confirming BIPA-compliant consent collection, data handling, and destruction on behalf of Walmart. Procurement teams should audit vendor agreements for BIPA compliance representations and indemnification provisions. 5) COMPLIANCE CONSIDERATIONS: Legal teams should verify that in-store signage and digital disclosures in Illinois locations satisfy BIPA's written notice and consent requirements before biometric data collection occurs. Retention schedules should be documented and auditable, and destruction procedures should be verified against the three-year BIPA maximum retention period.
Full compliance analysis
Regulatory citations, enforcement risk, and due diligence action items.
Free: track 1 platform + weekly digest. Monitor: 25 platforms + same-day alerts. No credit card required.
Ad personalization controls removed. Contact scanning added. Advertiser data partnerships quietly dropped. A timeline of every change.
Compliance Governance Intelligence
Need to monitor specific governance provisions?
Compliance includes provision-level monitoring, governance timelines, regulatory mapping, and audit-ready analysis.
Built from archived source documents, structured governance mappings, and historical version tracking.
Biometric data collection is subject to strict consent, retention, and destruction requirements under state laws including Illinois BIPA, and the policy's disclosure of this practice requires consumers in covered jurisdictions to be aware of their rights to consent or object.
The policy states that Walmart may collect facial geometry and other biometric identifiers from in-store camera systems; in Illinois, this triggers BIPA's written informed consent requirement before collection, and consumers have the right to request information about how their biometric data is stored and used.
ConductAtlas has identified this type of provision across 3 platforms. See the full comparison.
No. ConductAtlas is an independent monitoring service. We are not affiliated with, endorsed by, or sponsored by Walmart.