Walmart states it collects biometric identifiers such as facial geometry through in-store camera systems in certain locations, and retains this data for a limited period before destroying it in compliance with applicable state laws.
This analysis describes what Walmart's agreement states, permits, or reserves. It does not constitute a legal determination about enforceability. Regulatory applicability and practical outcomes may vary by jurisdiction, enforcement context, and individual circumstances. Read our methodology
Biometric data collection is subject to strict consent, retention, and destruction requirements under state laws including Illinois BIPA, and the policy's disclosure of this practice requires consumers in covered jurisdictions to be aware of their rights to consent or object.
Interpretive note: The exact scope of biometric collection (which store locations, which systems) is not fully specified in the available document text; application of BIPA consent requirements depends on whether collection occurs in Illinois and whether signage constitutes adequate written notice under BIPA's specific standards.
The policy states that Walmart may collect facial geometry and other biometric identifiers from in-store camera systems; in Illinois, this triggers BIPA's written informed consent requirement before collection, and consumers have the right to request information about how their biometric data is stored and used.
How other platforms handle this
We collect information about the apps, browsers, and devices you use to access Google services, which helps us provide features like automatic product updates and dimming your screen if your battery runs low. The information we collect includes unique identifiers, browser type and settings, device t...
When you visit the Careers portion of our websites, we collect the information that you provide to us in connection with your job application. This includes but is not limited to business and personal contact information, professional credentials and skills, educational and work history and other in...
American does not knowingly collect personal information directly from children – persons under the age of 13, or another age if required by applicable law – other than when required to comply with the law or for safety and security reasons. Due to the nature of our Services, we may collect travel i...
Monitoring
Walmart has changed this document before.
Receive same-day alerts, structured change summaries, and monitoring for up to 10 platforms.
"We may collect biometric information, including facial geometry or other biometric identifiers, through in-store camera and security systems in jurisdictions where permitted by law. We retain biometric data only for the period necessary to fulfill the purpose for which it was collected, after which it is destroyed in accordance with applicable law.— Excerpt from Walmart's Walmart Privacy Policy
1) REGULATORY LANDSCAPE: This provision implicates the Illinois Biometric Information Privacy Act (BIPA), which requires written informed consent prior to biometric data collection, a publicly available written retention schedule, and destruction of biometric data within three years or upon fulfillment of the initial purpose. Analogous statutes apply in Texas (CUBI) and Washington. The FTC has also addressed biometric data collection under its Section 5 authority. 2) GOVERNANCE EXPOSURE: High. BIPA has been the basis for significant class action litigation, with Illinois courts having found statutory damages of $1,000 to $5,000 per violation available to private plaintiffs. Walmart's operation of in-store camera systems across thousands of Illinois locations creates material aggregate exposure if consent and retention procedures do not comply with BIPA's specific requirements. 3) JURISDICTION FLAGS: Illinois creates the highest exposure due to BIPA's private right of action. Texas CUBI and Washington's biometric privacy law do not provide private rights of action but are enforced by their respective Attorneys General. Other states are considering or have enacted biometric-specific provisions. The notice's applicability is limited to US operations. 4) CONTRACT AND VENDOR IMPLICATIONS: Vendors providing facial recognition, loss prevention, or security analytics services to Walmart should have contractual obligations confirming BIPA-compliant consent collection, data handling, and destruction on behalf of Walmart. Procurement teams should audit vendor agreements for BIPA compliance representations and indemnification provisions. 5) COMPLIANCE CONSIDERATIONS: Legal teams should verify that in-store signage and digital disclosures in Illinois locations satisfy BIPA's written notice and consent requirements before biometric data collection occurs. Retention schedules should be documented and auditable, and destruction procedures should be verified against the three-year BIPA maximum retention period.
Full compliance analysis
Regulatory citations, enforcement risk, and due diligence action items.
Free: track 1 platform + weekly digest. Watcher: 10 platforms + same-day alerts. No credit card required.
Netflix updated its Privacy Statement on April 18, 2026, disclosing voice recording collection and expanded household ad profiling for the first time.
Google's Privacy Policy covers Search, Gmail, YouTube, Maps, and every site running Google Analytics. Here is what it actually authorizes.
Professional Governance Intelligence
Need to monitor specific governance provisions?
Professional includes provision-level monitoring, governance timelines, regulatory mapping, and audit-ready analysis.
Built from archived source documents, structured governance mappings, and historical version tracking.
Biometric data collection is subject to strict consent, retention, and destruction requirements under state laws including Illinois BIPA, and the policy's disclosure of this practice requires consumers in covered jurisdictions to be aware of their rights to consent or object.
The policy states that Walmart may collect facial geometry and other biometric identifiers from in-store camera systems; in Illinois, this triggers BIPA's written informed consent requirement before collection, and consumers have the right to request information about how their biometric data is stored and used.
ConductAtlas has identified this type of provision across 2 platforms. See the full comparison.
No. ConductAtlas is an independent monitoring service. We are not affiliated with, endorsed by, or sponsored by Walmart.