chain. Two retailers, two careful denials Both companies have been quick to frame their involvement in careful, legalistic terms. Coles insists it never trialled the technology in-store, instead running a “small, controlled proof of concept” that used no customer or staff data, and stresses it has made no rollout decision. Woolworths, meanwhile, confirms it tested the technology, but only at its New Zealand office, declining to say whether an Australian deployment is under consideration. This careful wording makes sense, since no major retailer wants to be the next test case after a landmark privacy ruling. That caution is well-founded, with the Bunnings saga still looming large. Australian Privacy Commissioner Carly Kind, the country’s chief privacy regulator, ruled in 2024 that the hardware giant breached privacy law by scanning hundreds of thousands of customer faces across 63 stores between 2018 and 2021 without proper consent. In 2026, however, the Administrative Review Tribunal, an independent body that reviews Australian government decisions, overturned that finding. It ruled that Bunnings did not break the law, while urging improvements to signage, disclosure and privacy policy. The decision has given Coles, Woolworths and other retailers a clearer indication of how facial recognition may be used lawfully, provided they satisfy requirements around necessity, disclosure and privacy protections. Regulation catches up, slowly The regulatory environment has shifted to accommodate this appetite. In July 2026, the Office of the Australian Information Commissioner, Australia’s federal privacy and information regulator, updated its guidance for the first time since 2024. It introduced a formal pathway for retailers deploying facial recognition technology, anchored by a mandatory privacy impact assessment. The Australian Retail Council, an industry body representing major retailers, has embraced this shift enthusiastically. Chief executive Chris Rodwell argues that facial recognition can help identify “known high-harm repeat offenders” before incidents occur, citing “unacceptable levels of violence, threats, intimidation and abuse” facing retail staff. A survey by the Shop, Distributive and Allied Employees’ Association, Australia’s largest retail workers’ union, found roughly a third of workers do not feel safe at work. That statistic is increasingly being used to justify surveillance as a duty-of-care imperative rather than a loss-prevention tactic. The business case beyond security What distinguishes this moment from the Bunnings-era debate is scope creep. Facial recognition is no longer confined to security cameras. Verifone’s newly launched Victa biometric payment terminals will let Australian shoppers “pay with a smile” or palm, while doubling as age-verification tools and loyalty-program integrations. Verifone predicts biometric payments will become as ubiquitous as contactless cards within a decade, though it insists the payment use case remains strictly opt-in. Security-driven facial recognition, by contrast, is unlikely ever to be opt-in, since its entire value proposition depends on scanning every face that enters a store. That asymmetry matters commercially. Retailers are effectively building two parallel biometric infrastructures: one consumer-facing and consensual, the other operational and largely invisible. The public may struggle to distinguish between them. Layer in the proliferation of electronic shelf labels across major supermarket, home-improvement and liquor chains, and the anxiety sharpens further. Critics warn that pairing dynamic pricing displays with facial recognition data could enable surveillance pricing, where prices are algorithmically tailored to what a shopper is likely willing to pay. The concern has already fuelled labor campaigns against digital shelf tags in the United States. A trust deficit retailers cannot price in The consumer backlash is already visible elsewhere in the sector. Kmart Australia’s A$89 camera-equipped smart glasses sold out within a week of their early August 2026 launch, demonstrating strong demand for wearable technology. At the same time, Australian progressive campaign group GetUp! is running a campaign against the product that has gathered more than 53,000 signatures. The contradiction is instructive: Australians are simultaneously buying surveillance-adjacent devices and protesting against them, a paradox retailers must now navigate carefully. For an industry still repairing trust after the Bunnings ruling, the strategic calculus is delicate. The legal ground has shifted in retailers’ favour, and the safety case is genuine and supported by union research. But normalising facial recognition at scale, especially without opt-in consent, tests the limits of what shoppers will tolerate simply to buy groceries. The next 18 months, as the OAIC’s updated guidance takes effect and more retailers quietly run their own “proofs of concept,” will determine whether Australia builds a retail surveillance regime shoppers grudgingly accept or one they actively resist. Further reading: Why smart glasses are creating a new trust problem for retailers