Facewatch facial recognition

Facewatch supplies live facial recognition to UK retailers. Cameras in a shop scan every customer entering, compare each face against a watchlist compiled from incidents reported by participating businesses, and alert staff when the system flags a match. Staff then decide whether to approach.

It belongs in a catalogue of policing AI despite not being police technology, because it performs a policing function — identifying suspected offenders in public-facing spaces and excluding them — without any of the statutory framework, oversight or appeal route that would attach if a police force did it.

THE NETWORK

Customers include B&M, Home Bargains, Sports Direct, Farmfoods, Spar, Southern Co-op, Costcutter, Budgens and Iceland. Sainsbury's expansion illustrates the pace: two shops in September 2025, six by February, more than 55 by early July, with around 150 more planned.

Volume is substantial. Facewatch issued 297,433 alerts to British retailers between January and June, roughly 1,643 a day.

WHAT THE COMPANY SAYS

Facewatch states an accuracy rate of 99.98%. Its account of the process emphasises brevity and deletion: it takes less than a second to create a biometric image of a face, assess it against the bespoke watchlist, and automatically delete it where there is no match. The company maintains the technology deters crime and protects staff.

Retailers report results. Sainsbury's cites a 46% drop in theft, aggression and antisocial behaviour where the cameras operate, and says more than 90% of people identified do not return.

Those figures deserve one caution. Shoplifting offences recorded by police in England and Wales fell 4% to 507,086 in the year to March 2026 — the first fall in years — but police-recorded crime and incidents logged inside a retailer's own stores are different measures, and neither establishes what caused the other.

THE REGULATORY HISTORY

The Information Commissioner's Office investigated and concluded in March 2023 that Facewatch's data processing had breached data protection law across a number of principles, including lawfulness, fairness and transparency, purpose limitation, storage limitation, the processing of special category data, the processing of data relating to criminal offences, and the rights of children.

Following private correspondence with the regulator, the company overhauled its practices. The ICO subsequently closed its formal inspection without requiring further action, satisfied that crime prevention is a legitimate purpose. It held that retailers may place individuals on a watchlist only where they are serious or repeated offenders.

Big Brother Watch has noted that the Policing Minister at the time, Chris Philp, held private meetings with the company while it was under investigation and stated he would do everything possible to promote its widespread use.

THE FINDING THAT MATTERS MOST

In 2024 a nineteen-year-old shopping in a Home Bargains in Manchester was flagged as a suspected shoplifter. She was confronted by staff, subjected to a bag search, publicly removed from the store, and told she was barred from shops across the country using the same system. She had never stolen anything.

In subsequent correspondence, Facewatch admitted that both its technology and its human "super-recogniser" reviewer had produced the error.

That second part is the most consequential sentence on this page. Every live facial recognition deployment documented on this site — including police deployments upheld by the High Court — relies on human review of an alert as the safeguard against algorithmic error. Here is a documented case where the algorithm was wrong and the trained human reviewer confirmed the mistake. Human review is a mitigation, not a guarantee, and this is the clearest evidence of that available.

She is not the only case. Another woman was wrongly added to the shoplifter watchlist; a 2026 Guardian investigation spoke to multiple people wrongly identified, who reported struggling to understand why they had been approached, how their data was being used, or how to challenge it. A Sainsbury's store suspended its system after an error attributed to human mistake.

THE CASE FOR IT

Retail crime is real, rising in most measures until recently, and frequently involves the same individuals repeatedly. Staff assaults are a genuine and underreported problem, and a system that warns staff that a person who previously threatened them has entered the shop is not a trivial benefit.

Non-matching faces are deleted immediately, which is a narrower retention position than many systems here. And the ICO's requirement that watchlists be limited to serious or repeated offenders is, if followed, a meaningful constraint.

THE CASE AGAINST

The due process objection is the strongest. A person can be added to a watchlist on the say-so of shop staff, without being told, without a hearing, and without any finding by a court — and because reports travel across the network, the consequence is exclusion from many shops rather than one. There is no equivalent of a criminal standard of proof, no disclosure, and no obvious route of appeal.

The private-to-private nature is what makes this possible. A police watchlist attracts judicial review, data protection scrutiny and parliamentary attention. A retailer's watchlist has attracted one regulatory investigation, resolved through private correspondence.

For essential shops — supermarkets and food retailers — exclusion is not a trivial sanction. Being barred from B&M, Home Bargains, Iceland, Spar and Sainsbury's simultaneously is a significant restriction imposed without any judicial process.

And the 99.98% figure needs reading at scale: at roughly 1,643 alerts a day, even a very low error rate produces wrongly accused people regularly.

WHAT IS NOT ESTABLISHED

How many people are on Facewatch watchlists nationally, and how many have been added without prosecution, is not published.

Whether the ICO's serious-or-repeated-offender restriction is complied with in practice is not independently audited.

The basis for the 99.98% accuracy claim — what was measured, on what population — is not published.

No figures were found for how many alerts result in confirmed identifications versus misidentifications, which is the ratio that would let anyone judge the system.