Hardware firm Bunnings and department store Kmart collect customers’ “faceprints” in some locations.
Consumer advocacy group Choice says the technology is unethical, invasive and being used without proper consent or reasoning.
Both retailers defended its use as an anti-theft and safety measure.
The Australian Information Commissioner said her office had opened an investigation to determine whether they had breached privacy laws.
Australian retailers can only collect sensitive biometric information if “reasonably necessary” for their operations and they have “clear consent”, Angelene Falk said.
“While deterring theft and creating a safe environment are important goals, using high privacy impact technologies in stores carries significant privacy risks,” Commissioner Falk said last month, after the use of the technology was first revealed.
“Retailers need to be able to demonstrate that it is a proportionate response.”
Last year, she found convenience store chain 7-Eleven had interfered with customers’ privacy by collecting faceprints in a similar case.
The watchdog said it was also “conducting inquiries” about another retail company, The Good Guys, which has paused its use of facial recognition technology.
The Australian Human Rights Commission has called for a ban on the technology until Australia has specific laws to regulate its use. It followed police in Western Australia using it for Covid isolation checks.
■ The nation where your ‘faceprint’ is already being tracked
■ Facebook to end use of facial recognition software
Choice said Bunnings and Kmart were only disclosing their use of the technology in small “conditions of entry” notices at the front of stores, and in privacy policies online.
The consumer group surveyed more than 1,000 households and found more than 75% had no idea the technology was in use.
“Using facial recognition technology in this way is similar to Kmart, Bunnings or The Good Guys collecting your fingerprints or DNA every time you shop,” said Choice’s Kate Bower.
Bunnings said its use of the technology had been inaccurately characterised and there were strict controls around its use.
The data collected is not used for marketing purposes, it says, and the only images retained are of people banned from stores or those suspected of illegal or threatening conduct.
“In recent years, we’ve seen an increase in the number of challenging interactions our team have had to handle in our stores and this technology is an important tool in helping us to prevent repeat abuse and threatening behaviour towards our team and customers,” said chief operating officer Simon McDowell.
A spokesperson for Kmart also said the technology was on “trial” to prevent theft and was subject to strict controls.