"I find it very troubling that Wegmans and other retailers are using facial recognition and other biometric technology to collect data on its customers," he wrote on Bluesky. "I have directed my team to begin the process to pass a local law to prohibit such collecting of data and retaining it."
No such local or state laws exist yet to regulate biometric data collection. New York City has a law requiring disclosure of biometric use. Poloncarz said the Erie County Division of Consumer Protection already has oversight on retailers such as Wegmans to prevent fraud.
"As someone who worked at Tops Markets and Sears, I understand the need to prevent theft, but this is a serious invasion of privacy that can have negative ramifications for a person, just because they walked into a store," he said.
Erie County Legislator Lindsay Lorigo, R-West Seneca, said she would push for a law that requires companies using facial recognition or collecting biometric data to post signs about it at their entrances, at the very least.
Does Wegmans collect biometric data in WNY? It won't say
Wegmans is collecting biometric data from customers and workers at its stores in Manhattan and Brooklyn — including scans of their eyes, likeness and voice — but the supermarket chain won't say whether it is doing the same at its Buffalo Niagara stores.
“This proposal isn’t about stopping technology — it’s about transparency,” Lorigo said. “Every day we choose to opt in when we share personal information through our phones or apps. When biometric data is being collected in a store, customers should have that same awareness.”
Lorigo said the Biometric Privacy Act would require reasonable security measures to protect the data from unauthorized access or disclosure. The law would not apply to biometric data collected for employment purposes. Images or video could not be sold or shared with third parties, except for lawful purposes involving law enforcement.
Enforcement would be handled by the Erie County Division of Consumer Protection. Penalties would range from a written warning for a first violation, up to $5,000 for third and subsequent violations. The proposed law would take effect 90 days after filing with the Office of the Secretary of State, if passed.
Wegmans is facing a growing backlash after confirming Tuesday that it uses biometric data in some of its stores, igniting privacy concerns among shoppers and drawing scrutiny from local and state officials.
The controversy has pushed biometric surveillance — once a largely invisible retail tool — into the political spotlight, with lawmakers warning that existing laws may not adequately protect consumers from how facial recognition and other biometric identifiers are collected, stored and shared.
Wegmans has said it uses the surveillance technology at a handful of stores, but declined to name which ones. The lack of transparency has rankled many.
"C’mon, Wegmans. You’re better than this. You need to drop the biometrics initiative now," Bluesky user Volfied wrote to the grocer on the app. "No amount of security is worth the invasion of privacy you’re committing, nor the liability you’ll incur over the inevitable data breach when it happens."
Some users defended the store, saying that if shoppers aren't shoplifting they shouldn't be worried about the collection of their biometrics. But others were skeptical of Wegmans' explanation for using the controversial practice.
"I don’t begrudge Wegmans the need to reduce losses from shoplifting, but I just don’t believe this explanation," wrote a Bluesky user using the name and photo of historic attorney and Republican politician Thomas Brackett Reed. "What makes a lot more sense: using biometrics to identify shoppers and track them as they shop. THAT’S the data Wegmans wants — and I think that’s what they’re doing."
That data can and has been used by other companies to experiment with dynamic pricing, with artificial intelligence learning and identifying which shoppers may be willing to pay higher prices, said Davi Ottenheimer, a data security expert and author of the book "The Realities of Securing Big Data."
He said biometric data is far more sensitive than passwords and other traditional security methods, because they can't be changed if there is a breach where the data is hacked, lost or stolen.
The data also has a significant risk of misidentifying someone for a crime they didn't commit, since the software currently being used misidentifies women and black people by a wide margin. And there is also the risk that the data can be tampered with or shared with nefarious actors.
"It goes beyond just what happens if they take it and share it, expose it. Exposure is one thing, but what happens if they also expose data that falsely accuses you of something?” Ottenheimer said.
©2026 The Buffalo News, Distributed by Tribune Content Agency, LLC.
