On Wednesday, Senate Majority Leader Bob Duff, D-Norwalk and Senator James Maroney, D-Milford, announced they would be introducing a bill in the 2026 legislative session to ban the collection of shoppers' biometric data. In a release, the senators cited a CT Insider report Monday on how Wegmans, which is collecting customer data in New York City, refused to disclose whether it was doing the same at its Norwalk location.
"Your story highlighted one place where we can certainly look to make a difference for consumers and customers of stores, so that they feel like they have privacy," Duff said in a phone interview Wednesday. "Consumers don't know where the boundaries are anymore."
Duff said the legislation was still being drafted and was in its "conceptual phase," but that the bill would likely seek to ban retinal scans and voiceprints, which collect customers' eyes and voice patterns, in addition to face scans, in retail establishments. He said he hoped to make Connecticut a "national model" for facial recognition bans.
At least 23 states, including Connecticut, have passed laws to prohibit the mass collection of biometric data, according to NPR. Illinois has particularly stringent laws, requiring that companies receive written permission before gathering biometric data and allowing customers to personally sue companies that violate the law.
Several other states, including Connecticut, rely on state attorneys general to enforce the laws.
In Connecticut, the collection of biometric data is governed by the 2022 Data Privacy Act, which largely requires "clear, affirmative consent" for companies collecting sensitive data on customers, but has an exception for companies using the data for "preventing crime and fraud," according to a spokesperson for Connecticut Attorney General William Tong.
On Monday, Wegmans declined to say whether it was using facial recognition technology at its Norwalk store, which is in Duff's district, after the company posted signs at multiple New York City stores informing customers that it was recording their biometric data. The signs in New York City, which are required by city law, were first reported by Gothamist.
"For security and safety purposes, we do not get into the specific measures used at each store," Tracy Van Auker, a Wegmans spokesperson, said in an email Monday.
Van Auker said Wegmans uses facial recognition technology "in a small fraction of our stores that exhibit an elevated risk," in order to protect shoppers and employees. She did not answer questions on what defines a store with an "elevated risk" or whether the Norwalk location was one of those stores.
According to Van Auker, Wegmans does not share the data with any third party and deletes the images and video it collects after an unspecified amount of time that "aligns with industry standards."
Duff said he thought Wegmans should "fess up" and disclose whether the company is using facial recognition tech in Norwalk.
Representatives for prominent Connecticut grocers Stop & Shop and Stew Leonard's both confirmed that the companies do not collect customers' biometric data in their stores. Wegmans did not immediately respond to a request for comment Wednesday.
This is not the first time questions have arisen about a supermarket's collection of biometric data in Connecticut. In 2023, a Vernon ShopRite came under scrutiny after posting a sign announcing that it was using facial recognition technology in the store. ShopRite did not immediately respond to a request for comment.
Duff said the new legislation would aim to protect consumers, as the exposure of facial recognition data, if sold, hacked or otherwise compromised, could open those involved to long-term privacy risks.
The senator said he had not determined whether the bans would apply beyond retail settings, including in hospitals or for law enforcement.
"It is a game of Whack-a-Mole, where you fix one thing and another pops up. Because there's a lot of money in selling data," Duff said. "Anytime there's a recording of data and people don't know about it, it's just raising a lot of red flags."
The facial recognition ban will be part of a broader package of new data privacy regulations that the senators plan to introduce when the General Assembly convenes in February. Duff said he had not yet spoken with his colleagues in the House of Representatives about the new regulations, but was planning to.
© 2026 the Connecticut Post (Bridgeport, Conn.). Distributed by Tribune Content Agency, LLC.
