At least two malls are using facial recognition technology to track shoppers' ages and genders without telling

At least two Calgary malls are using facial recognition technology to track shoppers' ages and genders without first notifying them or obtaining their explicit consent.

A visitor to Chinook Centre in south Calgary spotted a browser window that had seemingly accidentally been left open on one of the mall's directories, exposing facial-recognition software that was running in the background of the digital map. They took a photo and posted it to the social networking site Reddit on Tuesday.

The mall's parent company, Cadillac Fairview, said the software, which they began using in June, counts people who use the directory and predicts their approximate age and gender, but does not record or store any photos or video from the directory cameras. 

Cadillac Fairview said the software is also used at Market Mall in northwest Calgary, and other malls nationwide. 

"We don't require consent, because we're not capturing or retaining images," a Cadillac Fairview spokesperson said.

The software could, for example, say approximately how many men in their 60s used the directory, but not store images of those men's faces or collect any other biometric data, the spokesperson said. 

Instead, they said the data is used in aggregate to understand directory usage patterns to "create a better shopper experience."

The use of facial recognition software in retail spaces is becoming commonplace to analyze shopper behaviour, sell targeted space to advertisers, or for security reasons like identifying shoplifters.

It can also be used to identify and profile people by race or ethnic group, or even recognize individuals' faces and connect those faces with data collected by other means.

Cadillac Fairview said currently the only data they collect is the number of shoppers and their approximate age and gender, but most facial recognition software can be easily adapted to collect additional data points, according to privacy advocates. 

No opportunity to opt out

Sharon Polsky with the Privacy and Access Council of Canada said the general public would likely be shocked if they realized they were being surveilled with facial recognition technology.

"The people are not notified. They're not given an opportunity to opt in, much less opt out," Polsky said.

She said the most businesses usually do is post a sign saying a facility is under CCTV surveillance, but few go as far as spelling out to consumers what surveillance actually is taking place or undertake privacy impact assessments. 

"There's no way to verify the alleged purpose, and they [could] start using it for other purposes. From a civil liberties perspective, from a privacy perspective, from the perspective of being able to exercise our rights, it's a huge concern," Polsky said.

'An entire profile'

Polsky explained that when multiple data points are collected, from security camera footage, to cellphone information collected when shoppers connect to public Wi-Fi, to the anonymized facial recognition data, it can all be combined with negative privacy implications.

"They can put together an entire profile," she said.

Under Alberta's Personal Information Privacy Act, people need to be notified their private information is being collected, but as the mall isn't actually saving the recordings, what they're doing is legal.

It's not known how many other Calgary-area malls are using the same or similar software and if they are recording the data. 

"It's a private corporation. What goes on in a private corporation tends to be kept private," Polsky said.

Access to information requests

Polsky recommends if members of the public are concerned about what data is being collected on them or who it's being shared with — like data brokers, affiliate companies or advertisers — they should submit access to information requests, as is their right under PIPA.

The mall wouldn't say what software they use, as they view it as proprietary, but the shopper's photo of the directory shows the software is MappedIn. The Ontario-based company confirmed in an email that their directories can track facial recognition data. 

Representatives from North Hill Shopping Centre, Sunridge Mall and CrossIron Mills shopping centres in Calgary said they do not use facial recognition technology.

A spokesperson for Marlborough Mall and Westbrook Mall, which are owned by the same parent company, declined to comment, and The Core Shopping Centre and Southcentre did not respond to requests for comment.

• MORE CALGARY NEWS | Alberta man changes gender on government IDs for cheaper car insurance
• MORE CALGARY NEWS | Castle that gave Calgary its name hits the real estate market
• Read more articles by CBC Calgary, like us on Facebook for updates and subscribe to our CBC Calgary newsletter for the day's news at a glance