At least two malls are using facial recognition technology to track shoppers' ages and genders without telling

At least two Calgary malls are using facial recognition technology to track shoppers' ages and genders without first notifying them or obtaining their explicit consent.

A visitor to Chinook Centre in south Calgary spotted a browser window that had seemingly accidentally been left openon one of the mall's directories, exposingfacial-recognition software thatwas running in the background of the digital map. They took a photo and posted it to the social networking site Redditon Tuesday.

The mall's parent company, Cadillac Fairview, saidthe software, which they began using in June, counts people who usethe directory and predicts their approximate age and gender, but does not record or store any photos or videofrom the directory cameras.

CadillacFairviewsaid the software is also used at Market Mall in northwest Calgary, and other malls nationwide.

"We don't require consent, because we're not capturing or retaining images," a CadillacFairviewspokesperson said.

The software could, for example, say approximately how many men in their 60s used the directory, but not store images of those men'sfaces or collect any other biometric data, the spokesperson said.

Instead, they said thedata is used in aggregate to understand directory usage patterns to "create a better shopper experience."

The use of facial recognition software in retail spaces is becoming commonplace to analyze shopper behaviour, sell targeted space toadvertisers, or for security reasons like identifying shoplifters.

It can also be used to identify and profilepeople by race or ethnic group, or even recognize individuals' faces and connect those faces with data collected by other means.

CadillacFairview said currently the only data they collect isthe number of shoppers and their approximate age and gender, but most facial recognition software can be easily adapted to collect additional data points, according to privacy advocates.

No opportunity to opt out

Sharon Polsky with the Privacy and Access Council of Canada said the general public would likely be shocked if they realized they were being surveilled with facial recognition technology.

"The people are not notified. They're not given an opportunity to opt in, much less opt out," Polsky said.

She said the most businesses usuallydo is post a sign saying a facility is under CCTVsurveillance, but few go as far as spelling out to consumers what surveillance actually is taking place or undertake privacy impact assessments.

"There's no way to verify the alleged purpose, and they [could] start using it forother purposes.From a civil liberties perspective, from a privacy perspective, from the perspective of being able to exercise our rights, it's a huge concern," Polsky said.

'An entire profile'

Polsky explained that when multiple data points are collected, from security camera footage, to cellphone information collected when shoppers connect to public Wi-Fi, to the anonymized facial recognition data, it can all be combined with negative privacy implications.

"They can put together an entire profile," she said.

Under Alberta's Personal Information Privacy Act, people need to be notified theirprivate information is being collected, but as the mall isn't actually saving the recordings, what they're doing is legal.

It's not known how many other Calgary-area malls are using the same or similar software andif they are recording the data.

"It's a private corporation. What goes on in a private corporation tends to be kept private," Polsky said.

Access to information requests

Polsky recommendsif members of the public are concerned about what data is being collected on them or who it's being shared with like data brokers, affiliate companies or advertisers they should submit access to information requests, as is their right under PIPA.

The mall wouldn't say what software they use, as they view it as proprietary, but the shopper's photo of the directory shows the software is MappedIn. The Ontario-based company confirmed in an email that their directories can track facial recognition data.

Representatives from North Hill Shopping Centre, SunridgeMall and CrossIron Mills shopping centres in Calgary said they do not use facial recognition technology.

A spokesperson for Marlborough Mall andWestbrook Mall, which are owned by the same parent company,declined to comment, and The Core Shopping Centre and Southcentre did not respond to requests for comment.

• MORE CALGARY NEWS |Alberta man changes gender on government IDs for cheaper car insurance
• MORE CALGARY NEWS |Castle that gave Calgary its name hits the real estate market
• Read more articles byCBC Calgary, like us onFacebookfor updates and subscribe to ourCBC Calgary newsletterfor the day's news at a glance