Walmart Privacy Policy Lists Biometrics, Plate Data and More. What It Actually Says

Walmart’s Customer Privacy Notice lists a wide range of information it may collect, including face geometry, voice prints, fingerprints, precise location, license plate data and in-store camera footage. It also covers ordinary customer information such as browsing activity, shopping patterns, preferences and shipping addresses.

The notice explicitly says, “Not all categories of personal information will be collected or received about every individual.” That distinction matters because a list of data categories is not a record of everything Walmart collects from every person who enters a store.

What Walmart Says It May Collect

Walmart’s customer notice covers information collected through its websites, apps, stores and other interactions with the company. The categories include identifiers, internet and network activity, commercial information, inferences and certain sensitive personal information.

The notice lists biometric information including voice prints, iris or retina imagery, face geometry, palm prints and fingerprints. It also lists demographic information such as household income and education, professional and employment information, and inferences about individual preferences, shopping patterns and behaviors.

The notice also includes background checks and criminal convictions among information Walmart may collect. That does not mean a grocery shopper is subjected to a criminal-record check when entering a store or parking a vehicle.

Cameras, Wi-Fi and License Plates

Walmart says cameras and automated technologies may be used on its properties for security and operational purposes. Its notice says images may be captured as part of checkout, to help deter theft or to improve store design.

The inclusion of face geometry in the notice does not establish that every shopper is enrolled in a facial-recognition system. Walmart also describes face scanning in connection with optional features such as virtual try-on, which is a different collection context.

Walmart has a separate notice for automated license plate readers. Where permitted by law and where the technology is in use, the systems can collect license plate information and associated time and location information for purposes including security, theft and fraud prevention, parking and safety.

Walmart says license plate information is generally retained for 60 days, although it can be kept longer when needed for legal purposes. The notice does not establish that every Walmart parking lot has an automated license plate reader.

Phone location is another separate data event. Walmart says precise device location can be collected through technologies such as GPS, Wi-Fi or Bluetooth when the applicable permissions or consent requirements are met. An IP address, meanwhile, can provide imprecise location information and is not equivalent to precise GPS tracking.

Voiceprints Are Under Dispute

Walmart’s notice covers audio recordings and customer-service contact. Separately, callers in the Illinois lawsuits say they heard an automated prompt stating that the call and their voice may be recorded.

Illinois lawsuits filed in July and August 2026 allege that Walmart created voiceprints from customer calls without obtaining consent required under the state’s Biometric Information Privacy Act. Smith v. Walmart Inc. was filed July 6, 2026, in the U.S. District Court for the Northern District of Illinois. Krupke v. Walmart Inc., with Thomas as a co-plaintiff, was filed August 4, 2026, in the same court. A separate Illinois state-court claim has also been reported.

Those are allegations, not established facts. The courts have not found that Walmart unlawfully created voiceprints from the calls at issue.

The August 20, 2026, Customer Privacy Notice also includes language stating that audio collected through activated voice features on Walmart’s sites and app is not used for biometric analysis. That language concerns those voice features and does not resolve the allegations involving customer-service calls.

The lawsuits highlight a separate legal question: whether Walmart’s disclosures and practices satisfy the notice and consent requirements that apply to biometric information under Illinois law.

The Policy Is Not New

The broad list of data categories predates the August 2026 update. Walmart’s earlier privacy disclosures included many of the same biometric, demographic and behavioral categories.

The company’s February 16, 2026, automated license plate reader notice separately documented that technology. The August 20 customer-notice update added detail about voice interactions rather than creating an entirely new list of data categories.

That timeline matters when assessing claims that Walmart suddenly announced it would begin collecting every type of information listed in its notice.

What Shoppers Can Infer

The notices show that Walmart has a broad framework covering biometric information, surveillance technologies, license plate readers, device location and customer data. They do not show that all of those systems operate on every shopper or that every listed category is collected during an ordinary store visit.

What happens to a particular shopper depends on the interaction: whether the person uses Walmart’s app, enables location permissions, connects to store Wi-Fi, uses an optional voice or scanning feature, makes a customer-service call or enters a location where an automated system is operating.

Walmart says it will not charge a different price because a customer exercised applicable privacy rights. That statement concerns the treatment of customers who exercise those rights; it is not a blanket claim that personal data can never be used in Walmart’s pricing or commercial decisions.

The practical question raised by Walmart’s disclosures is therefore narrower than the viral lists suggest: which data-collection system is operating, what information does it actually capture, and what notice or permission applies to that interaction?