What Walmart's policy actually says

Walmart's current privacy notice lists "biometric information" as a category of personal data it may collect, defined as "voice prints, imagery of the iris or retina, face geometry, and palm prints or fingerprints." This isn't new — the same definition, in the same words, is confirmable in the policy's Dec. 2023 version. What actually changed on August 20, 2026, per Walmart's own changelog, was narrower: "Added information related to voice interactions in the 'How Do We Collect Personal Information?' section." The underlying rights and categories didn't move; how Walmart describes collecting voice data did, in some way this pass could not pin down further — Walmart doesn't publish a redline, only the one-line summary above.

The policy separately discloses Automated License Plate Readers (ALPR): "Automated License Plate Readers (ALPR) may also be in use on our properties, where permitted by law. Personal information is collected from ALPRs to help ensure security, prevent theft and fraud, assist with parking enforcement, and to help maintain the safety of individuals and properties." It also discloses cameras and automated technologies, in-store and outside, that "may capture images of you as part of check out, to help deter theft, or improve store design to better serve our customers." None of this is new to 2026 either — the ALPR disclosure is confirmable back to at least Dec. 2024.

What is a live, current clause: Walmart may use your personal information for "undertaking activities to verify or maintain the quality or safety of our services or devices and to improve, upgrade, or enhance them, such as training our AI" — meaning your shopping data, and potentially your biometric data, can be used to build the company's own AI systems. This language is also confirmable well before the August update, appearing at least as early as Dec. 2025.

Walmart's stated retention limit for biometric data: it will "permanently destroy" biometric identifiers at the first of three triggers — the original purpose is satisfied, three years pass since your last interaction with Walmart, or a law requires destruction sooner.

None of this means the policy is uncontroversial or unimportant — it means the news here isn't "Walmart just started doing this." It's that a policy authorizing all of this has existed, largely unread, while Walmart fights lawsuits over the exact things it authorizes.

The 76-second version: what Walmart's policy says it may collect, and which claims are still in court.

Three lawsuits, one closed

All three biometric categories Walmart's policy names have drawn Illinois litigation under the state's Biometric Information Privacy Act (BIPA) — one of the strongest biometric privacy laws in the country because, unlike most state privacy laws, it gives individuals the right to sue directly rather than relying only on a regulator. Two of those cases are confirmed active as of this writing; the third was closed years ago.

Facial recognition — filed, disputed, and closed: Illinois resident James Luthe filed suit September 1, 2022, in the Northern District of Illinois, alleging Walmart's Illinois stores use camera systems that "surreptitiously collect, possess, or otherwise obtain Biometric Data," and that the company matches facial scans captured in its stores against Clearview AI's facial recognition database — without the written consent BIPA requires. That specific case was voluntarily dismissed about a week later. A case with the same core allegations and additional plaintiffs, Luthe v. Walmart, 3:22-CV-2104, was then filed in the Southern District of Illinois — and was itself voluntarily dismissed without prejudice on November 2, 2022, per the court's own judgment. This pass found no evidence either case was refiled or revived since. Walmart disputed the underlying premise at the time: a company spokesperson told Business Insider that Walmart is not a Clearview client. The allegation is documented and Walmart's denial is on the record; the litigation itself is not currently active.

Voiceprints (customer-facing, active): A more recent suit, filed by plaintiff Amber Smith, alleges Walmart's AI-powered phone system collected, stored, and shared her voiceprint during calls she made to an Illinois Walmart store in December 2025 and July 2026 — the same biometric category the company's own policy names outright, and specifically the category its August 2026 update touched. Smith's suit separately alleges Walmart never published the written biometric-retention schedule BIPA requires.

Fingerprints (employee-facing, active): plaintiff Joann Davis alleges Walmart required her fingerprint for a workplace time-clock system without proper consent — an employee-side claim, filed April 25, 2024, distinct from the customer-facing suits above.

BIPA sets statutory damages of $1,000 per negligent violation and $5,000 per reckless or intentional violation, plus attorneys' fees. That's narrower than it used to be: a 2024 amendment (SB 2979) caps recovery at a single violation, and a single award, per person per method of collection — not one violation per scan — and a Seventh Circuit ruling in April 2026 held that cap applies retroactively even to cases already pending when the amendment passed. The exposure per plaintiff is real but bounded, which is a meaningfully different number than the uncapped, per-instance total these suits could once have sought.

The part Walmart is pushing back on

A separate, unrelated Walmart rollout — digital shelf labels, electronic price tags that can be changed remotely instead of printed — went viral alongside renewed attention to the privacy policy, with social media users connecting the two: if Walmart can identify who's standing in front of a shelf, could it show that person a different price than the next shopper? Walmart U.S. COO Kieran Shanahan addressed this directly at a company Associates Week event in Bentonville in June 2026: "To charge one customer one price and another customer another price, I've never seen us do that."

What this piece is not saying

This isn't claiming Walmart's privacy policy violates BIPA or any other law — a company disclosing what it may collect, in a privacy policy, is a different question from whether it obtained the consent a law like BIPA separately requires; that's exactly what the pending lawsuits are there to determine, and none has been decided. It isn't saying Walmart "just started" collecting biometric data in August 2026 — the opposite is true, and the earlier version of this piece got that wrong; it's corrected above. It isn't asserting the three named cases describe a single coordinated scheme — they're three separate matters, filed at different times, and Walmart disputed the specific factual premise of the facial-recognition claim (the Clearview connection) at the time. It isn't presenting the Luthe facial-recognition case as active litigation — the documented court record shows both the original and refiled versions were voluntarily dismissed by November 2022, and this pass found no sign either was revived; it's included here as disclosed, disputed history relevant to the pattern, not as a pending case. A voluntary dismissal is not a ruling on the merits — it doesn't mean the underlying allegations were found false, and it doesn't mean Walmart was vindicated; it means the case didn't proceed, for reasons the public record doesn't establish. And it isn't saying every Walmart customer nationwide has the same legal footing Illinois shoppers do — BIPA's private right to sue is unusually strong, and most other states don't give consumers the same direct path into court over biometric collection.

What can I do

Read what Walmart says it collects, in its own words: the Walmart Customer Privacy Notice is public, and the biometric definition quoted above is in it. Under California's CCPA and the twenty-plus other states with comprehensive privacy laws — the IAPP tracker lists which states have one and what each covers — you can require Walmart to tell you specifically what it holds on you.

If you're an Illinois resident and believe Walmart collected your faceprint, voiceprint, or fingerprint without the written consent BIPA requires, you may have a direct legal claim. BIPA is one of the few privacy laws that lets an individual sue without going through a regulator first, though recent changes cap what a single claim can recover.

Outside Illinois your practical lever is narrower: turn on Global Privacy Control, a browser signal that opts you out of sale and sharing, which Walmart says it will honor — the site lists the browsers and extensions that send it — or file an access or deletion request under your own state's law if it has one.

Why this is a BL:UF story

A retailer most Americans shop at weekly has, in writing, authorized collecting your face, your voice, and your fingerprints — filed under routine legal boilerplate almost nobody opens, sitting there well before any single week's news cycle made it relevant. Two lawsuits over exactly those categories are open right now, in a state whose law makes the shopper's word count; a third, over the category Walmart disputes most directly, already came and went once. That's what turns a policy nobody reads into something you can actually act on.

The Receipts