Wegmans confirms it’s collecting biometric data. What Delaware law says

• Wegmans acknowledged using facial recognition technology for security in a limited number of stores.
• The company states the technology is only used to identify individuals previously flagged for misconduct.
• Delaware’s Personal Data Privacy Act requires businesses to get consent before collecting sensitive data like biometrics.

In January, reports of signs notifying shoppers that their biometric data was being collected at a Wegmans store in New York City prompted the grocery chain to acknowledge that it uses facial recognition technology in a limited number of locations. The company says the cameras are part of its security strategy, but the disclosures have raised questions about whether similar surveillance are being used in other states, including Delaware.

In a statement issued after the signage drew public attention, Wegmans said facial recognition technology is used only in “a small fraction of our stores located in communities that exhibit an elevated risk.” According to the Rochester, New York-based retailer, the system collects facial recognition data only to identify individuals who have previously been flagged for misconduct.

Wegmans said it does not collect other forms of biometric data such as retinal scans or voice prints, and that images and video are retained only as long as needed for security purposes before being discarded.

When asked by Delaware Online/The News Journal whether facial recognition is used at its lone Delaware location, Wegmans did not provide a direct answer. Marcie Rivera, a spokesperson for the chain, said the company follows a single privacy policy for all shoppers nationwide. She noted the policy incorporates the privacy requirements of every state where the company operates, including Delaware.

How Delaware law protects personal data collection

All businesses operating in the First State are required to comply with Delaware’s Personal Data Privacy Act, which took effect in January 2025. Whether online or in person, the statute allows residents to opt-out of the collection of covered personal information and requires businesses to obtain consent before collecting sensitive personal data.

Personal data is defined as any information that can be linked to an identifiable individual, excluding publicly available information. This includes a name, address, phone number, email, mobile or computer device identifier.

MORE: 5 key steps to defend your personal digital data under Delaware’s privacy law

Businesses must obtain a consumer’s expressed consent before collecting or sharing sensitive personal information, including data related to race or ethnic origin, health conditions, sexual orientation, gender identity or biometric data.

The law does not automatically classify photographs, audio recordings or video recordings as protected personal data. These materials are covered only when used to identify a specific individual. Facial recognition technology, which analyzes images to match or identify a person, may therefore fall under the law depending on how it is used.

Your rights as a consumer

Even when a regulated business does not post signs about data collection, Delaware residents have the right to investigate whether a company is collecting their personal information.

Under the Delaware Personal Data Privacy Act, consumers are allowed to ask a business to:

• Confirm whether it is processing their personal data.
• Access that personal data (unless doing so would reveal a trade secret).
• Correct inaccuracies.
• Request deletion of personal data collected or obtained about them.
• Obtain a list of third parties that have received their data.

Delawareans can also opt out of targeted advertising and limit the sale of their personal information. Parents or legal guardians may exercise these rights on behalf of their children.

FOR SUBSCRIBERS ONLY: New bills would require Delaware to keep DNA evidence in criminal cases

Requests can be made through the contact methods provided in a company’s privacy notice. Under the act, businesses may deny a consumer’s request if complying would interfere with efforts to respond to or prevent security incidents, identity theft or fraud.

Consumers have the right to appeal any decision that denies a request. If the appeal is rejected, the business must provide information that allows the consumer to contact the Attorney General’s Office to file a complaint.

Enforcement and resources

The Delaware Personal Data Privacy Act applies to companies that conduct business in Delaware or offer products or services targeted to Delaware residents and that, during the previous year, either controlled or processed the personal data of:

• at least 35,000 consumers; or
• 10,000 or more consumers and earned more than 20% of gross revenue from the sale of personal data.

Service providers that manage or process data on behalf of those companies are also included.

Enforcement of the law is handled by the Delaware Department of Justice through its Fraud and Consumer Protection Division. Residents can learn more about their privacy rights at privacy.delaware.gov. Concerns about business data practices or unresolved complaints can be directed to the department’s privacy team through the contact information listed on the site.

To share your community news and activities with our audience, join Delaware Voices Uplifted on Facebook. Nonprofits, community groups and service providers are welcome to submit their information to be added to our Community Resources Map. Contact staff reporter Anitra Johnson at ajohnson@delawareonline.com.