3-Year-Old NYC Biometric Law Leads to First NY County Ban

Retailers deploying in-store facial recognition, eye tracking, or voice analytics now face a fragmented compliance map. Wegmans followed New York City's biometric disclosure law, yet the disclosure itself prompted questions about Western New York stores and ultimately a countywide ban—demonstrating that compliance with one jurisdiction does not protect a brand from stricter rules elsewhere.

Erie County, New York, has become the first county in the state—and one of the first major counties anywhere in the United States—to ban private-sector biometric collection outright. The ban did not emerge from a single high-profile data breach or federal mandate. It grew out of a local accountability chain: a 2021 New York City ordinance requiring businesses to disclose biometric data practices led Wegmans, earlier in 2026, to reveal that it was using facial recognition and storing customers' biometric data at some New York City stores. When the Buffalo-based Investigative Post then asked whether the grocer used the same technology in its Western New York locations, the company did not respond. Erie County Legislator Lawrence Dupre, who represents Buffalo's predominantly Black East Side, introduced legislation on May 26; by August 2026, the county had enacted an outright ban. The sequence illustrates how a disclosure law originally intended to create transparency became the foundation for a far stricter prohibition.

“

Erie County Legislator Lawrence Dupre, who represents Buffalo's predominantly Black East Side, introduced legislation on May 26; by August 2026, the county had enacted an outright ban.

The policy escalation is significant because it reverses the usual path of privacy regulation. New York City's biometric law took three years to pass and evolved from a proposal requiring businesses to disclose biometric collection into one of the nation's most restrictive local laws governing commercial facial recognition. Erie County's move is more aggressive still: rather than adding notice, consent, or data-deletion obligations, it simply bans private-sector biometric collection. That turns a compliance conversation into an operational prohibition, forcing retailers and other private entities to decide whether to disable in-store biometric systems, segment their operations by jurisdiction, or abandon facial analysis tools altogether.

The trigger point was corporate silence. Under the 2021 New York City ordinance, Wegmans disclosed that it analyzed faces, eyes, and voices in some stores. That disclosure initially drew little attention beyond the city. But when Investigative Post sought to clarify whether the company also deployed the technology in Western New York, the lack of a direct answer became the story. Dupre said the silence drove his initial response. For local lawmakers, unanswered questions about biometric databases transformed a routine notice into a governance failure. It is a cautionary example for companies: once disclosure is required, refusing to explain scope can produce stricter rules than a direct answer might have avoided.

The civil rights and equity dimension also matters. Dupre represents neighborhoods where, as he described it, surveillance has become the norm. Residents are already watched and profiled, and the prospect of corporate biometric databases operating without their knowledge raised deeper concerns about whose data is collected and why. That framing suggests the new ban is not only a privacy rule but a response to concentrated surveillance in historically overpoliced communities. Biometric restrictions may therefore become intertwined with broader debates about local police surveillance, commercial data brokerage, and algorithmic discrimination.