You went in for paper towels. Maybe some cereal. Before you reached the dairy aisle, cameras may already have logged your facial geometry. That’s not paranoia — that’s Walmart’s own privacy policy, written plainly enough that anyone willing to read past page one can find it. Walmart’s Customer Privacy Notice and Visitor Privacy Notice describe a broad range of biometric and surveillance data the company says it may collect across physical stores and digital platforms. Here’s what the documents actually say. What the Policy Lists, Word for Word Straight from Walmart’s own legal language — and it covers more ground than most shoppers expect. According to Walmart’s Customer Privacy Notice, the company may collect: - Biometric data: face geometry, iris and retina imagery, voiceprints, palm prints, and fingerprints - Camera and automated technology data: images and information captured during checkout, theft deterrence, and store layout analysis, from systems used both inside and outside store locations - Automated License Plate Reader (ALPR) data: from vehicles on Walmart property, used for security, fraud prevention, parking enforcement, and safety purposes — a practice explored in detail in coverage of San Jose’s Flock Problem The retention schedule adds unusual specificity: Walmart says biometric data will be permanently destroyed when its purpose is fulfilled, within three years of your last interaction, or as the law requires — whichever comes first. One important qualifier on voice data: Walmart’s notice lists voiceprints as a biometric category it may collect, but also states it does not use voice data for biometric analysis. Any voice or audio collection appears context-dependent — tied to specific customer service interactions or voice-activated app features, not ambient recording during a standard store visit. What “May Collect” Is Actually Doing Here The two most consequential words in this entire document aren’t “face geometry” —