Toys “R” Us Is Back—Now With More Surveillance!

After filing for bankruptcy and closing more than 800 stores last year, Toys “R” Us is back. The iconic retailer has opened two new mall outposts, one in Texas and another in New Jersey, just in time for the holidays. The stores are packed with some of the most kid-coveted products of the year, but have been garnering attention for another reason: the surveillance technology they’re using.

Media reports described how Toys “R” Us partnered with the startup b8ta to install sensors in the stores‘ ceilings, which track people as they walk around and look at toys. “Toys ‘R’ Us is monitoring where kids go to produce data for brands,” wrote iO9 last week. Tweets expressing outrage that the stores would “spy” on kids have collectively been shared thousands of times.

Collecting information on kids is a highly sensitive issue, and US law carves out various additional protections or restrictions when it comes to minors—the only major federal law on digital privacy, the Children’s Online Privacy Protection Act, for example, was passed to protect children under 13. Often these rules, including COPPA, require obtaining parents’ permission before collecting data.

But the companies behind the monitoring technology in the Toys “R” Us stores say they have designed their products specifically not to record children’s data at all.

The cameras are powered by technology from RetailNext, a surveillance giant that supplies more than 500 brands and malls in more than 90 countries.

“RetailNext provides Toys ‘R’ Us with the same cameras that are used by major retailers worldwide to measure foot traffic both at the entrance and within different areas of the store,” a spokesperson for Tru Kids, the parent company of Toys “R” Us, said in a statement. “This data allows Toys ‘R’ Us to measure and manage the performance of the store, including product placement and staffing. All traffic data is anonymous and the cameras do not register kids.”

How do you make a camera ignore children? Ray Hartjen, a spokesperson for RetailNext, says the company’s depth-sensing cameras are generally trained to ignore “objects, including people, less than four feet tall.” That’s not exactly ideal, given that a normal American 10-year-old can stand almost five feet, according to the CDC. The company’s newer Aurora sensor instead uses an algorithm, which Hartjen says was trained to tell the difference between kids and adults by looking at pictures of RetailNext customers who consented to their images being used. (RetailNext did not share information about how these images were collected when asked by WIRED.)

Of course, the cameras could still accidentally record children, classifying them as adults and counting them in the aggregated measurements its service provides. When asked how the company ensures the cameras’ accuracy, Hartjen says RetailNext has internal auditing teams who test its cameras each time they’re installed. “We do not knowingly collect personal information from children under 13,” RetailNext’s privacy policy states. “If we become aware that a child under 13 has provided us with personal information, we take steps to remove such information.”

If you’re an adult, though, you’re fair game. The Toys “R” Us stores are a prime example of the new reality of IRL shopping, where corporations are racing to replicate the kind of data collection that’s long been possible online. While physical stores have long used tools like rewards programs to track consumer spending, ecommerce companies can collect far more detailed analytics, like what product pages shoppers linger on the longest. Only around 10 percent of American shopping dollars are spent online—where that valuable information is readily available.

Physical stores are increasingly turning to tools like Wi-Fi beacons and sophisticated cameras to bring the same data collection to the real world. The information can inform everything from marketing campaigns to store layouts, as well as help retailers compete with their online competitors. “Stores feel they have to do what websites have done and what apps have done,” says Joseph Turow, a communication professor at the University of Pennsylvania and the author of The Aisles Have Eyes: How Retailers Track Your Shopping, Strip Your Privacy, and Define Your Power. “The idea is to make the store like the internet.”

B8ta, the startup Toys “R” Us partnered with, specializes in what it calls “retail as a service.” Companies that don’t have retail footprints can pay to sell their products in b8ta’s brick-and-mortar stores across the country, and in exchange receive data on how shoppers interact with them in person. The company uses cameras in the ceiling that track the amount of time consumers spend trying out goods from each brand it carries. “We’ve never hidden anything about our analytics because it’s an important part of our story,” says Vibhu Norby, b8ta’s CEO.

In Toys “R” Us case, b8ta helped the company turn its new stores into interactive marketing destinations, where kids can play Nintendo games, shoot Nerf guns, and even attend events at a dedicated in-store theater. All the while, sensors in the ceiling calculate the number of shoppers—shoppers, again, that the technology has determined are over 13—who enter the store and how long they spend with each company’s toys.

Many consumers are likely aware they’re being filmed while shopping, but may assume the footage wouldn’t be used unless they try to shoplift. It’s not clear how aware people are of more sophisticated cameras like the ones RetailNext offers, and disclosure notices inside stores are typically discreet. Over the past two years, digital privacy has become a prominent issue for lawmakers and activists, but most of the discussions have centered on companies like Facebook and Google. Less attention has been paid to physical surveillance for things like ad targeting—even as retailers have adopted the same technology as the tech giants.

Earlier this year, for example, the Associated Press reported that companies like Kroger and Walgreens were testing cameras designed to assess your age, gender, and mood when you walk by, in order to serve you targeted advertisements on in-store video screens. Other retailers are using facial recognition technology, largely to identify shoplifters. It’s not clear how widespread the practice may be—particularly because the technology remains largely unregulated.

Last year, the American Civil Liberties Union asked 20 major retailers about whether they used facial recognition in their stores, and almost all refused to say. Ahold Delhaize, which owns grocery stores including Food Lion and Stop & Shop, was the only one to say no. Lowe’s was the sole retailer to confirm using the technology.

RetailNext says the traffic analysis cameras used in Toys “R” Us stores are designed to intentionally blur faces, in order to prevent individual shoppers from being identified. But that’s not the case for every camera it offers. “Some retailers do collect demographic data through sensors mounted at angles to collect facial imagery,” says Hartjen. These cameras use artificial intelligence to estimate a person’s age and gender, which is then aggregated into general statistics (it’s not clear how they might assess someone who is transgender or nonbinary).

Retailers don’t need fancy cameras to find out who you are—they can just use your cellphone. Stores have used Bluetooth and Wi-Fi technology to detect nearby devices for at least several years. Some even offer personalized digital coupons to shoppers once they enter a store. By tracking phones, companies can collect information like how long customers spend in each aisle or what parts of the store they’re drawn to the most.

Amazon has combined many of these technologies into its Amazon Go stores, which opened to the public last year. The convenience stores are filled with cameras that can detect when you pick up an item and charge you for it automatically. To verify their identities, shoppers scan a QR code on the Amazon Go app upon entering. There are no cashiers, and you can leave without needing to formally checkout. The stores are equipped with the kind of tracking that can be found on Amazon’s retail website, which is exactly the point.

“There is no distinction between offline and online,” says Turow. “In the world as it’s evolving, we should be realizing that marketing surveillance is taking place in every physical and virtual area that we inhabit.”