Coles has confirmed a small proof-of-concept test. The retailer said it was a one-off exercise that did not use customer or team member information or data, and that no decision has been made about deployment. Woolworths has also confirmed trials through its New Zealand operations, although there is no confirmed Australian rollout.

The timing is significant. The developments follow updated guidance from the Office of the Australian Information Commissioner (OAIC) on facial recognition in retail, published in July after February's Administrative Review Tribunal decision involving Bunnings.

The Bunnings case has become an important reference point for retailers considering biometric security. The Tribunal found that Bunnings' use of facial recognition to address significant retail crime and protect staff and customers was permitted under the Privacy Act in the particular circumstances of the case. It also found shortcomings in Bunnings' notification of customers and its policies and procedures surrounding the technology.

The OAIC has since stressed that the ruling should not be treated as a general approval for facial recognition in retail. Its updated guidance describes the threshold as high and says organisations need to consider the circumstances of their own proposed use. 

That leaves security and loss prevention teams with a difficult question as retailers look for ways to tackle crime and protect employees.

The pressure is real. Research from the Shop, Distributive and Allied Employees' Association found that 34 per cent of almost 3,000 surveyed retail workers did not feel safe at work, while 25 per cent had experienced physical violence. 

Victoria recorded 95,181 criminal incidents in retail locations during 2025, according to figures cited by the Australian Retail Council. The number was 25.7 per cent higher than a decade earlier, with stealing from retail stores increasing by 16.7 per cent during the year. 

Facial recognition offers retailers a way to move beyond conventional CCTV by identifying people against a defined watchlist. That capability also brings the technology directly into Australia's privacy framework. Biometric information used for automated identification is treated as sensitive information under the Privacy Act, placing additional obligations on organisations using it. 

For security teams, the Bunnings decision therefore provides useful guidance without removing the need for careful assessment. A proposed system needs to be considered in the context of the particular security problem, the information being collected, how it will be used and the safeguards surrounding it.

Coles and Woolworths' interest suggests the issue will remain on the retail security agenda. As more organisations assess biometric technology, the next stage of Australia's debate is likely to focus on where the practical and legal boundaries should sit.

For now, the message from the privacy regulator is clear. The Bunnings ruling has opened a door for limited uses of facial recognition, but it has not opened the door for unrestricted deployment.

ICYMI Australian News:  Drone Incursions Put Australian Defence Security in Focus 

Register for The Security Event Australia happening  25-26 November 2026, MCEC Melbourne