A new independent watchdog with the power to inspect forces and, if they refuse to comply, seek a court injunction to stop them. An £11 million commitment to triple the number of live facial recognition vans working the streets of England and Wales. Government called it part of “the biggest policing reforms in 200 years,” and most of the coverage that followed treated it exactly that way: a story about how police will use the technology, backed by arrest figures from a static camera pilot in Croydon that ran from October 2025 to March 2026 and produced 173 arrests, including for rape, kidnap and sexual assault.

One line in the same announcement had nothing to do with policing at all. The Home Office confirmed it will also develop a separate legal code of practice for private-sector use of facial recognition, and it named retailers specifically as the intended audience. No outlet covering the story in the days since has given that detail more than a sentence.

It deserves more than a sentence, because retail facial recognition has been operating without one for years. The House of Lords Justice and Home Affairs Committee and the Ada Lovelace Institute have both previously described private-sector use of the technology as sitting in a legislative void: no statutory minimum standard for how the systems are built or tested, and no independent requirement to check them for bias across age, gender or race. There is also no consistent route for someone wrongly flagged as a shoplifter to challenge the match. Retailers building and sharing watchlists of suspected shoplifters have, in effect, been setting their own rules.

That gap has widened as the technology has spread. Big Brother Watch has spent the past two years campaigning against retail facial recognition specifically, arguing that shoppers are being matched against shared watchlists with no visibility into how those lists are compiled, corrected or shared with police. None of that debate has had a statutory answer. The Home Office’s announcement is the first confirmation that one is coming, shaped in consultation with the same new watchdog being created to police the police.

What the code will actually require is not yet public. The Home Office has given no date for publication and no detail on whether compliance will be mandatory, something the Ada Lovelace Institute has specifically pushed for rather than a voluntary standard retailers can choose to ignore. Based on what the policing side of the reform demands of forces, independent bias testing and a clear, auditable basis for any decision to flag someone are the likeliest minimum bar. Whether the private-sector code goes that far, or settles for a weaker set of principles, will decide how much actually changes for the loss-prevention teams running these systems today.

It arrives at a moment when retailers have more reason than usual to lean on the technology rather than question it. Shoplifting has climbed again this year according to British Retail Consortium data, and retailers including M&S have said publicly that offenders are becoming more brazen with less fear of consequence. Facial recognition has been one of the tools retailers point to when asked what they are doing about it. A new compliance standard lands squarely in the middle of that pressure, asking security and loss-prevention teams to prove their systems are fair at the same time as they are under pressure to show they are working.

The pattern has a precedent. Voluntary surveillance camera guidance in the UK has repeatedly turned into an expected buying standard well before it became a legal requirement, as systems bought to the old, looser bar get replaced or retrofitted once the market moves on. A retailer specifying facial recognition today has no finished text to build against, only the direction the Lords committee and the Ada Lovelace Institute have already set out: independent testing, and a record a person can actually challenge. Whether the Home Office’s code matches that bar, or settles for something looser, is still an open question, and it is the one this announcement left unanswered.

Register your interest for The Security Event 2027

Subscribe to The Security Briefing for monthly updates!