Estimating age with augmented cameras in tobacco shops is a no-go, CNIL says

The use of augmented cameras that can estimate the age of tobacco shop customers to prohibit the sale of cigarettes and other tobacco products to minors is neither necessary nor proportionate and, therefore, not allowed according to data protection and privacy laws.

The Commission Nationale de l'Informatique et des Libertés (CNIL), the French data protection authority (DPA), received several requests from tobacco shop visitors who challenged shop owners' decisions to install so-called augmented cameras that can guess a customer's age.

These cameras rely on an AI algorithm that scans a person’s face to determine whether he or she is a minor or an adult. A red light indicates that a person might be a minor, and a green light hints that this person is most likely a mature individual over 18.

This measure was implemented by numerous French tobacco shop owners as a selection tool to prevent the sale of tobacco products to minors, which is a legal offence.

The CNIL spoke to stakeholders and analyzed legislation to see whether these augmented cameras are compliant with the General Data Protection Regulation (GDPR) and the French Data Protection Act.

In short, they are not.

“Facial analysis carried out by so-called augmented cameras constitutes a processing of personal data, which must therefore respect the principles set by the GDPR to be legally implemented. It is essential to demonstrate that the use of these devices is necessary and proportionate before any deployment. This does not appear to be the case,” the privacy regulator concludes.

By installing augmented cameras, tobacco shop owners systematically ask their customers for proof of majority. Consequently, prior analysis of people’s faces by a camera to estimate their age does not appear necessary: tobacco shop owners can resort to other solutions, such as asking for someone’s identification document.

Furthermore, the use of augmented cameras could encourage tobacco shop owners to rely solely on the result rendered by the machine, without further verification.

In conclusion, so-called augmented cameras equipped with age estimation algorithms present risks to the fundamental rights and freedoms of individuals. Not only do they film and analyze all people in real-time, including adults, it prevents people from exercising their right to object, which is guaranteed by the GDPR.

The CNIL doesn’t explicitly say that tobacco shop owners in France have to remove augmented cameras. The privacy regulator’s conclusion, however, doesn’t leave much room for interpretation.