Cadillac Fairview Collected Five Million Shopper Images Using Undisclosed Facial Recognition in Canadian Malls

Cadillac Fairview, one of Canada’s largest commercial property owners, embedded small cameras inside digital directory kiosks at 12 shopping malls across five provinces — Ontario, Quebec, Alberta, British Columbia, and Manitoba. These included high-traffic properties such as Toronto’s Eaton Centre and Montreal’s CF Carrefour Laval. The cameras captured images of shoppers without their knowledge or consent — over five million numerical facial representations were generated — and facial recognition software analyzed the images to estimate each person’s age and gender.

A joint investigation by the federal Privacy Commissioner, Alberta’s Information and Privacy Commissioner, and British Columbia’s Information and Privacy Commissioner — with Quebec’s Commission d’accès à l’information collaborating separately — found that Cadillac Fairview violated the Personal Information Protection and Electronic Documents Act (PIPEDA). The investigation revealed that a third-party technology provider had retained approximately five million numerical facial representations on a decommissioned server. The commissioners found the company had failed to obtain meaningful consent for the collection of sensitive biometric information and had not been transparent about the facial recognition capabilities embedded in the kiosks.

The investigation concluded that shoppers had no reasonable expectation that visiting a mall would result in the capture and analysis of their biometric data. The cameras were inconspicuous and no signage informed visitors of the facial recognition technology. The commissioners recommended that Cadillac Fairview delete the collected data and obtain express consent before any future use of such technology. Cadillac Fairview subsequently confirmed it had deleted the data and removed the cameras.