Head detection vs facial recognition: what Bunnings and Kmart mean for screen analytics

Cameras near screens make people nervous, and after the last two years in Australian privacy law, they should prompt careful questions. Two retail cases set the tone: Bunnings and Kmart both used facial recognition in stores, and both were found to have breached the Privacy Act.

If you run a screen network, a retail media network or a venue, the question you will be asked is simple: is audience measurement the same thing? It is not. Here is why, and what still matters when you measure audiences responsibly.

What happened in the two cases

Kmart

Kmart ran facial recognition in 28 stores between June 2020 and July 2022. It captured the face of everyone at the returns counter and turned each one into a biometric template, a "faceprint", to check against a list of suspected refund fraudsters. The Privacy Commissioner found it had collected sensitive biometric information without consent, and that capturing tens of thousands of innocent customers to address a small number of fraud cases was disproportionate. It also found failures in notice and in the privacy policy. (Clayton Utz summary)

Bunnings

Bunnings used facial recognition to identify people previously linked to crime or violence in its stores. The Privacy Commissioner found breaches in October 2024. In February 2026, the Administrative Review Tribunal set aside the finding on consent, accepting that a safety exception applied, but upheld the breaches on notice, privacy policy and compliance practices. (Clayton Utz summary)

One detail from the Tribunal matters for everyone using cameras: face data held only briefly in memory still counted as "collection". Processing something for a split second does not, by itself, put it outside the law.

Recognition and detection are different acts

Both cases were about recognition: working out who a person is by matching their face against a list. That is what made the information biometric and sensitive, and why consent and proportionality were tested so hard.

Audience measurement asks a different question. Not "who is this?", but "how many people are here, and are they looking?" That is detection.

UrbanIQ's agent looks for the shape of a human head, from any angle, including from behind. We deliberately do not use a face detector, because that would only count people already looking and skew the attention numbers. Each detection is followed by position, not appearance, then turned into a handful of numbers: dwell, view time, and an anonymous age band, gender and expression estimate. The frame is gone.

What still matters, even without recognition

Detection is not a free pass. The Bunnings and Kmart outcomes both turned partly on transparency, and those lessons apply to anyone with a camera in a public place.

1. Tell people. Clear signage at measured sites, written in plain language: what is measured, that it is anonymous, and where to find out more.
2. Say it in your privacy policy. Name the technology, what it collects, and the purpose, specifically.
3. Do a privacy impact assessment before deployment, and keep it on file.
4. Collect the minimum. Report aggregates, not individual records, and keep demographic and emotion estimates at group level.
5. Watch the reforms. The tranche 2 exposure draft released in August 2026 proposes broadening personal information to anything that "relates to" a person. Design for the stricter reading now.

The commercial case for getting this right

IAB Australia's 2026 programmatic outdoor report found 43% of the industry is unsure how privacy reform will affect DOOH. That uncertainty slows deals. A measurement partner who can explain, in one minute, exactly what is and is not collected removes a blocker from every conversation with a brand's legal team.

We built UrbanIQ around one rule: measure the audience, never the individual. If you want to walk your privacy or legal team through how it works, book a demo and bring them along. Read our privacy policy for the detail.