Can a shop or stadium scan my face?

Facial recognition that identifies you creates biometric data — special category under Art. 9, forbidden to process unless a narrow exception applies. For a shop, stadium or supermarket the only realistic exception is your explicit consent — a camera at the entrance with a sign is nowhere near consent, and DPAs across Europe have said so in fines and bans repeatedly: covert “VIP/shoplifter watchlists”, emotion-scanning billboards and biometric entry gates have all been struck down. The AI Act adds hard bans (applicable since 2 February 2025): emotion recognition at work and in schools, untargeted scraping of facial images to build databases (the Clearview model — already fined by multiple DPAs), and real-time remote biometric identification in public spaces by law enforcement outside narrow, authorised cases. Retail “mood analytics” sits squarely in the danger zone. What IS allowed: ordinary CCTV without identification (see the shop’s duties under video-surveillance guidance), and voluntary, genuinely optional biometric convenience — think consent-based stadium fast lanes — with a non-biometric alternative that works just as well. Spot it, fight it: you can demand information (Art. 13/15: “do you use biometric identification, on what basis?”), object, and report the deployment to your DPA — these complaints get taken up, because every regulator wants a face-recognition precedent.