Major retailers including Wegmans, Lowe's, and Macy's are secretly using facial recognition systems to identify "persons of interest" - and the watch lists include individuals flagged by law enforcement agencies, raising serious questions about private companies conducting surveillance on behalf of the government.

According to documents obtained by the ACLU, these systems scan every customer's face against databases that include both store-identified shoplifters and law enforcement "BOLO" (Be On the Look Out) alerts. When asked directly, most retailers refused to confirm or deny the practice.

Here's what we know: Wegmans admits using facial recognition to identify people "determined by our asset protection team based on incidents occurring on our property" - and also "on a case-by-case basis, by information from law enforcement."

That last part should make you pause. Law enforcement providing watch lists to private retailers creates a surveillance infrastructure that sidesteps many constitutional protections that would apply if police were doing the scanning directly.

Madison Square Garden famously used facial recognition to identify and eject lawyers who work for firms suing the venue. The technology works. The question is whether we want to live in a world where every store entrance is a checkpoint.

The privacy implications are compounded by accuracy issues. Facial recognition is disproportionately imprecise when evaluating faces of Black people. At least 10 people have been wrongfully arrested based on facial recognition errors - that we know about. The real number is likely higher.

And there's the opacity problem: companies refuse to disclose accuracy rates, bias measurements, or even which specific store locations use the technology. Wegmans claims "We do not share facial recognition scan data with any third party," but won't say whether they share match alerts or other metadata.

The FTC has already banned Rite Aid from using facial recognition for five years after finding with how the drugstore chain deployed the technology. That case revealed that the company had no standardized procedures for handling false positives.