You Went to Walmart for Groceries. Did You Know How Much Data You May Be Giving Away?

We spend a significant amount of our practice advising companies about regulatory compliance, privacy, health information, data use, and the increasingly complicated intersection between technology and the law.

And the more we work in this area, the more we find ourselves asking a fairly basic question:

Does the average American have any idea how much information companies are capable of collecting about them?

Walmart’s recently updated privacy notice is a good reason to ask.

Walmart updated its Customer Privacy Notice on August 20, 2026, adding information concerning voice interactions. But what caught my attention was not simply that update. It was reading the privacy notice as a whole and considering the extraordinary breadth of information that one of America’s most familiar retailers says it may collect or receive.

Most people think about Walmart as the place where they buy groceries, household products, clothing, electronics, prescriptions, or school supplies.

They probably do not think about biometric information, precise geolocation, browsing behavior, behavioral inferences, voice interactions, iris or retina imagery, or face geometry.

But perhaps they should.

What Does Walmart Say It May Collect?

Walmart’s privacy notice identifies an extraordinarily broad range of personal information that it may collect or receive, depending upon the products and services a consumer uses, as well as device, account, and consent settings.

Among the categories Walmart identifies are:

• biometric information, including voice prints, iris or retina imagery, face geometry, palm prints and fingerprints;

• geolocation information, which can include precise device location when the consumer provides consent;

• internet and network activity, including browsing and search activity and interactions with websites, apps, emails and advertisements;

• purchase and transaction history, including products purchased, rented or returned;

• communications, including certain emails, text messages and interactions with AI assistant chatbots where Walmart is a party to the communication;

• demographic information, including such things as age, gender, citizenship, ethnicity, marital or family status, household income, education, employment information, family health, number of children and number of cars owned;

• sensory information, including photographs, audio and video recordings;

• financial information;

• device and advertising identifiers; and

• inferences about individuals, including preferences and characteristics derived from shopping patterns and behaviors—and even references to intelligence and aptitudes.

Walmart expressly notes that not every category is collected about every individual. That is an important qualification.

Still, read that list again.

This is a retail privacy notice.

Walmart also explains that information can be obtained through automated technologies, through its websites and apps, in stores, from devices, and from third parties. Its notice discusses the ability, with appropriate device settings and consent, to collect precise location information and potentially recognize a mobile device’s location within certain stores through technologies such as Wi-Fi and Bluetooth. (Walmart News & Leadership)

That is a very different relationship between retailer and customer than the one most Americans grew up understanding.

I Am Less Concerned About Whether It Is Disclosed Than Whether Consumers Understand It

To be clear, Walmart has published a privacy notice explaining its practices. This is not an accusation that Walmart is secretly collecting every one of these categories from every person who walks through its doors.

My concern is broader.

Have we reached a point where disclosure has become a substitute for meaningful consumer understanding?

A privacy notice can technically tell a consumer that a company may collect biometric information, precise geolocation, purchasing behavior and behavioral inferences.

But how many consumers read it?

How many understand what those categories mean?

And how meaningful is consent when participation in everyday life increasingly requires interacting with companies operating enormous technology and data ecosystems?

We have conditioned consumers to click “accept,” permit location access, create an account, scan a QR code, download an app and move on.

Very few stop to ask what happens next.

Your Grocery Store Is Becoming a Data Company

That is the larger development I believe deserves attention.

The distinctions we once made between technology companies and traditional companies are disappearing.

Your automobile manufacturer is a technology company.

Your television manufacturer is a technology company.

Your pharmacy is operating within a technology ecosystem.

Your grocery store is increasingly operating within a technology ecosystem.

And your retailer may know far more about you than what you purchased last Tuesday.

Transaction histories can reveal patterns. Location data can reveal movements. Search activity can reveal interests. Demographic information adds context. Connected-device data adds another layer. Artificial intelligence makes it increasingly possible to analyze enormous amounts of seemingly unrelated information and generate conclusions—or inferences—about an individual.

The value is no longer necessarily in one isolated data point.

The value is in connecting them.

We Just Raised the Same Question About Your Car

This issue extends well beyond retail.

In our recent Kendall PC article concerning data collection by connected vehicles, we discussed how modern automobiles are evolving into sophisticated data-collection platforms capable of gathering information that would have seemed unimaginable in a family car a generation ago.

That article raised many of the same concerns.

When our cars can potentially observe us, our phones can locate us, our televisions can understand our viewing habits, our retailers can analyze our purchasing behavior, and AI can make increasingly sophisticated inferences from all of it, we need to stop treating privacy as an obscure provision buried at the bottom of a website.

It is becoming one of the defining consumer-protection issues of our time.

Why Is the United States Still So Far Behind?

From our perspective as lawyers practicing in this area, this is the part that is increasingly difficult to reconcile.

The United States still does not have one comprehensive federal consumer privacy law establishing a uniform national framework governing personal information.

Instead, we have a combination of sector-specific federal statutes and an expanding collection of state privacy laws. As of 2026, more than twenty states have enacted comprehensive consumer privacy legislation, while additional specialized laws govern areas such as biometric information, consumer health data, children, data brokers and automated decision-making. (IAPP.org)

That is progress.

But it is also a patchwork.

And technology does not operate state by state.

Data does not stop at the Pennsylvania border because a consumer drove into New Jersey.

An algorithm does not fundamentally change because its user happens to live in California rather than Delaware.

A company operating nationally should not need a fifty-state flowchart to determine the basic privacy rights of an American consumer.

Other jurisdictions have approached privacy from a fundamentally different starting point: establish broad rules concerning personal information and then determine how companies may use it.

The American approach has historically been much more fragmented—regulating particular industries, particular types of information, particular business practices or, increasingly, leaving individual states to fill gaps.

Meanwhile, the technology is moving exponentially faster than legislation.

This Is Not Just a Walmart Issue

It would be easy to read Walmart’s privacy notice and make Walmart the story.

I don’t think Walmart is the story.

We are.

Walmart is one highly visible example of what the modern data economy has become.

Consumers trade information every day for convenience—often without consciously realizing a transaction has occurred.

Free Wi-Fi.

An app that tells you where an item is located.

Faster checkout.

Personalized recommendations.

Location-based pickup.

Voice assistants.

Virtual try-on technology.

Connected televisions.

Connected cars.

Each feature may be perfectly useful. Many are genuinely convenient.

But convenience has a price, and increasingly that price is information.

The question is whether consumers understand the bargain.

The Privacy Conversation Needs to Change

For years, privacy compliance has often been treated as a lawyer’s exercise:

Do we have a privacy policy?

Is the disclosure there?

Did the consumer consent?

Is there an opt-out?

Those questions remain legally important. But I think we need to start asking another question:

Would an ordinary person reasonably understand what is happening with his or her information?

Because a world in which companies are capable of collecting biometric identifiers, tracking location, analyzing behavior, combining data from multiple sources and drawing increasingly sophisticated conclusions about individuals requires something more than a 10,000-word privacy notice that almost nobody reads.

It requires a serious national conversation about what privacy should mean in 2026 and beyond.

Until then, I would encourage consumers to do something most of us rarely do:

Read the privacy notice.

Not every word. Not every time.

But occasionally, take five minutes and look at what your favorite retailer, app, automobile, television or device says it can collect about you.

You may be surprised by how much the companies you interact with every day are capable of knowing.

And perhaps that surprise is exactly why we need to start paying more attention.

How Kendall PC Helps Companies Navigate U.S. Privacy and Data Regulation

Kendall PC advises companies operating in regulated industries on U.S. privacy, data governance, healthcare privacy, consumer protection and emerging technology issues. Our work includes evaluating how companies collect, use, disclose and protect information; reviewing consumer-facing privacy disclosures; assessing website, app and tracking technologies; evaluating state and federal privacy requirements; and helping organizations build practical compliance frameworks appropriate to their actual operations and risk profiles.

As technology enables businesses to collect and analyze increasingly sophisticated categories of personal information, privacy compliance should be considered at the beginning of product development and commercialization—not after the technology has already been deployed.

This article is provided for informational purposes only and does not constitute legal advice. Privacy and data-protection requirements vary depending upon the jurisdiction, entity, technology, information involved and particular circumstances.