Is facial recognition legal? KVKK for stores

As facial recognition spreads through the retail sector, the question 'is facial recognition legal?' has become a critical compliance issue for store owners in Turkey. The answer under KVKK is clear: facial data is a 'special category of personal data' under Article 6, subject to the law's strictest protection regime — far tighter than ordinary personal data.

Why facial data is a special category

KVKK Article 6 lists biometric data — including facial data — among special categories of personal data, alongside health records, religious beliefs, and criminal history. Processing special-category data requires either the explicit consent of the data subject or proof of adequate safeguards approved by Turkey's data protection authority. In a retail context, neither is practically achievable.

Practical challenges of retail facial recognition

• Explicit consent: every customer entering the store must give free, specific, informed, and unambiguous consent to biometric processing. Collecting this from every visitor is operationally unworkable.
• Right to withdraw: consent can be revoked at any time, requiring immediate and complete deletion of all biometric data for that individual.
• Irreversibility of breach: unlike passwords, faces cannot be changed. A data breach causes permanent, irreparable harm.
• Penalties: Turkey's data protection authority imposes significant administrative fines for biometric data violations.
• Tightening global regulation: the EU AI Act restricts real-time facial recognition in public spaces; similar trends are shaping Turkish regulatory thinking.

Anonymous analytics: same value, zero biometric risk

What retailers actually want from facial recognition comes down to three things: understanding visitor behavior, detecting security risks, and measuring store performance. BEKÇİ AI delivers all three — without any facial recognition.

• Security detection: weapons, fire/smoke, and suspicious movement patterns are detected anonymously — no individual identification involved. Human-approved alerts minimize false positives.
• Heatmaps and dwell analysis: which zones are busy, how long customers linger by a shelf — all extracted from footage without recognizing or profiling anyone.
• Queue and checkout analysis: number of people waiting and average wait time — measured without any identification.
• Edge processing: all analysis runs on in-store hardware. The continuous video stream does not leave the premises; routinely only anonymous event data reaches the cloud.

'What / where / when' — not 'who'

BEKÇİ AI's core principle: understand behavior, not identity. No voice recording, no personal profiles, no facial data. Only anonymous event data reaches the cloud — for example, 'high traffic at the entrance at 15:00'. This data does not qualify as personal data under KVKK, so biometric obligations simply do not apply.