China warns of data privacy risks in retail AI systems
China's Ministry of State Security warned the public about potential data privacy and security risks from AI-powered retail systems including vending machines with facial recognition and delivery apps that collect location data and biometric information.
What happened
China's Ministry of State Security issued a public warning on 24 October 2025 about data privacy and security risks in electronic retail systems. The warning identified two main concerns: delivery apps that collect precise location data and create user profiles from purchase history and social connections, and automated vending machines equipped with facial recognition technology that collect biometric information including facial features and iris patterns.
The Ministry stated that vending machines equipped with recording, facial recognition, and infrared imaging technology can collect biometric data from both users and passersby. Individual vending machines request users provide phone numbers, gender, and birth dates after capturing facial data, and backend information systems connecting these devices may contain security vulnerabilities that could be exploited.
Reported impact
The Ministry warned that stolen data from delivery services could become an entry point for foreign intelligence agencies or others to conduct espionage, infiltration, and technical attacks. Data leaks from vending machines with security vulnerabilities could expose personal and biometric information to attackers.
Index analysis
The warning highlighted that retailers collecting delivery location data may map sensitive areas and create user profiles without clear legitimate necessity, creating risks if data is compromised. Vending machines collecting biometric data from users and bystanders pose risks if backend systems lack adequate security protections.
Governance controls
The Ministry called on the electronic retail industry to establish clear data collection boundaries and prohibit excessive collection of location and biometric information, and to conduct regular data security audits to prevent data interception or malware installation. The Ministry urged consumers to reject requests for unnecessary biometric data collection and to exercise caution with suspicious authorization prompts.
Classification
Sources and evidence
This record was researched and written by the Index, based on the following original reporting.