Is your supermarket spying on you? Mercadona & Carrefour got caught.

You’re being watched, and it’s not just by the cameras. What if your weekly supermarket run came with a side of surveillance? Not in terms of loyalty points, but in facial scans, deleted footage, and now silent data that was being harvested in the background – does that sound a bit dystopian? It is happening. 

In 2025, Carrefour was fined €3.2 million after exposing the personal data of over 120,000 of its customers due to several security failures. However, here is where most headlines are missing the point: Mercadona, Spain’s most beloved supermarket, is also facing a fine; it has already accumulated a €2.6 million fine in penalties related to privacy. So who, in turn, is protecting your privacy while you shop for oranges? Let’s examine what went wrong and how it might impact you in the future. 

Carrefour’s €3.2 million fine

Carrefour didn’t just make a simple mistake that left the entire data door open, and it’s one of Spain’s most prominent retail data scandals to date. Carrefour was fined €3.2 million by the AEPD, Spain’s data protection agency, which indicated a series of violations that affected more than 120,000 customers. So what went wrong?

• Poor data security, where customer information wasn’t adequately protected 
• Inadequate response to requests, so when people ask for their data to be deleted or corrected, they were ignored. 
• Consent data was being processed without users fully understanding or agreeing to what was occurring.

This is a systemic pattern of negligence that made customers vulnerable and exposed them to regular threats. 

Ranging from biometric tracking to ignoring data access requests, these are not isolated incidents. There is a growing culture of surveillance in retail, where your habits, face, and even movements are logged in the name of a “customer experience”.

The fine sent a message that even retail giants can’t treat your data like they throw away a receipt. Is it acceptable for a retail giant to fall this far short? Who else might also be collecting more than they should? 

Mercadona’s hidden €2.6 million scandal

While Carrefour’s fine made headlines, Mercadona’s Privacy issues were arguably worse and far more invasive to its customers. In 2021 alone, Mercadona launched a facial recognition system in 48 of its stores; The goal was to spot individuals with restraining orders or known criminal records. But the reality was very different.

• Every single customer who walked through the doors was scanned without informed consent.
• The system processes biometric data, one of the most sensitive types of data under the GDPR.

Spain’s AEPD was not impressed, to put it mildly. It fined Mercadona  €2.52 million, calling the program illegal, disproportionate, and unnecessary. The regulator cited violations of multiple GDPR articles, involving a failure to justify the technology and safeguard consumer rights. And that was not the end of it.

Notably, the case of a customer who was injured in the store, Mercadona, refused to hand over CCTV footage. So far, they have two strikes, nearly €2.7 million in fines, and the growing concern is that if Mercadona is doing this, what else is going on that hasn’t been noticed?

What are supermarkets collecting from you?

Today’s supermarkets are not just scanning groceries; they’re mainly scanning their customers. Here’s the kind of big data that they routinely collect, often without you realising:

• The loyalty card activity includes what to buy, how often you make purchases, where you make them, and when you make them.
•  Payment details that are linked to your identity and shopping habits.
•  Online behaviour, such as searches, clicks, keystrokes, and abandoned carts.
•  Facial recognition, although rare, has led to real cases, such as the ones we mentioned in Mercadona.
•  CCTV footage is used for security, but is not always accessible, even when requested by authorities

All this data can be used to build a detailed customer Persona, not just for marketing, but also for behavioural tracking, predictive modelling, and in some cases, severe security surveillance. 

And while some of this is illegal when done transparently, much of it falls into a grey area, especially when customers aren’t fully informed or can’t opt out. So the next time you hear a beep at the tell, ask yourself who’s watching who? 

What you can do

So why should you care about Supermarket surveillance?. Because it’s not just about your groceries, it’s also about your privacy, your rights, and your trust. Once that data is out there, your purchases, your habits, your face are things that you cannot take back. For Carrefour, they received a fine for failing to allow users to access or delete their data. Mercadona was punished for using facial recognition software without a proper legal basis. Both cases reveal a troubling pattern: the law exists, but enforcement often comes only after the damage is done. 

Here’s some good news: you can take the following steps today. First, ask for your data, as supermarkets are legally required to provide it. Secondly, review your loyalty card permissions in the app settings. Finally, you can complain to the AEPD if you believe your rights have been violated.

From discounts to data

Supermarkets used to compete on pricing, product offerings, and positioning. Now they compete on data. While we’re scanning loyalty cards for a few cents off, we’re also being scanned for our identities, habits, and even our facial recognition.

If Spain’s supermarket chains can fall foul of the law, one for deleting footage and the other for facial recognition, then how many more are quietly doing the same thing?. 

Until data protection is taken as seriously as food safety, this power and balance will stay, and customers will be kept in the dark, and corporations will grow ever more watchful.