In June 2025, CVS sent mass text messages to thousands of Louisiana customers — using contact information collected for prescription services — urging them to oppose House Bill 358, which would have prevented PBMs from also operating pharmacies. The House Oversight Committee opened a HIPAA investigation, noting that "political advocacy or lobbying" is not among HIPAA's permitted uses of patient information.

A class action lawsuit (filed in Cook County, Illinois) alleged that Walgreens deployed facial recognition security cameras that scanned customers' faces without disclosure or consent, violating the Illinois Biometric Information Privacy Act (BIPA). The lawsuit notes customers "lost the right to control the collection, use, and storage of their biometric identifiers" simply by walking in to pick up prescriptions. The FTC separately banned competitor Rite Aid from using facial recognition for 5 years in December 2023 for similar practices.

The OAIC investigated Bunnings following a CHOICE investigation and determined that Bunnings' use of facial recognition breached Australian Privacy Principles. Bunnings scanned every customer's face upon entering stores, comparing biometric data against a database of people previously involved in theft or antisocial behaviour. This means every customer -- millions of Australians buying plants, screws, and barbecues -- had their face scanned and processed as biometric data. To identify the small percentage of people on a watchlist, Bunnings collected the biometric data of everyone. The OAIC found Bunnings breached APP 3.3 (collection of sensitive biometric data without consent) and APP 5 (failure to notify individuals). Kmart Australia was found to have used identical facial recognition systems. Bunnings argued the technology protected staff safety. The OAIC determined that mass biometric surveillance of every customer was not a proportionate response to retail theft.

In November 2025, Priceline announced a partnership with retail media platform Zitcha to monetise its 9.5 million Sister Club members. Wesfarmers Health describes itself as "uniquely positioned to offer brands powerful, data-driven opportunities to connect with shoppers across multiple touch points." Your pharmacy loyalty data — what medications and health products you buy — is being packaged and sold to advertisers as a "retail media" product.

Nebraska AG alleged Temu unlawfully harvests data including from kids. The app uses gamification — spin-the-wheel, countdown timers, daily rewards — designed to be addictive to minors. No meaningful age verification. Kentucky AG's July 2025 lawsuit cited harm to children. Gamification mirrors documented social media addiction techniques.

In September 2025, the OAIC found Kmart breached the Privacy Act by using facial recognition technology in 28 stores between June 2020 and July 2022. The system captured the face of every person who entered these stores — not just suspected fraudsters. The Privacy Commissioner found the collection was disproportionate to the fraud risk: scanning the faces of millions of innocent shoppers to catch a small number of fraudsters. Kmart was ordered to publish an apology. The technology captured children, elderly people, and anyone who walked through the door — none of whom were suspected of anything. To stop a few people stealing, Kmart scanned millions of faces.

The $8.8 billion Sigma-Chemist Warehouse merger (completed February 2025) gives a single entity access to pharmacy dispensing data from 600+ Chemist Warehouse stores PLUS Sigma's wholesale distribution data covering thousands of independent pharmacies. The ACCC acknowledged this was a "major structural change" for the pharmacy sector but accepted only three-year behavioural undertakings — not structural ones.

South Korea's PIPC fined AliExpress $1.4 million in July 2024 after finding it shared data with approximately 180,000 sellers in other countries — mostly China — without required legal measures. First company ever punished for violating South Korea's overseas data transfer rules.