Chaayos Silently Captures Your Facial Data When Ordering a Cup of Tea; Chaayos Responds

Chaayos, a popular retail chain that serves a range of food and beverages, has augmented its one-time-password (OTP) method by deploying a facial recognition feature to fulfil orders from customers. The move eliminates the need for returning customers of the chain to enter OTPs for each order. While the new deployment by the company, owned by the Delhi-based Sunshine Teahouse, is not a first in the sector, it has raised privacy concerns on social media. The company doesn't first explicitly seek the consent of customers before capturing their facial data. The terms and conditions page on the Chaayos website also suggests that the company could share the facial data -- alongside the phone number and other details of its customers -- with third parties. Similar to Chaayos, Bengaluru-located tea retail chain Chai Point also has a facial recognition system within its order taking process. Gadgets 360 reached out to Chaayos for clarity on the issue, and received a response.

For quite a long time, Chaayos required customers to place an order at its kiosks by first registering their name and phone number on a tablet at the sales counter, and then entering the OTP they received on their mobile number. The company, however, has now upgraded that system with facial recognition for identifying returning customers. The new feature works through the tablets that have a decent front-facing camera to capture your facial features. If you're a first time user, these tablets take your selfie when you enter your name, mobile number, and OTP to proceed with your order. The next time you visit the chain however, and place an order, the system is claimed by the company to identify you, eliminating the need for you to enter your name, mobile number, and OTP.

Instead of asking any explicit permissions from customers, the facial recognition feature shows a screen that has a Start button and text "Face it. Why put numbers through, when we can identify you?" -- all in bold. This is where Chaayos starts the action and captures your facial data.

Gadgets 360 visited one of the Chaayos outlets in New Delhi and found that the process of taking portrait shots takes just a few seconds. Also, it works in the background -- without letting customers know that they're about to give their facial data to the outlet.

As per the terms and conditions specified on the Chaayos website, the "primary purpose" of collecting personal information and facial recognition feature is to allow customers to "access and use" the website and "visit" the outlets "to avail and purchase of" its services/ products. It also helps to "personalise your experience." There is, however, no guarantee the customer data would always remain private to the company, as pointed out by Nikhil Pahwa of MediaNama.

"[A]lthough Sunshine Teahouse is committed to protecting customer's privacy, Sunshine Teahouse does not promise or guarantee the same and customer should not expect, that customer's personal information should always remain private," the company said while defining its terms and conditions.

Chaayos doesn't clearly mention that customers must provide their facial data to process orders. Nonetheless, one of the terms and conditions said that they need to use the facial recognition feature at the outlets to receive products and services from the company.

"While you can browse some sections of our website without being a registered member or visit the store/ outlet of the company, certain activities (such as placing an order) do require registration and require you to provide facial recognition feature and other the relevant information to the company," the company stated.

As for the matter of user consent of using facial recognition, the terms and conditions blithely say, "Your use of the website and voluntarily providing above-mentioned Personal information through facial recognition feature at the outlet/ store of the company constitutes your CONSENT to all the terms and conditions contained in this privacy policy (as amended from time to time) and you shall be bound by the same."

The exact launch date of the facial recognition feature by Chaayos is unclear. Nevertheless, a representative at the Chaayos outlet in Nehru Place told Gadgets 360 that it was rolled out less than a week ago. A report by Inc42 mentions the deployment of facial recognition by the company while detailing its debut in Bengaluru earlier this month.

Chaayos has been facing public outrage for taking facial data of its customers without notifying them properly. Several customers have posted their views on social media.

MediaNama's Pahwa says that it is "very worrying trend" that seems to be normalising facial recognition.

"Biometric information is sensitive personal data: once compromised, it is compromised forever," Pahwa tells Gadgets 360. "I would strongly urge all private entities to voluntarily adopt a moratorium on using facial recognition systems until we have a law that protects privacy, and norms that restricts or prevents the usage of facial recognition systems."

Prasanna S, a digital rights activist and one of the leading lawyers behind the right to privacy case, affirms that the Chaayos move is an "egregious violation of privacy" for collecting sensitive personal data without the data subject's consent.

"Even under our IT Rules, biometrics including facial data is classified as sensitive personal data," he underlines.

It looks like Chaayos isn't alone in the race of bringing facial recognition into its order process. Chai Point has a similar system in place at least since December last year, as highlighted in a report by The Week.

In addition to private companies showing their interest towards building facial recognition systems to obtain biometric data, the National Crime Records Bureau (NCRB), under Home Ministry, is set to take such developments to a new level. It is aiming to establish the world's largest facial recognition system to track and nab criminals. Some airports in the country have also started placing machines to recognise faces of passengers.

Responding to Gadgets 360, Chaayos has provided a statement on the issue:

Since inception, Sunshine Teahouse Pvt Ltd (“Chaayos”) has strived to leverage technology to deliver great customer experience. Towards this endeavour, we have recently launched a facial recognition feature at our Point of Sale as an option to eliminate the hassles of OTPs and reduce the overall customer purchase time. The feature is currently in the beta phase at select cafes and will be officially rolled out post thorough testing.

At Chaayos, we are extremely conscious about our customer's data security and privacy and are committed to protecting it. Data from the facial recognition feature is encrypted and cannot be accessed by any party, including Chaayos itself except for the purpose of logging-in our customers. There is no third party sharing of the data for any purpose. And Chaayos does not use or process this information for any other purpose. Moreover, customers have the right to not opt in for facial recognition feature and instead use their phone number to enjoy benefits of our loyalty program. Even providing phone number is not mandatory to enjoy a cup of chai or other products at Chaayos.

We also provide our customers with a permanent “Opt-out” feature on our website, where-in they can choose to permanently delete their pictures captured by our systems at any point of time . Our café staff are also well trained to help customers register or opt-out of the feature.