Sign in Subscribe
AI

French data watchdog rejects AI age cameras in tobacco shops

France's privacy authority declares enhanced surveillance systems neither necessary nor proportionate for age verification, citing GDPR violations and surveillance concerns.

Luis Rijo

• 5 min read
Modern surveillance camera with French flag backdrop highlighting CNIL's ruling on AI age estimation systems.
Modern surveillance camera with French flag backdrop highlighting CNIL's ruling on AI age estimation systems.

France's data protection authority has ruled that artificial intelligence-powered cameras designed to estimate customer ages in tobacco shops violate privacy regulations. The Commission Nationale de l'Informatique et des Libertés (CNIL) announced on July 11, 2025, that these enhanced surveillance devices fail to meet legal requirements under the General Data Protection Regulation.

According to the CNIL position statement, these AI-powered cameras scan customers' faces to determine whether individuals appear underage. The systems display green or red lights based on preset age thresholds of 18 or 21 years. Despite being marketed as decision-support tools, the devices process biometric data and fall within GDPR scope.

The technology operates through continuous facial analysis of all persons within camera range. Current deployments activate by default and analyze faces of individuals regardless of their apparent age. These cameras utilize artificial intelligence algorithms to estimate whether customers exceed predetermined age limits for tobacco, alcohol, and gambling products.

PPC Land Newsletter

Subscribe the PPC Land newsletter ✉️ for similar stories like this one. Receive the news every day in your inbox. Free of ads. 10 USD per year.

Subscribe

Summary

Who: France's Commission Nationale de l'Informatique et des Libertés (CNIL) issued the ruling against tobacco shop owners deploying AI-powered age estimation cameras.

What: The data protection authority declared enhanced surveillance cameras that scan faces to estimate customer ages violate GDPR requirements due to lack of necessity, proportionality concerns, and surveillance risks.

When: The CNIL announced its position on July 11, 2025, following stakeholder consultations conducted throughout early 2025.

Where: The ruling applies to tobacco shops across France using enhanced cameras equipped with artificial intelligence algorithms for facial analysis and age estimation.

Why: According to the CNIL assessment, these systems fail to improve upon existing age verification requirements while creating unnecessary privacy risks, contributing to surveillance normalization, and preventing meaningful consent or objection mechanisms for customers.

PPC Land Newsletter

Subscribe the PPC Land newsletter ✉️ for similar stories like this one. Receive the news every day in your inbox. Free of ads. 10 USD per year.

Subscribe

Technical limitations undermine effectiveness

According to the CNIL analysis, AI-based age estimation cannot provide certainty and carries inherent error risks. This uncertainty means tobacco vendors must still request official proof of age, making facial analysis redundant. The authority found that these systems offer no added value and may discourage proper verification procedures.

"Since AI-based estimation cannot provide certainty and carries a risk of error, it does not exempt vendors from requesting official proof of age," states the position document. The technology's inability to guarantee accuracy undermines its practical utility for legal compliance.

The CNIL identified several technical problems. Enhanced cameras film all persons, including those manifestly of age. These systems prevent individuals from exercising their right to object under GDPR Article 21. The continuous scanning creates disproportionate data processing that exceeds necessary requirements for age verification.

French law requires tobacco retailers to verify customer ages before selling restricted products. According to the CNIL assessment, enhanced cameras do not satisfy this legal obligation. Vendors must continue requesting identity documents or certified age verification applications regardless of camera results.

The authority pointed to alternative verification methods that comply with data protection requirements. These include traditional identity document checks and certified age-verification applications. The European Commission is developing a "mini-wallet" prototype for age verification, expected by summer 2025, which would display minimal information while proving majority status.

Enhanced cameras represent a clear case where technology fails to improve upon existing legal compliance mechanisms. According to the CNIL findings, these devices add an unnecessary layer of data processing without reducing legal verification requirements. The automation may even encourage retailers to rely solely on machine results without proper documentation checks.

Fundamental rights concerns drive rejection

The CNIL emphasized that enhanced camera deployment poses risks to fundamental rights protected under EU Charter provisions. Even when data processing occurs locally without storage, these devices contribute to algorithmic surveillance normalization in public spaces.

"Deploying such cameras poses risks to fundamental rights, even when data is processed locally and not stored," according to the position statement. The authority expressed concern about widespread deployment in public-facing venues like tobacco shops normalizing enhanced surveillance.

The technology raises particular concerns about individual autonomy in public spaces. Continuous facial scanning occurs without meaningful consent or objection mechanisms. According to the CNIL analysis, customers cannot reasonably avoid these systems while accessing legitimate services. This creates a coercive environment where individuals must accept surveillance to purchase legal products.

French data protection law requires demonstrable necessity and proportionality for personal data processing. According to the CNIL assessment, enhanced age estimation cameras fail both tests. The technology processes more data than necessary while providing no improvement over existing verification methods.

Broader surveillance implications examined

The CNIL position reflects growing concerns about AI surveillance systems across European markets. French authorities join Dutch and German regulators in establishing strict guidelines for AI applications processing personal data.

The tobacco shop camera ruling aligns with broader European efforts to regulate enhanced surveillance technologies. According to EDPB guidance released in December 2024, AI systems cannot automatically be considered privacy-compliant and require case-by-case assessment by data protection authorities.

Enhanced cameras represent part of a larger trend toward algorithmic decision-making in commercial settings. The CNIL previously published comprehensive guidance on enhanced cameras in public spaces in July 2022, establishing strict criteria for deployment. The tobacco shop position builds upon these earlier guidelines while addressing specific sector concerns.

Marketing implications for surveillance technology

For digital marketing professionals, the CNIL decision highlights growing regulatory scrutiny of AI-powered consumer analysis systems. Enhanced surveillance technologies face increasing restrictions across European jurisdictions, affecting companies developing or deploying such systems.

The ruling particularly impacts businesses considering biometric or enhanced analysis technologies for customer profiling. According to recent EDPB recommendations, data protection authorities should serve as primary oversight bodies for high-risk AI systems, including those used in commercial surveillance.

Marketing technology vendors must consider whether their products create similar GDPR compliance issues. Systems that analyze customer behavior, appearance, or demographics without clear legal basis face potential regulatory challenges. The French position suggests authorities will prioritize individual rights over technological convenience in commercial applications.

Companies operating enhanced surveillance systems should review their legal bases and necessity assessments. According to the CNIL analysis, processing personal data through AI systems requires demonstrable improvement over existing methods. Technologies that duplicate existing processes while adding privacy risks may face regulatory rejection.

Enforcement timeline and industry response

The CNIL reached its conclusion after conducting stakeholder consultations throughout early 2025. The authority examined current deployments and assessed their compliance with GDPR requirements. Multiple requests for guidance prompted the formal position statement released on July 11.

Industry stakeholders must now evaluate existing enhanced camera deployments for GDPR compliance. According to the position statement, current systems fail to meet legal requirements due to excessive data processing and ineffective opt-out mechanisms. Companies have received clear guidance that existing implementations require modification or removal.

The French authority's position creates precedent for similar technologies across retail sectors. Enhanced surveillance systems in shopping centers, entertainment venues, and other commercial spaces may face similar scrutiny. According to CNIL guidance, any system that analyzes personal characteristics requires robust legal justification and proportionality assessment.

Tobacco retailers using enhanced cameras must transition to compliant verification methods. The CNIL identified traditional identity checks and certified applications as acceptable alternatives. These methods provide greater accuracy while respecting individual privacy rights and GDPR requirements.

Timeline