This is a research prototype. The data and analyses are preliminary and not yet validated — we'd welcome your .
XPeng Motors was fined 100,000 yuan by Shanghai regulators for the unauthorized collection of over 430,000 facial images of store visitors. The company utilized facial recognition cameras provided by a third-party supplier, Ulucu, to track customer traffic and demographics without obtaining consent or informing consumers. The company has since removed the equipment and deleted the collected data, citing unfamiliarity with relevant privacy laws.
The Chinese electric vehicle (EV) firm XPeng Motors was fined by local market regulators for illegally collecting in-store customers’ facial images without their consent for six months.
Domain classification, causal taxonomy, severity scores, and national security assessments were LLM-classified and may contain errors.
AI systems that memorize and leak sensitive personal data or infer private information about individuals without their consent. Unexpected or unauthorized sharing of data and information can compromise user expectation of privacy, assist identity theft, or cause loss of confidential intellectual property.
The incident involved the unauthorized collection and processing of highly sensitive biometric facial data from over 430,000 store visitors without their consent.
Human
Due to a decision or action made by humans
Intentional
Due to an expected outcome from pursuing a goal
Post-deployment
Occurring after the AI model has been trained and deployed
The privacy violation arose from the human decision by XPeng Motors to deploy facial recognition cameras and collect customer data without obtaining consent.
XPeng Motors illegally collected over 430,000 facial images of store visitors in Shanghai using third-party facial recognition cameras. Regulators fined the company 100,000 yuan, and the data was subsequently deleted. The incident represents a minor commercial privacy violation with negligible national security implications.
The facial recognition cameras operated independently to automatically detect, capture, and analyze the faces of visitors entering the stores in real-time without requiring direct human intervention for each capture.
Level 2: High Risk. The system utilizes facial recognition technology to process sensitive biometric data (gender and age) of individuals, which has significant implications for fundamental rights and privacy.
The system was deployed to automatically detect and recognize faces, as well as analyze demographic characteristics (age and gender) of store visitors.
The reports are highly consistent across multiple sources regarding the key facts: the number of images collected (431,623), the fine amount (100,000 yuan), the purpose of the collection (passenger flow and demographic analysis), and the lack of consumer consent. There is no conflicting information about the core events.
None
Technology
Facial Recognition Cameras
Purchased 22 cameras with facial recognition functions to analyze visitors.
Third-Party Software Integration
Used Ulucu software which automatically collected and processed facial images.
Data Inputs
Unconsented Image Collection
Collected 431,623 facial photos without obtaining customer consent.
Sensitive Biometric Data
Collected highly sensitive facial images capable of identifying individuals.
Human Factors
Ignorance of Legal Requirements
Staff and buyers were unfamiliar with consumer privacy laws.
Misjudgment in Procurement
Procured illegal third-party services due to lack of legal awareness.
Process and Methods
Lack of Consent Process
No mechanism to inform consumers or obtain permission before collection.
Deficient Third-Party Vetting
Failed to audit the third-party supplier's compliance with local laws.
Management
Prioritizing Metrics over Privacy
Focused on analyzing passenger flow metrics without assessing privacy risks.
Inadequate Compliance Oversight
Management failed to review store-level technology procurement for compliance.
Regulatory Environment
Stricter Privacy Regulations
New laws like Consumer Rights Protection Law protect personal biometric data.
Increased Regulatory Enforcement
Market supervision authorities actively inspect and penalize violations.
AI system involved
Identified by automated extraction; can differ from the alleged developers above.
