# Mapping fashion's privacy obligations from loyalty to fitting-room tech
A body scanner in a Levi's-style flagship captures 200,000 data points from your torso in four seconds to recommend a jean size. That scan is not "just measurements." Under several laws it is biometric data, one of the most heavily regulated categories on earth, and collecting it without the right consent can cost a retailer thousands of dollars per shopper.
This lesson traces how three regulatory frameworks land on the actual touchpoints fashion brands deploy: loyalty apps, body-scan sizing, and RFID clienteling. By the end you will know what consent each one demands and what to check before launch.
The General Data Protection Regulation (GDPR) is the EU law governing personal data of people in the EU, in force since 2018. Personal data means anything identifying a person: name, email, purchase history, even a device ID.
Two things matter for fashion:
Fines reach up to 20 million euros or 4 percent of global annual turnover, whichever is higher.
The California Consumer Privacy Act (CCPA), expanded by the California Privacy Rights Act (CPRA) effective 2023, gives California residents rights to know, delete, and opt out of the "sale" or "sharing" of their personal information. Enforcement sits with the California Privacy Protection Agency (CPPA) and the state Attorney General.
Key difference from GDPR: CCPA is mostly opt-out. You can collect data, but you must let shoppers say "do not sell or share my info." Roughly a dozen other US states now have similar laws (Virginia, Colorado, Texas, and others), so a US rollout is never single-state.
The strictest rules in the US are state biometric laws. The most important is Illinois's Biometric Information Privacy Act (BIPA), dating to 2008.
BIPA is the one that keeps fashion legal teams awake. It requires written consent before collecting biometric identifiers (face geometry, fingerprints, and importantly for sizing tech, body scans that identify a person). It also grants a private right of action: individuals can sue directly, with statutory damages commonly cited at 1,000 dollars per negligent violation and 5,000 dollars per intentional one.
Texas and Washington have biometric laws too, but they lack the private right of action, so BIPA drives most litigation.
For a plain-language reference, the IAPP US State Privacy Legislation Tracker is a free, well-maintained mapmapUsing software to automate repetitive marketing tasks and campaigns, enabling personalisation at scale across channels like email, web, and social.View full definition → of who has what.
A loyalty app is a data machine. It collects email, purchase history, location, and behavioral profiles (what you browse, when, how often).
What GDPR requires: A lawful basis for each use. Sending your order confirmation? Legitimate interest or contract. Sending marketing? Consent, via a clear opt-in checkbox that is not pre-ticked. Building a profile to predict your next purchase? That is profiling, and shoppers can object.
What CCPA requires: If you share app data with ad partners (Meta, Google) to retarget shoppers, that counts as "sharing." You must offer a visible "Do Not Sell or Share My Personal Information" link.
Run a data inventory (a documented mapmapUsing software to automate repetitive marketing tasks and campaigns, enabling personalisation at scale across channels like email, web, and social.View full definition → of what you collect, why, where it lives, and who you send it to). Most loyalty breaches of law are not evil intent. They are a marketing team quietly piping data to a fifth ad vendor nobody logged.
A minimal inventory row looks like this:
field: email_address
source: loyalty signup form
purpose: order confirmation + marketing
lawful_basis: consent (marketing), contract (transactional)
shared_with: [Klaviyo, Meta CAPI]
ccpa_category: "shared"
retention: 24 months after last purchaseIf any vendor in shared_with is missing from your privacy policy, you have a gap.
This is where fashion tech collides hardest with the law. Virtual try-on, 3D body scans, and fit-recommendation tools (companies like Zeekit, acquired by Walmart, or 3DLOOK operate in this space) can capture body geometry.
The critical question: does the scan identify the individual?
That design choice, keep versus discard, is the single biggest privacy decision in fitting-room tech.
Before launching body-scan sizing, ask the vendor three questions in writing:
1. Is the raw scan stored, and if so, where and for how long?
2. Can it re-identify a returning shopper from body geometry?
3. Is processing on-device or in the cloud?
If the answer to question 2 is yes, treat it as biometric and build the explicit-consent flow. Do not rely on a buried terms-of-service line.
RFID (Radio Frequency Identification) tags are chips woven into garments, read wirelessly. Retailers like Zara's parent Inditex have deployed RFID widely for inventory.
Inventory RFID is low-risk: it tracks garments, not people. The privacy line is crossed with clienteling, where a store associate's tablet links a VIP shopper's identity to what they picked up, tried on, and where they lingered.
What the law says: Once you connect RFID reads to a named customer, it becomes personal data. GDPR needs a lawful basis and transparency (the shopper should know the store profiles them). CCPA gives them the right to see and delete it.
Audit whether RFID and CRMCRMCustomer Relationship Management: software and strategy to manage and analyse customer interactions throughout their lifecycle.View full definition → (Customer Relationship ManagementCustomer Relationship ManagementCustomer Relationship Management: software and strategy to manage and analyse customer interactions throughout their lifecycle.View full definition →, your customer databasecustomer databaseCustomer Relationship Management: software and strategy to manage and analyse customer interactions throughout their lifecycle.View full definition →) are joined. If a clienteling dashboard shows "Sofia tried on 4 dresses, bought 1," that join exists and triggers full personal-data obligations. Confirm shoppers were told, ideally at loyalty signup, that in-store behavior may be recorded.
Knowledge check
1. Why does a body-scan sizing service face a higher consent bar than a loyalty app collecting purchase history under GDPR?
2. A fashion brand argues it can process a shopper's purchase history to send personalized restock alerts without asking for consent. Which GDPR concept best supports this?
3. What is the fundamental structural difference between GDPR and CCPA/CPRA that shapes how a retailer designs data collection?
4. Select ALL correct answers about how the three frameworks treat consent and data rights.
Select all the correct answers.
5. Select ALL correct answers describing why a torso scan for jean sizing is legally different from 'just measurements.'
Select all the correct answers.
Individual checks are not enough. You need repeatable governance.
A Data Protection Impact Assessment (DPIA) is a structured review you run before launching high-risk processing. GDPR requires one for large-scale biometric or behavioral tracking. Body-scan sizing and RFID clienteling both qualify.
A DPIA answers: what data, what risk, what safeguards, is it proportionate? Document it. If a regulator asks why you launched a body scanner, the DPIA is your defense.
Most fashion data risk lives with vendors: the fit-tech startup, the loyalty platform, the ad network. Under GDPR these are data processors, and you (the brand) are the data controller and stay legally responsible for their behavior. You need a Data Processing Agreement (DPA) with each, spelling out security, retention, and deletion.
A practical annual checklist:
A US brand rolls out body scanners in 50 Illinois stores. It stores identifying scans without written consent. Suppose 20,000 shoppers scan in year one.
Under BIPA, negligent violations are commonly cited at 1,000 dollars each (this is an illustrative figure from the statute, not a prediction of any settlement):
20,000 x 1,000 = 20,000,000 dollars of theoretical exposure.
The fix costs almost nothing: a written consent screen and a 30-day auto-delete policy. Governance is cheap. Litigation is not.