AI Shoplifting Detection for a Small Shop: What It Sees and the Law

It can work, but the evidence is vendor claims, not independent tests, and it pays only if your stocktake shows real theft. Prices are quoted, not published; local news reports on one well-known vendor put it at about $200 a month per store. Privacy law applies: signs, a stated purpose, limited storage, no audio and a person deciding every alert.

Two numbers decide it. The first is what you really lose: your stocktake gap valued at cost, and how much of that gap is theft. The second is the share of alerts that are real. Software that flags a gesture cannot know whether the item was paid for or the bag is the customer's, so every alert needs a person and a policy for what that person does. I use a pet shop and a garden centre as examples, with made-up quotes.

Follow me on Instagram@sagnikteaches

Gesture alerts and the context a camera cannot see

Small-shop tools in this category tend to work in one of three ways. The first is gesture detection on the cameras you already own. Veesion is one example: its site says the software analyses your existing cameras with no extra hardware, watches for gestures and concealment linked to theft (think of an item going into a bag, a pocket or under a coat), sends staff a short video alert on a phone to check, and uses no facial recognition. The second is analytics tied to tills or self-checkout lanes, which compares what the camera sees with what was scanned; that suits bigger stores. The third is face matching against a list of people a shop or group of shops has flagged, which carries the heaviest legal burden and is covered further down.

Connect on LinkedInSagnik Bhattacharya

What these tools see is movement, hands and objects. What they cannot see is context: whether the customer scanned the item earlier, whether the bag is their own, whether the person is a colleague restocking, or a parent holding a toy while a child wanders off. They also depend on the picture itself: camera angle, lighting, resolution, crowding and shelves that block the view. Some reviews of these tools mention a tuning period for each store before alert quality settles. Vendor pages lean on testimonials and headline results rather than published error rates, and I found no independent false-positive figures for any of them, so treat every claim as something you will test, not a fact.

Subscribe on YouTube@sagnikteaches

And they cannot see losses that happen elsewhere: delivery shortfalls, till errors, damage and anything a member of staff takes. In some shops those make up much of the stocktake gap. Yours may differ, and finding out is the first job.

Do the loss sums before you ask for a quote

Your stocktake gap is the difference between what your system says you should hold and what you count, valued at cost. Split it as honestly as you can into theft, errors (miscounts, wrong deliveries, mis-rings) and damage or expiry. Then the test is one line: break-even share equals the monthly cost of the system divided by monthly theft at cost. It tells you what share of theft the system must stop just to pay for itself.

All the figures in that table are invented for illustration, including the quotes. Reading it: the pet shop cannot win on theft alone, even if the system stopped every incident, so its money is better spent on layout and habits. The garden centre has to stop 38% of its theft before it breaks even, and that depends entirely on how many alerts are real and acted on in time. The cut-offs I use: above 50%, skip it; between 20% and 50%, run a trial; below 20%, the case is strong. They reflect my judgement; no industry body publishes such a rule.

Detection is also not prevention. An alert only saves stock if someone sees it and acts while the customer is still in the shop. A clip reviewed the next morning is evidence, which has some value, but it is not the saving the brochure describes.

What it costs beyond the subscription

The subscription is the line vendors quote, and the only public figures I found are anecdotal. Local TV news stories about Veesion, one of them from March 2024, put it at about $200 a month, "a couple hundred dollars", for a single store, while its own site lists no prices, only demo requests. So treat $200 as an old, second-hand figure to test a quote against, not as a price, and ask for references you can phone yourself. The other lines are what turn a modest fee into a real cost, so ask about each before you compare quotes.

One general-purpose check before you sign anything: five checks before buying AI software for a retail store applies to this category as much as any other, and convenience store AI cameras: cost and the privacy checks first covers the camera side from a neighbouring sector.

The false-alarm problem, in numbers

Suppose the garden centre runs a four-week trial and logs every alert with an outcome code: C for confirmed theft in progress, P for a paid item or the customer's own, S for staff or stock handling, and U for unclear. The log reads like this (illustrative).

Precision, meaning confirmed theft divided by all alerts, is 7%. Say staff stopped 14 of the 21 incidents in time, recovering stock worth about $350 at cost. Against an all-in cost of $600 for the month, the trial fails on its own numbers. That is not a verdict on any vendor, because tuning might halve the false alerts, and your shop may do better. It is the reason to measure before signing a year-long contract.

The people side matters more than the money. Every one of the 150 paid-item alerts is a customer who might have been approached wrongly. A policy for staff, which I would print on a card by the till, keeps that from going badly:

1. Look at the clip. If the item looks unpaid and the person is still in the shop, go over and offer help, such as "Are you finding everything? Shall I take that to the till for you?"
2. Do not touch, block or search anyone, and never say the word theft.
3. If you remain concerned, tell a colleague, note what you saw and follow your policy. Ask your insurer and a solicitor what your staff may and may not do before you write that policy.
4. Log the outcome code and the minutes spent, every time, including the innocent ones.

Check who gets approached, too. If the log shows alerts landing disproportionately on a type of customer, the pattern is the problem, and that is a reason to stop, not to tune.

Signs, notices and storage: what the privacy rules ask

This is general information, not legal advice. I name two laws because the title asks, and other places have their own, so ask a solicitor or a data-protection adviser which apply where you trade and where your customers live. My own tutorial on GDPR and AI tools: what a small business must do covers the wider picture.

UK GDPR: the list a small shop can follow

• Write down the purpose, such as preventing and detecting theft and keeping staff safe, and do not use the footage for anything else without a fresh assessment.
• Do a short legitimate-interests check: is the purpose real, is a camera necessary or would something less intrusive work, and do customers' rights outweigh your interest in the places you film? No cameras in fitting rooms or toilets.
• Put clear signs at entrances and inside, saying who runs the system, why and how to contact you. I would add "and analysed by software", because that is a different use from plain recording.
• Set a storage period you can justify and write it down. The law gives no fixed number, and around a month is common practice, not a rule.
• Switch audio recording off. Recording conversations is far more intrusive than recording pictures.
• Be ready for access requests. People can ask for footage of themselves, you generally have a month to answer, and you must be able to find, export and protect other people's images in the clip.
• Tell your staff what is recorded and why. They are covered by the same rules.
• Treat the vendor as a processor acting for you: a written contract, plus answers on where footage is processed and kept, whether the vendor's staff view clips, whether it uses your footage to improve its models and which other firms handle it.
• Do a data protection impact assessment, a written risk check, before you switch on analytics that profile behaviour. Ask your adviser whether yours is mandatory; for face matching, assume it is. A worked example of the format is in an AI DPIA template for a receptionist.
• Keep a person making the decision. There are specific rules about significant decisions taken only by software, and banning someone from your shop on an alert alone sits close to them.

The CCPA angle

The CCPA applies to a for-profit business that meets at least one of three tests: annual gross revenue of $26.625 million or more in the previous calendar year (the regulator's inflation-adjusted figure since January 2025, so check the current one); buying, selling or sharing the personal information of 100,000 or more consumers or households; or earning half its revenue or more from selling or sharing personal information. A small shop usually meets none of them, so the CCPA often will not bind it, but confirm that with an adviser rather than assuming.

If it does apply, you need a notice at collection where you gather personal information, and in a shop a sign pointing to your online privacy notice is one accepted way to give it. Biometric information used to identify a person counts as sensitive personal information, with extra rights attached. Separately, some places have dedicated biometric laws, and some of those set no minimum business size.

Face matching and shared watchlists: why I would start elsewhere

Face matching turns a camera feed into biometric data. Under the GDPR family of laws that is a special category needing a stricter legal basis, and the practical risk is misidentification: a wrong match can put an innocent person on a list that other shops see. If a vendor shares alerts or images between shops, treat the decision as far bigger than buying a camera feature. Ask for the vendor's own risk assessment, how someone gets removed from a list, and who is liable for a wrong match. For a small shop, I would spend on the basics first and leave this category alone unless an adviser has looked at your specific case.

The cheaper layer: staff habits, layout and your own till data

Many losses are cured by habits a camera cannot supply:

• Greet every customer within a few seconds of the door opening. Being noticed deters, and costs nothing.
• Keep the lines you lose most behind the counter or in a locked case, and keep them off the shelves nearest the door.
• Check sightlines from the till: low shelving, a mirror on blind corners, the door in view.
• Count the 20 lines with the biggest gaps every week, rather than the whole shop once a year.
• Check every delivery against the invoice before the driver leaves.
• Split till duties, so the person who rings refunds does not also count the cash.

AI helps with your own data here. Export a month of voids, refunds and discounts from your till with each staff member replaced by a code, and ask for patterns:

Below is one month of till exceptions (voids, refunds, discounts), with each staff member replaced by a code (S1 to S6), and the shop's opening hours.
For each exception type, show the count per code and per hour of day. Flag anything more than twice the average of the other codes, and say how many entries each flag rests on.
Do not suggest that anyone has done anything wrong. List the innocent explanations I should check first (rota, training, till position, delivery days).
Data: [paste]

A typical output (illustrative): "Voids: S3 made 38 of 71 (54%); the others made 5 to 9 each, mostly on Saturday mornings. Refunds: no flag. Discounts over 20%: S5 made 7 of 11. Innocent explanations: S3 opens on Saturdays and handles the returns trolley; S5 trains new starters, who ask for manager discounts." Two corrections before you act on it: the flag rests on a single month, and the model may add a line such as "possible void abuse", which I would delete. A pattern is a prompt to ask a question, not evidence. Keep the export out of any chat tool whose training switch is on, because staff records are personal data too. The stock side of the same idea is in how small shops can use AI to forecast stock and reorder.

Questions to put to a vendor before a trial

• Which camera makes, resolutions and frame rates work, and what happens if some of mine do not?
• Is video processed on-site or in the cloud, where is it stored and for how long?
• Can your staff view my clips? Is any review done by people?
• Do you use my footage to train or improve your models, and can the contract say you will not?
• Which other firms handle the data, and will you sign a data processing agreement?
• Does anything, such as alerts, images or profiles, get shared between customers' shops?
• How is "detection rate" defined and measured, and on whose footage? What is the false-alert rate per camera per day in a shop of my size?
• Can I phone a shop like mine, not just read a testimonial?
• What are the trial length, what is measured, what does it cost and how do I leave?
• How do I export a clip and blur other people in it for an access request?
• What happens to my footage and settings when I cancel?
• Will you help with the impact assessment?

A four-week trial, with stop rules written first

Before the trial starts, record your baseline: last month's stocktake gap and the weekly count of your top 20 lines. During it, log every alert with an outcome code and the minutes spent. At the end, work out precision, stock stopped in time, all-in cost and any wrongful approaches. Agree the stop rules with whoever signs the contract before the first alert arrives, so the decision rests on the log rather than on how the sales call went.

The thresholds are mine, so adjust them to your margins. The structure is the point: one month, one log, rules fixed in advance.

Sign wording and a storage note to adapt

AI is good at first drafts of these, and a solicitor or adviser should check the final wording. A sign (use your own business name and contact details):

CCTV IN OPERATION
We record and analyse video in this shop to prevent and detect theft and to keep staff and customers safe.
Operated by [business name]. Questions or requests about your images: [contact details].
More information: [where your privacy notice can be found]

And a one-page storage note to keep on file:

CCTV and analytics note (adapt and have it checked)
Purpose: preventing and detecting theft; staff and customer safety.
Cameras: [number and areas]. None in changing rooms or toilets. Audio is off.
Analytics: software flags possible theft; a staff member reviews every alert before anyone acts.
Storage: footage kept [30] days unless needed for an incident, then deleted automatically.
Access: [named roles] only. Requests for footage go to [name] and are answered within one month.
Vendor: [name]; contract and processing terms reviewed on [date].
Review: this note is reviewed every [12] months.

Keep a short log of any time footage is shared with the police or anyone else: date, who asked, what was handed over and why. If the break-even sums or the trial say no, none of this was wasted, because the signs, storage note and alert policy improve an ordinary CCTV system as well.

Questions shop owners ask about AI theft detection

Does AI shoplifting detection need new cameras?

Some tools are described as running on the cameras you already have, through a box or cloud service connected to them. Others want specific resolution or frame rates. Ask for a written list of compatible cameras and what happens if yours are not on it, because replacing cameras can cost more than the subscription.

Can I post a clip online to name a shoplifter?

Not without taking advice first. Publishing footage of identifiable people can breach data-protection rules, and a wrong identification can lead to a defamation claim. Pass clips to the police instead, keep a log of what you handed over and when, and let them decide what happens next.

Is a consumer camera with person detection the same thing?

No. Person or motion detection tells you someone moved, not that anything was taken. Check the provider's terms for business use, where footage is stored and whether its staff can view it, and apply the same signs, purpose and storage rules you would to any CCTV system.

Is an AI alert enough as evidence?

An alert is a flag from software, not proof. What matters is the original clip with an accurate timestamp, so check the system's clock and export clips in their original format when you pass them on. Keep the outcome log too, because it shows how often alerts turned out to be wrong.

Further reads

• AI Footfall Cameras for a Retail Store: What They Count and Privacy — Counting visitors without watching individuals.
• What AI Costs a Small Retail Shop in Its First Year — What AI costs a small shop across its first year.
• How to Set Up Human Review for AI Work Without Slowing Down — Building a review step that does not slow the work.
• Retail AI Consultant: Hire-or-Not Checklist for a Small Shop — Whether to hire help for a retail AI project.
• AI Tools and AI Development: The Complete 2026 Guide — the AI hub, including every tutorial in the AI-for-business series.

Sources: vendors' own sites, including Veesion's, none of which publishes a price (checked October 2026); local TV news reports on AI shoplifting detection, including one station's editor's note; the CCPA regulator's FAQ on business thresholds and sensitive personal information; the CCPA regulations on giving notice at collection offline; general data-protection principles for CCTV. Not legal advice.