Face-scanning tech

San Francisco bar patron refused service after speaking out against face-scanning tech

'If they have an issue with someone, they can retaliate'

By Lizzy Rager

Eric Norman felt annoyed that every time he went to his go-to bar in the Castro, the Mix, he’d have his photo taken and ID scanned. But he didn’t know then that his information was shared across a network of venues, beyond what he had assumed was a simple age verification check.  

“This is something way more than just verifying someone’s age and taking a photo. There’s a whole surveillance apparatus to this where they’re storing data and sharing data,” Norman said.

Patronscan Guard+ is an ID scanner, camera and monitor technology that resembles the scanners used in airport security. The Mix, Badlands and Toad Hall are now under scrutiny after a Gazetteer San Francisco article earlier this month reported they used the device. 

Controversy has swirled over the use of the devices, with advocacy group Fight for the Future issuing a warning for Pride weekend. “We advise San Franciscans avoid such bars until they remove the facial recognition technology to ensure safety for the queer and trans community, free from harmful surveillance,” the organization said Thursday.

The technology verifies IDs, and collects a person’s photo, full name, date of birth, gender and ZIP code, as well as the expiry date of an ID, according to Patronscan’s website. 

According to the company’s website, in California, that information is retained for 21 days, and it is deleted after that period — though bar regulars, like Norman, might continuously be in the system through repeat scans. 

“Patronscan limits the collection of information to only what we consider important to verify age, to avoid an inaccurate match to the known list, and for law enforcement investigations when a crime is committed,” Patronscan’s FAQ says. After a scan, the device might run an additional authentication check searching public addresses for a match with the ID.

Venues have the option to publicly or privately flag customers for reasons like being too violent or drunk, with maximum flag periods of one year for flags shared with other Patronscan venues and five years for private, or single-venue, flags. Private flags need no reason, but for public flags, Patronscan cites that California law only permits warnings about fraud, abuse and material misrepresentation to be shared across venues.

Organizers estimate that there will be around 1 million people coming into the city for Pride this weekend. Some community members have expressed alarm that the technology creates a “surveillance network” at a time when queer people are being targeted by the current presidential administration. Others raised concerns that the service essentially creates lists of queer and trans people who frequent the bars, which could be stolen or shared.

“Facial recognition technology and biometric surveillance have no place in the Castro,” Norman posted on June 17 on social media, after reading Gazetteer SF’s reporting. He called on the bars to stop using the technology, and for elected officials to institute a ban. 

Patronscan says it does not use facial recognition technology in North America, and that it never has. The photo captured at the door of venues is used to compare against the photo on the ID, and is deleted after 21 days, Patronscan said in a news release. Facial recognition technology is widely used across the country, especially in sports and entertainment venues, and works by comparing a recently captured photo with photos across public databases, according to the Center for Strategic and International Studies. Madison Square Garden, which has long used face-scanning tech, was exposed earlier this week for keeping a dossier on facial recognition technology activists.

Norman has been a patron of Mix for over 15 years, but when he tried to go back to the Mix the next day, he said, a bouncer told him that the bartenders refused to serve him. He posted about the encounter on social media that night.

“Management was not aware of these events when they occurred,” general manager Nick Kleazy said in statement. “The employee was not authorized to make admission decisions arising from a personal online dispute or to represent the business in that manner. Those actions were taken independently and without management’s knowledge or approval.”

He said management is not “in a position to dispute the patron’s account of what occurred,” but apologized for what occurred on behalf of the bar and said that the Mix is reviewing the circumstances internally and addressing the matter. He told SFGATE that Norman is welcome at the bar.

“It highlights one of my fears about the use of this technology. It’s not just a company that can misuse my data,” Norman told SFGATE in a phone interview. “Apparently employees and staff, if they have an issue with someone, they can retaliate, flag me in the system.”

Face scanners across the state

At least eight venues in San Francisco have devices and are subscribed to the “flag network,” according to Patronscan media spokesperson Rhiannon Mosoronchon. Patronscan refused to disclose the names of the bars. Norman went to Toad Hall, another venue that uses Patronscan, a few days later without issue, but contends that his sentiment that the technology is “ripe for abuse” remains.

Along with the sites in San Francisco, locations in West Hollywood, Sacramento and San Diego have been spotted using Patronscan devices. Roughly 30 bars in Sacramento used Patronscan in 2019, according to the Sacramento Bee, one of the largest known uses of Patronscan in the state.

The city of Sacramento began requiring some businesses with liquor licenses to obtain ID-scanner services before they could receive entertainment permits in 2016, and businesses began seeking out Patronscan contracts in turn. According to a 2018 daily public safety report by Patronscan, the company collected over 10,000 unique customer scans in a single day. And in the first five months of 2018, according to a Senate analysis, the company collected and retained information from 561,087 customers — when the population of Sacramento was 500,000.

The data included where customers live, how far they have traveled and how many different venues the customers visited. Patronscan no longer produces daily public safety reports to venues after a new law tightened restrictions on ID scanning. It still produces venue-specific reporting, according to Mosoronchon, including gender split percentage, average age (without date of birth), and ZIP codes that are local versus out of town. “Any additional demographic data is based on publicly accessible sources such as US census data,” she said.

Taking issue with his ID being scanned at a Sacramento bar, former assemblyman James Cooper authored Assembly Bill 2769, which was signed into law in 2018. It limited ID scanner companies’ ability to store data on California consumers. It also limited the ability of venues to hand out lifetime bans, which occurred with some regularity; the average ban time of Patronscan venues was 19 years, according to the public safety report. 

Owned by Ontario, Canada-based Servall Data Systems, Patronscan was also the subject of an Illinois lawsuit and a government investigation. The suit, Norman v. Servall Biometrics (the company’s former name; plaintiff Norman is no relation to the Eric Norman SFGATE interviewed), alleged that the company illegally captured, stored and shared facial geometry of patrons without clear, informed consent. The company denied the allegation, and Servall settled the suit in 2024 for an undisclosed amount, according to the Markup.

Who has your data?

A policy expert thinks Patronscan currently doesn’t comply with AB 2769.

“I do not understand how any person can scan someone’s ID, and then share any of that information with another bar and be following California’s rule,” Electronic Frontier Foundation senior policy analyst Joe Mullin told SFGATE by phone.

In light of increased ICE presence and deportations throughout the country, people are feeling extra vulnerable about having their data collected and potentially misused, Mullin said. He added that the technology could also have other kinds of privacy breaches, like a rogue employee with a crush using the software to look up a patron’s name.

“ID information can be used for harassment or stalking, and that’s why we have a law saying you’re not really supposed to keep lists of IDs,” Mullin said. 

Patronscan’s spokesperson said the company has never received requests from the Department of Homeland Security or other government agencies. Law enforcement requests, she said, must be sent through a portal requiring proof of authority and jurisdiction, and requests must be sent separately, to a specific venue or person in a set date range, and include proof of an active ongoing investigation including a specific case number and a formal protective order for long-term data retention requests. 

“We understand why people have concerns about technology and privacy; those are legitimate conversations worth having and we take our part in them seriously. But when inaccurate claims circulate without correction, it makes the conversation harder for everyone, including the small, independent venues that invest in tools like ours because they want their spaces to be safe,” Mosoronchon said in an email. 

A Fight for the Future petition went live last week, calling for the bars to stop using the technology. As of Thursday, the petition has garnered over 1,850 signatures. The digital rights group has also posted a national pledge for performers to boycott bars that use facial recognition technology, with support from San Francisco artists Tune-Yards and Boots Riley.

“My understanding of these technologies is that there’s often a huge mismatch between how they’re sold and then how they’re experienced, especially to the vulnerable in society,” Reem Suleiman, campaign director of Fight for the Future, said in a phone interview. “The queer and trans community has a target on its back under this administration, so it feels incredibly irresponsible to allow for any sort of biometric scanning or surveillance of the community.”

Tensions in the Castro

The Patronscan device has helped Mix prevent thefts, pickpocketing and fights, said Kleazy. The bar typically only uses the scanner on busy nights, he noted. He refused to disclose whether the bar would use the scanners over Pride weekend.

He added that staff are supportive of having the scanner there. “It is something we have installed to protect my employees and customers. And it has worked,” Kleazy said.

In March 2025, a patron that a bartender 86ed from the Mix attacked the bartender after his shift, Kleazy said. The bartender suffered significant fractures on his skull, and had to be hospitalized for months. Kleazy said this event was the “catalyst” for having the scanner at the bar. 

He said that he would be open to removing the device if evidence comes out that the company is negligently using data. 

A regular patron of the Mix, Scott Elliot, said he has “mixed emotions” about the practice. He said he recovered a stolen bike using the data stored by Patronscan, but disliked how the flag network allows patrons to be banned across different subscribed venues.

“We have all this data that we are just handing over constantly. I don’t think that we really have a place to say, well, they’re taking my photo at the door. Well, five license plate readers took your photo on the way there, cameras on the street took your photo on the way going in,” Elliott said.

The owner of Badlands and Toad Hall could not be reached for comment. SFGATE also reached out to San Francisco Pride, but the organization was unable to comment before publication time. 

“We have had concerns for years about any company that’s scanning and sharing IDs,” Mullin said. “We shouldn’t ignore the fact that there’s already privacy laws about our ID cards for good reason.”