Met Police's rogue shoplifting app use exposed 179 people's data

London's Metropolitan Police unlawfully uploaded personal data on 179 people, including three children, to retail crime platform Auror, the UK's data watchdog has found. The Information Commissioner's Office (ICO) issued a reprimand and an enforcement notice after discovering that officers registered around 500 free accounts on the platform between March 2023 and September 2024 without the force's formal approval or required data protection checks. For 128 people, the data consisted of names alone; for 49, names and dates of birth; and for two, names, dates of birth, and home addresses.

Auror is a New Zealand-founded platform that lets retailers share incident reports, images, and CCTV footage with police. Retailers pay for access, while police partners use it free. Supermarkets and other stores encouraged Met officers to sign up, directing them to the platform to view CCTV evidence. But the force never completed a data protection impact assessment (DPIA) or established formal data-sharing agreements with Auror Europe, the ICO said. The lack of governance meant the uploads were unlawful, and the regulator described the oversight failures as ongoing.

The problems surfaced through internal security reports in August and September 2024. One flagged officers uploading names of suspects they recognized from CCTV footage; another noted officers collecting CCTV footage from the platform without checks. Access was blocked on September 26, 2024. The Met's data protection officer only informed the ICO in December 2024, during a discussion about a separate matter, prompting a formal probe in April 2025.

The ICO's findings paint a picture of systemic governance gaps. The force relied on 'soft controls' such as policy reminders and staff training to prevent use of unapproved software, rather than technical blocks. Officers used Auror for more than 18 months without triggering any alert, and the regulator said the force failed to test whether its web controls worked. The ICO also pointed to a repeat failure: officers used Clearview AI in 2021 without proper oversight. Because the Met has not demonstrated that its safeguards can prevent similar incidents, the ICO considers the failures ongoing.

The enforcement notice compels the Met to strengthen safeguards against improper use of third-party tools and provide periodic progress updates to the ICO. David Doodson, head of investigations at the ICO, said the action should send a message across the policing sector and beyond: 'If you are using new technology to process people's information you must do so lawfully, transparently and with appropriate governance from the outset.' He added that the ICO's role is not only to hold organizations to account but to drive improvements.

The Met accepted the findings. A spokesperson said officers were using the platform 'in good faith to identify and arrest shoplifters' but acknowledged the force had not completed the relevant security and data protection work. After suspending access and carrying out a full review, the Met completed the necessary legal, security, commercial, and data protection checks. The platform is now used in 14 London boroughs following formal approval and a pilot, and the force says it has quadrupled positive outcomes for shoplifting. In an August 2026 announcement, the Met said the tech, which it did not identify by name, would be rolled out beyond those boroughs and was already deployed in stores such as Tesco, Boots, Greggs, and M&S. Shoplifting reports via the platform result in a positive outcome in 29.4 percent of cases.

The reprimand follows a separate ICO rebuke in August concerning two sensitive cases. In one, a Met officer sent unredacted legal documents to the subject of a stalking protection order, exposing the victim's new home address and contact details. In the other, an officer committed the cardinal CC-not-BCC sin, exposing the email addresses of 18 people linked to Parliament who were targeted in a honeytrap sting. These incidents, taken together, suggest a pattern of data-handling failures within the force.

For executives and boards, the Met's experience is a cautionary tale about shadow IT. When employees adopt third-party tools without formal procurement, data protection impact assessments, or technical controls, the organization bears the regulatory risk. The ICO's enforcement notice requires the Met to prove its safeguards work, not just promise them. Any company processing personal data should audit which platforms employees are actually using, test whether technical blocks are functioning, and ensure data-sharing agreements exist before the regulator comes knocking.