When shoppers encounter a beauty try-on prompt asking for camera access, a meaningful percentage say no. That isn't irrationality — it reflects genuine uncertainty about what happens to face data once it leaves the device. For brands deploying AR try-on, this isn't just a privacy compliance question. It's a product design problem that directly affects how many shoppers actually use the feature.
What Shoppers Actually Worry About
Consumer surveys on biometric data consistently surface the same concerns. Shoppers are not primarily worried about their lipstick shade preference being stored somewhere. They're worried about facial geometry data — the structural map of their face — being retained, sold, or used in ways they didn't consent to. That worry is shaped by a combination of real events (major data breaches involving facial recognition systems) and reasonable extrapolation from how other personal data has been handled by consumer-facing technology platforms.
A 2023 study on consumer attitudes toward AR features in retail found that 64% of respondents said they would be "unlikely or very unlikely" to use a try-on feature if they weren't sure whether their face data was stored by the retailer. The same study found that when shoppers were explicitly told that processing happened on-device only, willingness to use the feature increased by approximately 31 percentage points. The delta between those two states is the value of clear, accurate privacy communication.
For beauty brands, this isn't theoretical. A try-on feature that 40% of shoppers refuse to engage with because of privacy uncertainty is a significantly weaker conversion tool than one that 71% engage with because they understand what it does and doesn't do.
On-Device Processing: What It Actually Means
The phrase "on-device processing" gets used frequently in AR product marketing, sometimes accurately and sometimes not. It's worth being specific about what it means in Lumeglint's case and why it matters technically.
Lumeglint's AR engine runs in the browser using WebGL and on-device machine learning inference. When a shopper opens a try-on session, the following happens entirely within their browser on their device:
- The device camera stream is accessed by the browser — standard camera permission, no different from a video call app.
- A lightweight facial landmark detection model identifies 468 facial mesh points on each camera frame, running at up to 60 frames per second on current hardware.
- The Fitzpatrick skin-tone classifier reads a region of the detected face region and determines the appropriate rendering parameters for the current user.
- The shade is rendered onto the detected facial geometry using WebGL, and the composited result is displayed in the browser window.
- The camera frame, the facial geometry data, and the skin-tone classification are all discarded after rendering. None are written to local storage, none are sent to any server.
The brand's Lumeglint dashboard receives session analytics — session count, duration, shade selections, add-to-cart events — but these are behavioral metrics, not biometric data. The analytics pipeline is functionally identical to any other e-commerce event tracking. We receive the same type of data that Shopify Analytics or Google Analytics would receive: that a user performed an action on a page. We do not receive what the user looks like.
Why Server-Side Approaches Create Compliance Complexity
Not all AR try-on tools process on-device. Some earlier architectures — and some current vendor implementations — work by sending a camera frame or a captured selfie to a server where the shade rendering is performed, then returning the rendered image to the browser. This approach has some technical advantages in rendering fidelity on older hardware, but it creates real compliance complexity.
If a face image leaves the device, it becomes biometric data under the BIPA (Illinois Biometric Information Privacy Act), the Texas Capture or Use of Biometric Identifier Act, the Washington My Health MY Data Act, and the CCPA's sensitive personal information provisions, among others. These statutes have consent requirements, retention limits, and in the case of BIPA, a private right of action that has generated substantial litigation against companies in adjacent industries.
Beauty brands are not typically staffed to manage biometric data compliance programs. Most DTC brands don't have dedicated privacy counsel or a DPO. Choosing an AR tool that processes face data server-side essentially means the brand is taking on a compliance obligation that didn't exist before, for a feature that should be driving conversion rather than adding regulatory risk.
"Privacy-by-design was a decision we made before we wrote our first line of rendering code, not something we added afterward. The on-device constraint shaped the architecture from day one. It's also why our brands can honestly tell their shoppers: your face never leaves your phone."
— Camille Laurent, CEO & Co-Founder, Lumeglint
The on-device approach eliminates this compliance complexity because there's no biometric data in the brand's or Lumeglint's possession. A brand deploying Lumeglint can accurately and completely represent to its shoppers that no face data leaves their device — because it's true, not because of a retention policy that could be changed.
What Brands Should Communicate to Shoppers
Accurate privacy communication on the try-on feature itself drives engagement. We recommend that brands using Lumeglint include a short disclosure in the try-on modal, adjacent to the camera permission prompt. Something like:
"Your camera is used only to display the try-on effect on your screen. No images or facial data are stored or shared. Processing happens entirely on your device."
This language is accurate for Lumeglint's on-device architecture and takes approximately four seconds to read. In our early pilots, the presence of this disclosure adjacent to the camera permission prompt increased camera permission grant rates by a meaningful margin compared to sessions without it. Shoppers respond to explicit, honest language. They don't respond to privacy policy links that go nowhere useful.
Beyond the in-session disclosure, brands should also ensure their privacy policy accurately reflects the try-on data flow. The key language to include is that facial landmark detection runs on-device and no facial geometry or image data is transmitted to the brand or to third-party processors. Legal review is the brand's responsibility; we can provide technical documentation to support that process.
The CCPA and GDPR Angle for US DTC Brands
US DTC beauty brands primarily face CCPA compliance requirements for California customers, which represent a disproportionate share of US beauty ecommerce revenue given California's DTC market weight. CCPA's sensitive personal information category includes biometric data, and the 2023 CPRA amendments tightened the consent requirements for collecting and using it.
Because Lumeglint's on-device architecture means no biometric data is collected, CCPA's biometric data provisions don't apply to the try-on feature. The behavioral analytics (session events, shade selections) are processed under the standard analytics data flow, which is already handled by most brands' existing CCPA compliance programs covering tools like Klaviyo and Yotpo.
For brands with EU customers, GDPR Article 9 covers biometric data as a special category. The same logic applies: on-device processing means no biometric data is processed by the brand or Lumeglint, so Article 9's consent and processing requirements don't attach. The e-commerce behavioral data is processed under the brand's existing legitimate interest or consent basis for analytics, which is already established for their other tools.
Building Trust Through Honest Technical Communication
We've found that some brands hesitate to be specific about how their AR try-on works, either because they don't know the technical details of what their vendor does, or because they're worried that explaining it will make shoppers more nervous rather than less. In our experience, the opposite is true.
Shoppers who understand that processing is on-device and can verify that no data leaves their phone are more engaged users, not more anxious ones. The brands that communicate most clearly about their privacy approach see higher try-on engagement rates than brands that offer the feature without explanation. Transparency about privacy, done accurately, is a brand asset — particularly in the beauty category where personal trust is already a core purchase driver.
If you're evaluating AR try-on options and want to understand the technical architecture of any vendor you're considering, we're happy to provide documentation. The right question to ask any vendor is: "Where does facial landmark detection occur, and can you show me the data flow?" A clear answer to that question tells you most of what you need to know about your compliance exposure.
