The Checkout Handshake: Auditing Pay-by-Palm Before You Enrol

Paying for a meal deal used to involve a card, a PIN and maybe a muttered apology to the queue. Now some UK tills want your hand. Palm-vein and fingerprint payment systems are turning up in shops, stadiums, staff canteens and membership venues, all promising a quicker checkout if you let a scanner read the pattern under your skin. It sounds convenient. It also turns a body part into a reusable identifier, which is a bigger deal than tapping a debit card.

The hand is the new card

Biometric payment is not one product. A fingerprint terminal reads the ridges and valleys on a fingertip. A palm-vein scanner uses near-infrared light to map the veins inside your hand. Some systems combine vein patterns with hand geometry. The sales pitch is speed and fewer lost cards, but the trade is familiar: you provide a unique physical characteristic, and a machine turns it into something that can be matched again and again.

That matching is the point. The terminal is not really checking that you are you in some philosophical sense. It is checking that the template it has just created is close enough to a stored template to authorise a payment token. In 2026, that token might sit alongside your bank card in a wallet, or it might be managed by the biometric provider. Either way, the checkout is no longer just asking for a card. It is asking for a reusable key.

What the terminal actually captures

A pay-by-palm terminal typically captures a vein pattern and converts it into a mathematical template. A fingerprint reader captures minutiae points — the small details where ridges end or split. Good systems do not store a glossy photograph of your hand for later use. They store a template, which is meant to be a one-way representation. That is reassuring up to a point, but a template is still personal data when it can be linked to you, and biometric data used for unique identification is special category data under UK GDPR.

The terminal may also log the time, the till, the store and the payment reference. Those transactional details can build a trail even if the biometric template itself is encrypted. Ask yourself what the system learns: that a hand was present, that a payment succeeded, and possibly that the same hand has paid here before. That is more than a contactless tap reveals.

Where the template lives

This is the question most checkout signs do not answer. In many setups, the merchant’s till is not the place where the template is kept. The terminal passes an encrypted sample or identifier to a biometric provider, which performs the match and releases a payment instruction. The template may sit in the provider’s cloud, in a merchant’s identity system, or in a combination of both. The shop may be the data controller, the biometric firm may be a processor, or the roles may be split.

That matters because ‘the shop has it’ and ‘a company you have never heard of has it’ lead to different questions. If the template is held by a provider, can it be used across other retailers? Can it be linked to a loyalty account? What happens if the provider is sold or breached? A terminal that says ‘pay by palm’ is not a privacy notice. Look for the notice, the provider name and the retention period before you wave.

Your UK GDPR leverage

Biometric data used to identify you is special category data. Processing it generally needs explicit consent or another specific condition under UK GDPR and the Data Protection Act 2018. For a shop, consent should be freely given, specific, informed and easy to withdraw. If biometric payment is the only way to pay, that consent is on shaky ground — a point worth making politely at the counter.

You have rights. You can ask for access to your data, ask for a copy of the template in a portable format where it applies, ask for rectification, ask for restriction, object to processing, and withdraw consent. You can also ask for erasure. That last one should mean deletion of the biometric template, not just closure of a payment account. A request that says ‘delete my palm template and confirm in writing’ is clearer than ‘cancel my account’. If the response is vague, you can complain to the Information Commissioner’s Office.

How to audit before you enrol

Treat enrolment like signing a contract you cannot read at a glance. First, identify the data controller and the biometric provider. Second, ask whether the template is used only for payment or also for age checks, loss prevention or entry to venues. Third, ask how long the template is kept after you stop using the service. Fourth, ask whether it can be shared across brands or linked to a loyalty profile. Fifth, ask what alternative payment methods exist and whether refusing biometrics affects your access.

If you are already enrolled, send a subject access request and an erasure request to the organisation named in the privacy notice. Keep screenshots of the enrolment screen and any receipt. If a staff member tells you the system is ‘just like a fingerprint on a phone’, ask them to put the provider’s name and retention policy in writing. That is not being difficult. It is the checkout equivalent of reading the terms before you tick the box.

How to refuse without losing the checkout

You can say no. Use a card, phone or cash where accepted. If a venue insists that biometric payment is mandatory, ask for its written policy and whether an alternative is available on request. Some venues may be effectively cashless, but that does not automatically make biometric enrolment compulsory. If you feel pressured, step aside from the queue and ask for a manager. A queue is not a consent mechanism.

If you want to keep the convenience but limit the trail, ask whether the template can be deleted after each visit — most systems cannot do this, but the answer tells you how the service is designed. Avoid enrolling with a provider that will not name its retention period. And if you change your mind, withdraw consent in writing rather than simply stopping using the terminal.

Questions to ask at the till

Who is the data controller? Which company stores my biometric template? Is it deleted when I stop using the service? Can it be used in other shops or venues? Is it linked to my payment history or loyalty account? What happens if there is a breach? Can I withdraw consent today and get confirmation? These are ordinary consumer questions, not technical ones. A provider that cannot answer them at a checkout has not thought hard enough about the hand it is asking for.

Biometric payment may well become ordinary. That does not make it neutral. The sensible approach is to treat your palm or fingerprint as a reusable ID, not a party trick, and to audit the trail before you enrol. Convenience is fine. A permanent identifier deserves a proper look first.