“The object which triggered privacy alarms at Walmart is not a camera, not a microphone, and not a scanner. It is a location tracker.”
Consumers have been noticing the presence of a small, box-like device attached to the underframe of some shopping carts at Walmart, then sharing videos of the device that ricocheted around TikTok. The videos did what all modern retail mystery stories do: they left blanks to be filled in by the viewer. Some people thought it might be “tracking everything you put in your cart,” while others proposed wheel-locking technology or other forms of store surveillance. However, the device in question has been found to be a LoRaWAN GPS tracker, the sort used to tell a store where the cart is, not what is in it.
This is important, but it does not necessarily resolve the anxiety. In 2026, consumers have learned to interpret “it only tracks location” as an unfinished thought. The route of a cart through a store may be telling, even if it never scans a barcode. And if a merchant fails to say what a device is used for, the consumer will assume it is for what they fear most: invisible profiling.
The easiest reason to justify adding trackers is also the least sensational: carts get lost. Cart drift, or the phenomenon of carts showing up blocks away, in parking lots, on sidewalks, and in waterways, has long been a problem for retailers. One company that specializes in theft prevention has estimated that nearly 2 million carts are stolen annually in the U.S., resulting in $175 million in replacement and repair costs, which helps to explain why a company might be interested in having more visibility into a particular set of rolling metal objects.
The GPS-style tracking is designed for this purpose. GPS is an “active” method, meaning it is designed for more continuous location awareness, as opposed to RFID, where a tag is usually detected only as it passes by a reader. In other words, RFID is for controlled checkpoints, while GPS is for assets that roam. Precision of GPS tracking is often mentioned as reaching a 7-meter diameter in optimal conditions, which is sufficient to distinguish “behind the store” from “three streets over.” This is cart recovery logic, not purchase logic.
Nevertheless, a cart tracker found itself in a cultural moment in which consumers are ready to make connections between mundane hardware and larger data behaviors. In a series of online rumors in late 2025, it was asserted that Walmart was capable of tracing an in-store cash transaction back to a person without what would seem to be obvious identifiers; a spokesperson for the company provided a more straightforward explanation: Today, the most likely explanation for an email following a cash transaction is that the customer was asked at checkout to enter their phone number and opt in to link the transaction to a Walmart account that shared that phone number.
The list of information that Walmart could collect, as stated in its privacy policy, is very broad and includes “purchase and transaction history information” and other types like biometric information. The cart tracker does not have to access any of this information in order to function. However, the public does not typically assess devices alone but rather systems.
For consumers, the bottom line is not whether the box “reads the cart.” It is if the retailer can clearly articulate what kind of information the system generates, how long it is retained, and whether it is ever connected to a specific consumer. Until this gap is filled, a tracker designed to locate missing carts will simply continue to be seen as something else entirely, a sign of how far retail has migrated from shelves to servers.
