Is a virtual try-on app on your Shopify store a biometric categorisation system?

What is a biometric categorisation system under the AI Act?

The Regulation defines the term itself, and writes the exception into the same sentence — both halves decide what your product page owes.

Article 3(34) is why a try-on raises the question: it defines biometric data as personal data from specific technical processing of a person's characteristics, naming facial images as an example.

Reading the neighbouring definitions together removes a common defence: Article 3(35) and Article 3(36) both turn on a comparison — identification against a database, verification against previously provided data — while Article 3(40) asks for neither. The Commission's guidelines on prohibited practices say the same, quoting a description of categorisation as not about identifying an individual and adding in their own voice that persons may be categorised for statistical reasons without being identified at all. Identifying nobody does not settle the question.

Does the Article 3(40) carve-out cover a virtual try-on?

The exception sits inside the definition, and its two tests are joined by and: a fitting feature lands there only when it satisfies each one, and reading them as a single test makes the carve-out wider than the law.

Recital 16 says filters categorising facial or body features used on online marketplaces could constitute such an ancillary feature, because they can be used only in relation to the principal service — selling a product by letting the consumer preview it on themselves. Could, not does.

None of the EU pages we read on August 29, 2026 — the Regulation's full text, the Commission's guidelines on prohibited practices, and its FAQ on Article 50 — uses the words virtual try-on. You match your feature against that description, not against a list.

When does a try-on cross the line, and what do you owe then?

The line runs through the conditions themselves: a feature that assigns a shopper to a category for anything beyond fitting the product to them stops being used only in relation to the principal service.

The Commission's examples carry a scope: the permitted marketplace filter and the prohibited inference of political views or sexual orientation from photographs belong to the Article 5(1)(g) prohibition, not to the Article 50(3) transparency duty. What we take from them is how the line is drawn; applying it to a storefront feature that sorts people is our reading, not the text of the rule.

The second sentence of Article 50(3) exempts only law-enforcement systems, which is not a route open to a store, and Article 50 applies from 2 August 2026. Article 3(39), emotion recognition, carries no carve-out at all, so a mood-reading feature owes the same Article 50(3) notice.

Which of you owes that notice — you as deployer, the app's maker as provider — is the one question this page does not answer; our guide to the AI Act's disclosure duties does.

What to ask your try-on vendor before you decide

Both conditions describe processing you cannot see from the storefront, so the vendor answers them, not you. Ask in writing, so the answer becomes a record you can show.

If the try-on your shopper sees is a Shop Mini, the vendor may not be your app developer: Shopify documents Shop Minis as experiences built by Shopify or Shopify Partners, available only on the Shop app. Shopify says you cannot choose which products display in a Shop Mini, and cannot opt your products out of displaying in them.

• Does the feature assign the shopper to a category — face shape, skin tone, body type — or only place the product on an image?
• Is that categorisation used for anything beyond showing this product to this shopper?
• Could the feature work without the categorisation step, and if not, what makes it technically necessary?
• Where do the images go, how long are they kept, and under whose privacy policy? Shopify's API Terms class biometric data that can uniquely identify a person as Sensitive Personal Information.
• Under Article 50(3), which of us do you treat as the deployer and which as the provider?

Neither Shopify page we read on August 29, 2026 — the App Store requirements and the API Terms — sets rules for how a try-on app handles face images, so the vendor's written answer is your record.