Happy Bar & Grill biometric surveillance tool development

Happy Bar & Grill, a Bulgarian restaurant chain, faced public backlash surrounding the discovery of a vendor product page for an AI facial recognition system which had been developed by IP Biometrix, that biometrically profiles customers and had been designed for use in Happy Bar & Grill restaurants. The system appeared to have the capabilities to track physical attributes, infer ethnicity categories, and analyse emotional states of customers, as well as monitor the amount of time employees spent smiling.^[1] Happy, the parent company of Happy Bar & Grill, later acknowledged considering procurement of the system in late 2023 before rejecting it on 14 December 2023, and asserted that the system was never deployed in any of their restaurants.^[2]

Happy Bar & Grill is a Bulgarian restaurant chain operating multiple locations across Bulgaria, Romania, Spain, and the United Kingdom.^[3] IP Biometrix's public portfolio previously listed the chain as a customer and detailed its system, including data seemingly taken from a restaurant, though whether this represents live deployment or the use of prerecorded training data is unknown.^[1] This was found by a Consumer Rights Wiki user around 4 March 2026. According to an official statement released on 12 March 2026, the chain received an offer for an AI-powered facial recognition system from Bulgarian security vendor IP Biometrix in 2023. The company stated the system was assessed between September and December 2023^[4] before being officially rejected on 14 December 2023.^[5]

IP Biometrix's portfolio page describes the system processing both employees and customers. A sample image shows multiple individuals labelled as "Subject 6053," "6054," and "6055" with extensive biometric attributes tracked. Displayed percentages (e.g., ethnicity scores) appear to represent AI confidence levels regarding specific selected individuals, rather than aggregate counts of demographics within the venue.^[1] Tracked attributes include:

• Physical features: glasses, dark glasses, beard, moustache, blink, mouth open, mask presence, "face quality"
• Ethnicity classifications: white, black, Asian, Hispanic, Indian, Arabian
• Emotional states: neutral, anger, contempt, disgust, fear, and others

IP Biometrix's portfolio page was captured by the Internet Archive on 2 January 2026. Demonstration images within the portfolio contain file names dated to at least 9 November 2024 (e.g., "Screenshot-2024-11-09-120029.png"), however the images may have been prepared at an earlier time.^[1]

Patrons entering Happy Bar & Grill received no visible signage at entrances or within dining areas informing them that their facial biometrics were being captured, analysed, or stored during the testing period.^[6] Happy's published privacy policy makes no mention of facial recognition, biometric processing, or AI surveillance systems in restaurants.^[7] This is consistent with their representation that the system has never been deployed.

Under the EU General Data Protection Regulation (GDPR), facial recognition constitutes processing of biometric data — a "special category" of personal data requiring explicit consent or another narrow legal basis under Article 9.^[8] Inferring ethnicity and emotional states triggers additional restrictions as these reveal "racial or ethnic origin" and constitute sensitive psychological profiling. The absence of transparent notice before data collection violates GDPR Articles 13–14, while processing customers' biometrics for staff performance monitoring lacks a proportionate legal basis under Articles 6 and 9.^[8] Under Bulgarian national guidance, the Commission for Personal Data Protection (CPDP) has stated that processing biometric data in shops and restaurants for the purpose of analyzing customer behavior, gender, or age cannot be based on "legitimate interest." The CPDP emphasizes that placing information signs is insufficient to achieve "explicit consent."^[9]

On 12 March 2026, Happy Bar & Grill filed an abuse complaint against Consumer Rights Wiki's web host provider, attempting to pull down the website. Some have criticized the decision, believing that the controversy could create more publicity over their business practises.^[10]

On 12 March 2026, Happy Bar & Grill issued an official statement addressing the allegations. The company categorically denied current use of the system, stating that no such software or technology is currently used in Happy restaurants. They acknowledged receiving an offer from GI Mobility Services (linked to IP Biometrix) in 2023 and confirmed testing occurred between September and December 2023. The company stated they officially rejected the proposal on 14 December 2023, stating that the solution was unnecessary for their operations.^[5]

Happy contacted the administrators and hosting provider of the Consumer Rights Wiki, requesting a complete removal and retraction of the article.^[2][10] The article initially stated that evidence supported that widespread implementation of the system had occurred, however this has since been changed. IP Biometrix removed the portfolio page showcasing the Happy Bar & Grill implementation during a site renovation prior to March 2026. The content is now preserved through the Internet Archive's Wayback Machine capture from 2 January 2026.^[1]

Consumer awareness of the surveillance system gained traction on 11 March 2026, following a post on the sub-Reddit r/bulgaria,^[11] and the publication of a number of news articles.^[2][5][12] Much of the community response reflects the initial statements by this article that widespread deployment of the system had occurred.

Additional concerns have been raised following scrutiny of IP Biometrix's other projects, including camera systems at the University of National and World Economy (UNWE) which shared the implementation on their Instagram account,^[13] and their list of partners, which was removed from their website.^[6]