When Is a Retailer Liable for Inadequate Security?
In the courts reviewed here, a retailer is liable for a third party’s crime only when it knew, or should have known, that the specific kind of crime was likely, and then failed to take reasonable steps. Georgia’s 2025 law, SB 68, narrows this for newer incidents: the owner must have known of prior similar conduct. The core test is foreseeability. Courts weigh prior incidents on the premises, their similarity and recency, and the cost of added protection. Your own incident history is usually the strongest evidence in these cases.
Why foreseeability decides most negligent-security claims
Under Georgia’s common-law rule, a proprietor must exercise ordinary care to keep premises safe, and the Georgia Supreme Court holds that the reasonable foreseeability of third-party criminal conduct is part of that duty. Without foreseeability that a criminal act will occur, no duty to prevent it arises. The same court says a factfinder must weigh the likelihood and severity of the harm against the cost and feasibility of added measures. Foreseeability is therefore the gate that opens or closes the entire claim, not a side issue.
How the foreseeability bar differs by state
Courts do not agree on how much notice is enough. Louisiana’s high court says a very high degree of foreseeability is required to give rise to a duty to post security guards, while a lower degree may support lesser measures such as cameras, lighting, or fencing. California’s high court holds that a high degree of foreseeability is required before a landlord must hire guards, and that this degree rarely if ever can be shown without prior similar violent incidents. Washington’s court requires prior violent acts that are sufficiently similar, close in time, and numerous enough to put a business on notice. Texas uses the Timberwalk factors, which measure foreseeability but cannot alone decide whether a risk was reasonable.
| Jurisdiction | What the court asks | Notice the court required or found lacking |
|---|---|---|
| Louisiana | Existence, frequency, and similarity of prior incidents, plus location and condition | Very high foreseeability for guards; lower for cameras or lighting |
| California (landlord case) | Scope of duty after foreseeability | High foreseeability, rarely shown without prior similar violent incidents |
| Washington | Prior violent acts similar, close in time, and numerous | Prior acts must put the business on notice the act was likely |
| Texas | Timberwalk factors, which measure foreseeability but do not alone decide reasonableness | Factors inform foreseeability; they do not set a guard threshold |
| Florida (Fourth District) | Whether similar incidents happened at the specific store | Active shooter training did not create a foreseeable zone of risk; no prior batteries were shown at the store |
| Georgia (incidents before the 2025 law) | Totality of circumstances | Jury may weigh high-crime area and employee concerns |
The table is our own comparison of the tests the cited courts apply. It does not predict how any specific case will be decided.
One gap is worth knowing about. Washington’s court expressly left open the circumstances under which the “place or character” of a business can create a duty to protect invitees, so a store there cannot assume that a clean incident record ends the question. That case involved a mall with four unarmed guards and no security cameras, a reminder that courts look at which measures were actually in place.
Georgia changed the test for newer incidents
Georgia’s 2025 law, SB 68, creates a separate cause of action for negligent security. The bill says the Act becomes effective upon its approval by the Governor, and that its negligent-security sections apply only to causes of action arising on or after that date, with earlier ones governed by prior law. For those newer claims, the Senate Research Office summary says an owner must have known of prior occurrences of substantially similar wrongful conduct on the premises, on adjoining property, or within 500 yards. The governor’s signed text also says no owner must exercise extraordinary care against third-party wrongful conduct. It adds that a plaintiff must show the owner failed to remedy a specific and known physical condition of the premises.
In our view, the most useful review is a Georgia store list sorted by date. Confirm with counsel the date the Governor approved the bill, which is the effective date, pull every incident on or after it, and check whether any was substantially similar and known to the store. Older claims still follow prior law, so keep those files separate.
Your own incident history carries the most weight
Across these cases, prior incidents are the evidence that moves a court. The Louisiana court calls the existence, frequency, and similarity of prior incidents the most important factor. In Florida’s Fourth District, the court found no prior batteries against a person at the Publix store involved.
In our view, your own log deserves more attention than national trends when you assess a single store. Keep the incident log that feeds your repeat-offender policy accurate, because it is the record a plaintiff has the most reason to ask for. A store that tracks only losses and omits threats or assaults will have a thinner record than the one it actually lived through.
Why an unenforced policy is a risk
A written security procedure does not set the legal standard of care, but it is still evidence. Florida’s Fourth District says a party’s internal operating manuals are admissible if relevant, and that they do not fix the standard. In Georgia, CVS’s escort practice and a removed guard, in a case where the store also had three prior crimes at the premises, were enough for a jury to consider knowledge of the hazard.
Training is treated differently from a standing practice. In 2026, Florida’s Fourth District held that Publix’s active shooter training did not create a foreseeable zone of risk. It merely showed that the company was aware an active shooter event was possible somewhere. A concurring judge warned that if large entities were found to owe a duty on those facts, eventually all smaller entities would be understood to have foreseen the same risks. Preparing associates is therefore not an admission of foreseeability at a given store, but what a store knew about its own premises still counts.
Our judgment is simple: do not adopt a security policy your team will not staff and enforce. A rule that is posted but ignored is still evidence, because a plaintiff will ask whether staff followed it on the day of the incident. A realistic policy, consistently followed, is safer than a long list nobody runs.
Industry standards do not automatically set liability
The court sources we verified address foreseeability, prior incidents, and internal policies, and none treats a trade standard as the legal standard. Treat such standards as evidence a plaintiff’s expert may cite, not as a rule.
For associates, that means training should not claim that a trade-group checklist creates a legal duty. Teach the behaviors the law can measure: noticing a pattern, reporting it through the incident report process, and escalating when a threat repeats.
A minimal incident log that holds up
The cases above keep returning to the same questions: what happened, where, how recently, how alike, and what the store did next. A log that answers them for each event gives you a usable record. This template is our own suggestion, not a court-approved form.
| Field | What to record |
|---|---|
| Date and time | When it happened, and when the store learned of it |
| Location | The specific store and area, such as the entrance, parking lot, or register |
| Type | Theft, threat, assault, robbery, or weapon displayed |
| Similarity note | Whether it resembles an earlier event at the same site |
| Who knew | The manager or associate who received the report |
| Response | What the store changed, if anything, and the date |
What to do this week
- Pull the last three years of incidents for each store and sort them by type, location, and date.
- For Georgia stores, flag every incident on or after the date the Governor approved SB 68 (confirm that date with counsel) and confirm it is logged.
- Compare each written security procedure against what staff actually do on a typical shift.
- Remove or revise any procedure your team cannot staff or enforce, and document the change.
- Review the observe-and-report approach with associates at the next huddle.
Frequently asked questions
Does a store have to hire guards to avoid negligent security claims?
No single rule applies everywhere. California's high court sets a demanding foreseeability bar before a landlord must hire guards, while Louisiana's court allows a lower bar for cameras, lighting, and fencing. Build your risk file site by site, so each measure you adopt can be matched to the level of prior activity that justified it.
Can a company's own safety policy be used against it in court?
Yes, if it is relevant. Florida's Fourth District held that internal operating manuals are admissible if relevant, but they do not fix the legal standard of care. Managers should assume plaintiffs will read the written procedure and ask whether staff followed it on the day of the incident.
Did Georgia change the rules for negligent security claims?
Yes, for newer incidents only. The statute reaches claims arising on or after its effective date, and anything earlier is judged under the rules that applied before. A practical step is to tag every Georgia incident with its date before anyone argues about which law governs it.
Does a single prior robbery on the property create liability?
The answer depends on the state. Washington's court requires prior violent acts sufficiently similar, close in time, and numerous enough to put a business on notice, so one unrelated event would likely fall short. The verified sources do not address that exact fact pattern. Practical step: log each event's type, location, and date, then compare them at your monthly review.