Rite Aid hit with five-year facial recognition ban for 'reckless' use

Under a settlement reached with the Federal Trade Commission, Rite Aid will not be allowed to use AI-powered facial recognition technology for another five years. In a complaint filed Tuesday, the FTC accuses Rite Aid of “recklessly” using facial surveillance systems from 2012 to 2020.

According to the FTC, during this period Rite Aid used facial recognition technology to “capture images of all consumers as they entered or moved through stores.” A database of customers identified as shoplifters or engaging in other suspicious behavior was then allegedly created. For some customers, the database included “accompanying information” such as names, dates of birth and what activity was deemed suspicious by the store, the complaint says.

Rite Aid employees allegedly followed flagged customers around stores and conducted searches

According to the FTC, when a reported shopper entered a Rite Aid store with facial recognition technology, employees received a “match alert” on their cellphones. As a result, Rite Aid employees allegedly followed customers around stores, conducted searches, publicly accused them of shoplifting and even asked authorities to turn away certain shoppers, the complaint says. According to the FTC, Rite Aid misidentified people as shoppers who had previously been flagged by the system, with the incidents “disproportionately” affecting people of color.

Additionally, the pharmacy chain failed to inform customers that it was using facial recognition technology while employees were “instructed not to disclose this information,” the complaint says. Most of the Rite Aid stores equipped with facial recognition technology were in New York City, Los Angeles, Sacramento, Philadelphia, Baltimore, Detroit, Atlantic City and several other cities.

“Rite Aid’s reckless use of facial surveillance systems has caused indignity and other harm to its customers, and its violations of the order put consumers’ sensitive information at risk,” Samuel Levine, director of the Bureau of Consumer Protection at the FTC, said in a statement. “Today’s landmark order makes clear that the Commission will remain vigilant in protecting the public from unfair biometric surveillance and unfair data security practices.”

In addition to a five-year ban on the use of facial recognition technology, the FTC’s proposed order requires Rite Aid to implement “comprehensive safeguards” to protect customers. The company must, among other things, delete “all photos and videos” of customers captured by its facial recognition system, implement a data security program and provide written notice to customers whose biometric data will be recorded in a database in the future. Because Rite Aid is currently going through bankruptcy proceedings, the FTC says the order will go into effect once the bankruptcy court and federal district court approve the measures.

Aside from Rite Aid, several retail stores have implemented facial recognition as a means of monitoring guests. In 2021, 35 organizations banded together and called on retailers like Albertsons, Macy’s and Ace Hardware to stop using the technology. Some states, including Maine, have passed laws to regulate the use of facial recognition, while New York City requires venues and retailers to notify customers when biometric data collection is being used.