FTC bans Rite Aid's use of facial recognition tech


The store has been issued a five-year ban of the technology after over a decade of misuse

The Federal Trade Commission (FTC) has issued a five-year ban on facial recognition technology to Rite Aid after the store mishandled its uses for over a decade. 

While the surveillance technology was implemented in Rite Aid stores for safety reasons, the agency found that Rite Aid was using it in ways that are harmful to consumers, including falsely accusing customers of shoplifting. According to the FTC’s complaint, women and people of color were primarily targeted for shoplifting. 

“Rite Aid’s reckless use of facial surveillance systems left its customers facing humiliation and other harms, and its order violations puts consumers’ sensitive information at risk,” said Samuel Levine, director of the FTC’s Bureau of Consumer Protection. 

“Today’s groundbreaking order makes clear that the Commission will be vigilant in protecting the public from unfair biometric surveillance and unfair data security practices.”  

Shoppers were profiled

Rite Aid had been using the facial recognition technology in its stores from 2010 through 2020, and it was originally implemented to help stores identify potential shoplifters or other problematic behaviors. 

The FTC learned that not only did Rite Aid not disclose to shoppers that they were being surveilled, but employees were also told to keep the surveillance system under wraps. Additionally, there were no systems in place to protect shoppers, which ultimately led to a great deal of chaos and harm for Rite Aid shoppers. 

“Employees, acting on false positive alerts, followed consumers around its stores, searched them, ordered them to leave, called the police to confront or remove customers, and publicly accused them, sometimes in front of friends or family, of shoplifting or other wrongdoing, according to the complaint,” the FTC wrote. “In addition, the FTC says Rite Aid’s actions disproportionately impacted people of color.” 

In one such instance, an 11-year-old girl was falsely accused of shoplifting based on images that had been generated from the facial recognition system. 

Rite Aid had contracted with two companies that created a database of people that were believed to be shoplifters or a general harm to the store. The database ended up being full of inaccurate information, low-quality images, and customers’ personal information. 

Protecting consumers moving forward

In addition to the five-year ban, the FTC has also required Rite Aid take further action to protect consumers. 

The company has been mandated to delete all pictures and videos that have been collected while this technology was implemented, and ensure all third-party entities do the same. In addition, should this technology be utilized again after five years, Rite Aid is required to clearly display notices in their stores, implement a data security system, and delete any data within five years. 

"Rite Aid’s mission has always been and will continue to be to safely and conveniently serve the communities in which we operate,” the company said in a statement. “The safety of our associates and customers is paramount. As part of the agreement with the FTC, we will continue to enhance and formalize the practices and policies of our comprehensive and information security program.” 

Take an Identity Theft Quiz. Get matched with an Authorized Partner.