Rite Aid won’t use facial recognition for 5 years in FTC settlement

Rite Aid Corp. is agreeing to proposed Federal Trade Commission (FTC) restrictions on deploying facial recognition technology in its stores.

In a proposed settlement reached with the FTC on Dec. 19, 2023, the drugstore retailer will be prohibited from using facial recognition technology for surveillance purposes for five years, and will follow certain measures to ensure consumer safety and privacy if it deploys any facial recognition surveillance systems in stores after the ban lifts.

The settlement, which is subject to approval from the court overseeing Rite Aid’s ongoing Chapter 11 bankruptcy proceedings, is in response to an FTC complaint filed in federal court. The complaint alleges that from 2012 to 2020, Rite Aid deployed artificial intelligence (AI)-based facial recognition technology in order to identify customers who may have been engaged in shoplifting or other problematic behavior, but failed to take reasonable measures to prevent harm to consumers.

As a result, the FTC says some Rite Aid shoppers were erroneously accused by employees of wrongdoing because facial recognition technology falsely flagged the consumers as matching someone who had previously been identified as a shoplifter or other troublemaker, with disproportionate impact on people of color.

According to the complaint, Rite Aid contracted with two companies to help create a database of images of individuals considered to be “persons of interest” for criminal activity, along with their names and other information such as any criminal background data. 

The companies collected tens of thousands of images of individuals, many of which were low-quality and came from Rite Aid’s security cameras, employee phone cameras and news stories, generating thousands of false positive matches, according to the complaint.

Rite Aid, which has not used facial recognition technology in its stores since 2020, issued an official response to the proposed settlement.

“We are pleased to reach an agreement with the FTC and put this matter behind us,” Rite Aid said in the statement. “We respect the FTC’s inquiry and are aligned with the agency’s mission to protect consumer privacy. However, we fundamentally disagree with the facial recognition allegations in the agency’s complaint. 

“The allegations relate to a facial recognition technology pilot program the company deployed in a limited number of stores,” Rite Aid said. “Rite Aid stopped using the technology in this small group of stores more than three years ago, before the FTC’s investigation regarding the company’s use of the technology began. As part of the agreement with the FTC, we will continue to enhance and formalize the practices and policies of our comprehensive information security program.”

“Rite Aid's reckless use of facial surveillance systems left its customers facing humiliation and other harms, and its order violations put consumers’ sensitive information at risk," said Samuel Levine, director of the FTC’s Bureau of Consumer Protection, in an official agency press release. “This groundbreaking order makes clear that the commission will be vigilant in protecting the public from unfair biometric surveillance and unfair data security practices.”

Headquartered in Philadelphia, Rite Aid operates more than 2,300 retail pharmacy locations across 17 states. It also operates Seattle-area regional drugstore chain Bartell Drugs, pharmacy benefits company Elixir, and corporate health services provider Health Dialog.