Rite Aid Banned From Using Facial Recognition as Part of FTC Settlement

Agency alleged retailer failed to implement reasonable procedures and prevent harm to consumers in its use of the technology

Marian Zboraj

12/20/2023

Rite Aid disagrees with the facial-recognition allegations in the FTC's complaint.

Rite Aid Corp. has reached a comprehensive settlement agreement with the U.S. Federal Trade Commission (FTC) regarding the company’s historical use of facial-recognition technology to prevent retail theft and issues relating to the company’s compliance with a 2010 commission order. FTC alleged that the retailer failed to implement reasonable procedures and prevent harm to consumers in its use of the technology in hundreds of stores.

In a complaint filed in federal court, the FTC contended that from 2012 to 2020, Rite Aid deployed artificial intelligence-based facial-recognition technology to identify customers who may have been engaged in shoplifting or other problematic behavior. The complaint, however, charges that the company failed to take reasonable measures to prevent harm to consumers who, as a result, were erroneously accused by employees of wrongdoing because facial-recognition technology falsely flagged the consumers as matching someone who had previously been identified as a shoplifter or other troublemaker.

The complaint alleges that Rite Aid didn’t inform consumers that it was using the technology in its stores, and that employees were discouraged from revealing such information. As noted in the complaint, employees, acting on false positive alerts, followed consumers around its stores, searched them, ordered them to leave, called the police to confront or remove consumers, and publicly accused them of shoplifting or other wrongdoing.

According to the complaint, Rite Aid contracted with two companies to help create a database of images of individuals — considered to be “persons of interest” because Rite Aid believed that they engaged in or attempted to engage in criminal activity at one of its retail locations — along with their names and other information such as any criminal background data. The company collected tens of thousands of images of individuals, many of which were low-quality and came from Rite Aid’s security cameras, employee phone cameras and even news stories, according to the complaint. As a result, the FTC says that the system generated thousands of false-positive matches.

As part of its settlement, Rite Aid will be prohibited from using facial-recognition technology for surveillance purposes for five years.

The proposed order will require the retail chain to implement comprehensive safeguards to prevent these types of harm to consumers when deploying automated systems that use biometric information to track them or flag them as security risks. It will also require Rite Aid to discontinue using any such technology if it can’t control potential risks to consumers. To settle charges that it violated a 2010 commission data security order by failing to adequately oversee its service providers, Rite Aid will also be required to implement a robust information security program, which must be overseen by the company’s top executives.

Rite Aid issued the following statement in regard to the settlement:

“We are pleased to reach an agreement with the FTC and put this matter behind us. We respect the FTC’s inquiry and are aligned with the agency’s mission to protect consumer privacy. However, we fundamentally disagree with the facial-recognition allegations in the agency’s complaint. The allegations relate to a facial-recognition technology pilot program the company deployed in a limited number of stores. Rite Aid stopped using the technology in this small group of stores more than three years ago, before the FTC’s investigation regarding the company’s use of the technology began.
Rite Aid’s mission has always been and will continue to be to safely and conveniently serve the communities in which we operate. The safety of our associates and customers is paramount. As part of the agreement with the FTC, we will continue to enhance and formalize the practices and policies of our comprehensive information security program.
Looking ahead, we are focused on the important actions underway to strengthen our financial position as we continue providing leading health care products and services to the nearly 1 million customers that we serve daily.”

The settlement with the FTC is subject to approval by the U.S. Bankruptcy Court overseeing Rite Aid’s ongoing restructuring, and the U.S. Federal District Court in which the FTC filed its complaint.

Rite Aid officially declared bankruptcy in October. The retailer said that it aims to restructure with $3.45 billion in new financing from some of its lenders. “This financing is expected to provide sufficient liquidity to support the company throughout this process,” a company statement noted.

Employing nearly 6,000 pharmacists, Philadelphia-based Rite Aid operates more than 1,900 retail pharmacy locations across 17 states. The company is No. 22 on The PG 100, Progressive Grocer’s 2023 list of the top food and consumables retailers in North America.