FTC bans Rite Aid from using facial surveillance systems for five years

Rite Aid will not be able to use any kind of facial recognition security system for next five years as part of its settlement with the Federal Trade Commission, which accused it of "reckless use of facial surveillance systems.” The FTC said in its complaint that the drugstore chain deployed an artificial intelligence-powered facial recognition technology from 2012 to 2020 to identify customers who may have previously shoplifted or have engaged in problematic behavior. Apparently, the company had created a database with “tens of thousands” of customer images, along with their names, dates of birth and alleged crimes. Those photos were of poor quality, taken by its security cameras, employees’ phones and even from news stories. As a result, the system generated thousands of false-positive alerts.

Samuel Levine, Director of the FTC’s Bureau of Consumer Protection, said the technology’s use left Rite Aid’s customers “facing humiliation and other harms.” Employees would follow flagged customers around the store, the complaint said, would publicly accuse them of wrongdoing in front of friends and family and would sometimes get the police involved. Further, the system was more likely to generate false positives in predominantly Black and Asian communities. A Reuters investigation in 2020 revealed that the company used facial surveillance in “largely lower-income, non-white neighborhoods.” The FTC noted in its complaint that the technology and “Rite Aid’s failures were likely to cause substantial injury to consumers, especially to Black, Asian, Latino and women customers.”

In addition to prohibiting the use of facial surveillance technologies, the order also requires Rite Aid to delete the photos it collected, notify consumers when their information is registered in a database for security purposes and to provide conspicuous notices if it does use facial recognition or other types of biometric surveillance technologies. It also has to implement a proper data security program to protect the information it collects and will need to have a third party assess it. The proposed order will take effect after being approved by the bankruptcy court, since the company is currently going through bankruptcy proceedings.

Rite Aid, however, said that it “fundamentally disagree[s]” with the agency’s allegations and that it stopped using the surveillance technology years ago.

“We are pleased to reach an agreement with the FTC and put this matter behind us,” the drugstore chain said in a statement. “We respect the FTC’s inquiry and are aligned with the agency’s mission to protect consumer privacy. However, we fundamentally disagree with the facial recognition allegations in the agency’s complaint. The allegations relate to a facial recognition technology pilot program the Company deployed in a limited number of stores. Rite Aid stopped using the technology in this small group of stores more than three years ago, before the FTC’s investigation regarding the Company’s use of the technology began.

Rite Aid’s mission has always been and will continue to be to safely and conveniently serve the communities in which we operate. The safety of our associates and customers is paramount. As part of the agreement with the FTC, we will continue to enhance and formalize the practices and policies of our comprehensive information security program.”