The Federal Trade Commission has banned Rite Aid from using AI facial recognition technology, accusing the pharmacy chain of recklessly deploying technology that subjected customers – especially people of color and women – to unwarranted searches.

The decision comes after Rite Aid deployed AI-based facial recognition to identify customers deemed likely to engage in criminal behavior like shoplifting. The FTC says the technology often based its alerts on low-quality images, such as those from security cameras, phone cameras and news stories, resulting in "thousands of false-positive matches" and customers being searched or kicked out of stores for crimes they did not commit.

"Rite Aid failed to take reasonable measures to prevent harm to consumers from its use of facial recognition technology," the complaint alleges.

Two of the cases outlined in the complaint include:

• An employee searching an 11-year-old girl after a false match. The girl’s mother said she missed work because her daughter was "so distraught by the incident."
• Employees calling the police on a Black woman after a false alert. The person in the image that triggered the alert was described as “a white lady with blonde hair.”

“It has been clear for years that facial recognition systems can perform less effectively for people with darker skin and women,” FTC Commissioner Alvaro Bedoya said in a statement. “In spite of this, we allege that Rite Aid was more likely to deploy face surveillance in stores located in plurality-non-White areas than in other areas.”

The FTC said facial recognition was in use between 2012 and 2020 in hundreds of stores, and customers were not informed that the technology was in use.

“Rite Aid's reckless use of facial surveillance systems left its customers facing humiliation and other harms, and its order violations put consumers’ sensitive information at risk," Samuel Levine, director of the FTC’s Bureau of Consumer Protection, said in a Tuesday statement. “Today’s groundbreaking order makes clear that the Commission will be vigilant in protecting the public from unfair biometric surveillance and unfair data security practices.”

A statement from Rite Aid said the company is pleased to reach an agreement with the FTC, but it disagrees with the facial recognition allegations in the complaint.

"The allegations relate to a facial recognition technology pilot program the Company deployed in a limited number of stores," the statement reads. "Rite Aid stopped using the technology in this small group of stores more than three years ago, before the FTC’s investigation regarding the Company’s use of the technology began."

The ban is to last five years. If Rite Aid does decide to implement similar technology in the future, the order requires it to implement comprehensive safeguards and a “robust information security program” overseen by top executives. The FTC also told Rite Aid to delete any images collected for the facial recognition system and said the company must tell customers when their biometric information is enrolled in a database for surveillance systems. 

The settlement comes as Rite Aid works its way through bankruptcy proceedings. The FTC’s order is set to go into effect once the bankruptcy and federal district court give approval.