FTC Bans Rite Aid from Using Facial Recognition Technology (2023)

Incident Summary

On December 19, 2023, the U.S. Federal Trade Commission (FTC) issued a consent order banning Rite Aid Corporation from using facial recognition technology for surveillance purposes for a period of five years.^[1] The FTC’s complaint found that Rite Aid had deployed AI-powered facial recognition systems in hundreds of its retail stores over approximately eight years, beginning in 2012, to identify customers the system flagged as likely shoplifters based on prior images.^[1][2]

The FTC determined that the technology disproportionately generated false-positive matches for women and people of color, resulting in employees confronting, following, searching, falsely accusing, and in some cases calling police on innocent customers who had been wrongly flagged by the system.^[1][3] The complaint also found that Rite Aid failed to implement reasonable safeguards, including neglecting to test the system for accuracy or bias, failing to train employees on how to handle alerts, and not providing a mechanism for individuals to contest false matches.^[2]

A 2020 Reuters investigation had previously revealed that the facial recognition systems were disproportionately deployed in stores located in lower-income communities and communities of color, raising additional concerns about discriminatory targeting.^[4]

Key Facts

• Regulatory authority: U.S. Federal Trade Commission
• Duration of deployment: Approximately 2012–2020 (approximately eight years)
• Technology used: AI-powered facial recognition systems from multiple vendors
• Bias finding: Disproportionate false-positive rates for women and people of color
• Deployment pattern: Systems concentrated in stores in lower-income and non-white neighborhoods
• Enforcement: Five-year ban on facial recognition use; mandatory deletion of collected data; required implementation of comprehensive data security program
• Safeguard failures: No accuracy or bias testing, inadequate employee training, no mechanism for contesting false matches

Threat Patterns Involved

Primary: Biometric Exploitation — Rite Aid deployed facial recognition technology to identify and track customers using biometric data without adequate safeguards, consent mechanisms, or accuracy verification, constituting a misuse of biometric identification systems.

Secondary: Data Imbalance Bias — The facial recognition system exhibited systematic bias, generating disproportionately higher false-positive rates for women and people of color, a pattern consistent with well-documented demographic performance disparities in facial recognition algorithms trained on imbalanced datasets.

Significance

1. First FTC ban on commercial facial recognition. The Rite Aid consent order represented one of the first instances in which the FTC banned a company from using facial recognition technology, establishing a regulatory precedent for enforcement against biased biometric surveillance in commercial settings.
2. Documented discriminatory impact. The case provided concrete evidence that facial recognition systems deployed without adequate testing disproportionately harm women and people of color, reinforcing findings from academic studies such as the NIST Face Recognition Vendor Test.
3. Geographic targeting as compounding harm. The disproportionate deployment of the technology in lower-income and predominantly non-white neighborhoods compounded the discriminatory impact, demonstrating how deployment decisions can amplify algorithmic bias.
4. Accountability gap in retail AI adoption. The eight-year deployment period without systematic accuracy testing or bias auditing illustrated a broader pattern of retailers adopting AI surveillance technologies without implementing basic safeguards or accountability mechanisms.