Following charges that its artificial intelligence-powered surveillance system lacked appropriate safeguards and falsely tagged customers as shoplifters, Rite Aid has been prohibited from using such technology for the next five years, according to the Federal Trade Commission.

As part of a newly proposed settlement, the Philadelphia-based pharmacy chain will also be required to implement a robust information security program overseen by its top executives when deploying automated systems that use biometric information to track or flag consumers as security risks. But if Rite Aid fails to show it can’t control potential risks to consumers, the FTC said the company must permanently discontinue the use of the technology.

For the FTC, the order marks its first move to regulate biases in AI technologies and follows a warning last May that the agency would be closely monitoring any automated systems using biometric information.

In a statement, Samuel Levine, director of the FTC’s Bureau of Consumer Protection, said, “Rite Aid’s reckless use of facial surveillance systems left its customers facing humiliation and other harms, and its order violations put consumers’ sensitive information at risk.” Levine went on to say he believes the “groundbreaking order” makes clear that the FTC “will be vigilant in protecting the public from unfair biometric surveillance and unfair data security practices.”

In a complaint filed in U.S. District Court for the Eastern District of Pennsylvania, the FTC alleged that from 2012 to 2020, Rite Aid deployed facial recognition technology in hundreds of its retail pharmacies across several states to identify customers it had previously deemed likely to be shoplifting or engaging in other criminal activity. But the chain “failed to take reasonable measures to prevent harm to consumers, who, as a result, were erroneously accused by employees of wrongdoing” because the technology flagged them “as matching someone who had previously been identified as a shoplifter or other troublemaker,” the complaint said.

Those individuals were detained or searched by Rite Aid employees, subjected to increased surveillance, publicly accused of criminal activity, reported to police, and, in some cases, banned from entering or making purchases at stores, the FTC alleged.

The facial recognition technology was more likely to generate false positives at stores within predominantly Black and Asian neighborhoods than in predominantly white communities, where 80% of Rite Aids are located, the FTC added.

“Rite Aid’s actions subjected consumers to embarrassment, harassment, and other harm,” the FTC said. “The company did not inform consumers that it was using the technology in its stores and employees were discouraged from revealing such information. Employees, acting on false positive alerts, followed consumers around its stores, searched them, ordered them to leave, called the police to confront or remove consumers, and publicly accused them, sometimes in front of friends or family, of shoplifting or other wrongdoing.”

Rite Aid’s actions subjected consumers to embarrassment, harassment, and other harm.
– Federal Trade Commission

In its complaint, the FTC also says Rite Aid violated a 2010 data security order with the commission by failing to adequately implement a comprehensive information security program.

Among the shortcomings: not inquiring about the accuracy of its technology before using it; preventing the use of low-quality images; neglecting to train or oversee employees tasked with operating the facial recognition technology or including procedures for tracking the rate of false positive matches.

Using technology from two undisclosed vendors, Rite Aid maintained a database of at least tens of thousands of individuals that included images collected from security camera footage, driver’s licenses or government IDs, along with data such as names, years of birth, and “information related to criminal or ‘dishonest’ behavior in which individuals had allegedly engaged,” the FTC alleged.

As part of the proposed settlement, the FTC said Rite Aid must order third parties to delete images or photos collected by its facial recognition system, notify shoppers when biometric data is collected or used in connection with its security or surveillance systems, among other requirements.

Following the FTC’s announcement, Rite Aid issued a statement saying it was pleased to reach an agreement but disagrees with claims that the technology was misused. “We respect the FTC’s inquiry and are aligned with the agency’s mission to protect consumer privacy. However, we fundamentally disagree with the facial recognition allegations in the agency’s complaint,” the company said in a statement. “The allegations relate to a facial recognition technology pilot program the company deployed in a limited number of stores. Rite Aid stopped using the technology in this small group of stores more than three years ago, before the FTC’s investigation regarding the Company’s use of the technology began,” the chain stated.

We respect the FTC’s inquiry and are aligned with the agency’s mission to protect consumer privacy. However, we fundamentally disagree with the facial recognition allegations in the agency’s complaint.
– Rite Aid

“Looking ahead, we are focused on the important actions underway to strengthen our financial position as we continue providing leading healthcare products and services to the nearly one million customers that we serve daily,” it added.

The settlement is subject to approval by the U.S. Bankruptcy Court for the District of New Jersey, which is overseeing Rite Aid’s ongoing restructuring.

Rite Aid – the nation’s third-largest drugstore chain – filed for bankruptcy in October 2023 amid slowing sales, rising debt and lawsuits alleging it contributed to the U.S. opioid epidemic.

As part the process, Rite Aid has made moves to shrink its retail footprint, announcing plans to close nearly 200 stores across the country – including about a dozen in New Jersey.