FTC bars Rite Aid from using facial recognition under settlement

The Federal Trade Commission proposed to bar Rite Aid from using facial recognition software in its drugstores for five years to settle allegations it improperly used the technology to identify shoplifters, the agency said Tuesday.

The FTC alleged that from 2012 to 2020, Rite Aid deployed facial recognition technology in hundreds of its retail pharmacies across several states in order to identify customers it had previously deemed likely to be shoplifting or engaging in other criminal activity. But the system generated thousands of false-positive matches, according to the FTC, resulting in some shoppers being mistakenly flagged as persons of interest.

Those individuals were detained or searched by Rite Aid employees, subjected to increased surveillance, publicly accused of criminal activity, reported to police, and in some cases banned from entering or making purchases at Rite Aid stores, the FTC alleged.

Rite Aid’s facial recognition technology was more likely to generate false positives in stores located in predominantly Black and Asian neighborhoods than in predominantly white communities, where 80% of Rite Aid stores are located, the FTC claims.

Rite Aid relied on facial technology from two undisclosed vendors, the agency said. It maintained a database of persons of interest that included images collected from security camera footage, driver’s licenses or government IDs, along with data such as names, years of birth, and “information related to criminal or ‘dishonest’ behavior in which individuals had allegedly engaged,” the FTC alleged in its complaint, which was filed in U.S. District Court for the Eastern District of Pennsylvania. There were “at least tens of thousands of individuals in its database,” the agency alleged.

As part of the proposed settlement, the FTC said Rite Aid must order third parties to delete images or photos collected by its facial recognition system, notify shoppers when biometric data is collected or used in connection with its security or surveillance systems, among other requirements. It will also require Rite Aid to permanently discontinue using the technology if it can’t control potential risks to consumers.

Rite Aid said in a press release that it’s pleased to reach an agreement with the FTC but that it disagrees with the agency’s allegations.

“The allegations relate to a facial recognition technology pilot program the Company deployed in a limited number of stores,” the company said, adding that it stopped using the technology more than three years ago, before the FTC initiated its investigation.

The FTC action comes after a Reuters investigation in 2020 detailed Rite Aid’s use of facial recognition technology in primarily lower-income, non-white neighborhoods. Reuters identified facial recognition software providers DeepCam and FaceFirst as RiteAid’s vendors. FaceFirst’s technology routinely misidentified Black individuals as shoplifters, the Reuters investigation found.

Privacy and civil liberties advocates continue to raise alarms around the use of facial recognition software and the need for further regulation. The technology has led to increased surveillance, and numerous studies have shown the artificial intelligence underpinning the technology is more likely to misidentify people of color, leading to wrongful arrests.

The proposed settlement is subject to approval by a court overseeing Rite Aid’s bankruptcy proceedings. The drugstore chain filed for Chapter 11 bankruptcy protection in October amid slowing sales, rising debt and lawsuits alleging it contributed to the U.S. opioid epidemic.