Rite Aid is banned from using facial recognition in its stores after the FTC said it falsely flagged thousands of shoppers as potential criminals

• The FTC banned Rite Aid from using facial recognition technology in its stores for five years.
• The software was meant to alert staff when suspected criminals entered Rite Aid stores.

The Federal Trade Commission has banned Rite Aid from using facial recognition technology in its stores for five years, saying that it falsely flagged some people as suspected criminals.

The FTC said that between 2012 and 2020, Rite Aid used facial recognition technology in hundreds of retail stores, mostly in and around big cities including New York City, Los Angeles, San Francisco, Philadelphia, Detroit, and Seattle, to alert staff if a potential criminal had entered. These individuals

The system sent email and phone alerts to workers at the stores featuring a picture of the individual and showing that it had matched with someone on Rite Aid's watch lsit. The FTC said that because of these alerts, in some cases, staff banned the customers from stores, accused them of past criminal activity in front of other people, searched them, and even called the police.

But the software led to many false matches, the FTC said. Between December 2019 and July 2020, Rite Aid employees recorded thousands of false positive match alerts, the FTC said.

For example, Rite Aid's facial recognition technology generated more than 900 match alerts in over 130 stores across multiple states over just five days for one person recorded in its database.

"In multiple instances, Rite Aid employees took action, including asking consumers to leave stores," the FTC said.

An 11-year-old girl was also stopped and searched because of a false match, the commission said.

Black, Asian, Latino, and women consumers were most likely to be harmed by Rite Aid's facial recognition software, according to the FTC.

Rite Aid's database, which recorded tens of thousands of individuals, featured images of people Rite Aid thought had engaged in actual or attempted criminal activity at one of its stores or people that law enforcement had told the pharmacy chain to be on the lookout for them.

Many of the pictures were low-quality, obtained through CCTV, facial recognition cameras, law enforcement, and media reports, the FTC said. Some of the pictures were also taken by staff on their phones or were photos of government ID cards like driver's licenses, according to the FTC.

Cameras in Rite Aid's stores would then capture live images of customers and compare these to its database. The software generated confidence scores based on how accurate it thought the match was, but these scores generally weren't shared with the store employees tasked with deciding whether to take action against the customer, the FTC said.

Rite Aid obtained its facial recognition technology from two third-party vendors and didn't inform consumers of its usage, the FTC said.

The FTC said that Rite Aid had failed to assess the technology's accuracy, enforce image-quality standards required for the technology to function accurately, and provide enough training for and oversight of the store employees tasked with operating the technology.

Under the proposed settlement order, Rite Aid will be banned from using facial recognition technology in its stores for five years, delete any photos it obtained through using the software, and provide clear notices to customers about the use of biometric surveillance in its stores.

"We are pleased to reach an agreement with the FTC and put this matter behind us," Rite Aid said in a press release. "However, we fundamentally disagree with the facial recognition allegations in the agency's complaint."

Rite Aid said that it had used the facial recognition technology "in a limited number of stores" and had stopped using the software more than three years ago.