Rite Aid wrongfully used facial recognition to accuse customers of shoplifting, FTC says

The Federal Trade Commission on Wednesday said Rite Aid secretly used facial recognition on customers for nearly a decade, and wrongfully accused many of shoplifting.

The FTC says Black and Asian customers were more likely than white customers to be misidentified as people who had shoplifted, or attempted to do so. Women were more likely to be misidentified than men.

According to the complaint, Rite Aid contracted with two companies to help create a database of images of individuals — considered to be “persons of interest” because Rite Aid believed they engaged in or attempted to engage in criminal activity at one of its retail locations — along with their names and other information such as any criminal background data.

In a statement, Rite Aid said the program was used at only a few stores and discontinued in 2020.

Under the settlement, the agency barred Rite Aid from using facial recognition technology in stores or online for five years. The FTC confirmed to NBC News that this is the first time it has ordered any entity to stop using facial recognition.

“Rite Aid’s reckless use of facial surveillance systems left its customers facing humiliation and other harms, and its order violations put consumers’ sensitive information at risk,” said Samuel Levine, director of the FTC’s Bureau of Consumer Protection, said in a press release.

The order must be approved by a bankruptcy court because Rite Aid filed for bankruptcy protection in October.

In its statement, the agency says Rite Aid started using "artificial intelligence-based facial recognition technology" in 2012 to identify customers who may have been shoplifting or engaging in other undesirable behavior. It contracted with two companies to develop a database of people who had shoplifted or been accused of shoplifting in the past.

That database was often filled with low-quality images from store security cameras, employees’ phones, or news stories, along with names and other information, including any criminal background data.

Then the system sometimes identified shoppers as people who had been accused of shoplifting at other stores thousands of miles away, or flagged one person at dozens of stores around the country.

The FTC says the system generated thousands of false positives, and they were more common in stores located in neighborhoods with large Black and Asian populations than white ones.

"Employees, acting on false positive alerts, followed consumers around its stores, searched them, ordered them to leave, called the police to confront or remove consumers, and publicly accused them, sometimes in front of friends or family, of shoplifting or other wrongdoing," the FTC said.

Customers were not informed that Rite Aid was using the technology and employees were "discouraged" from revealing it, according to the agency.

It also says Rite Aid didn't take steps to mitigate the harm that would have been caused by falsely accusing customers of shoplifting and didn't regularly monitor or test its system, nor did it tell employees that the system could make mistakes. When the company switched to a technology that enabled employees to report bad matches and required employees to use it, it didn't follow through to make sure employees followed that policy.

Notably, the FTC did not fine Rite Aid. Justin Brookman, director of technology policy for Consumer Reports, said the agency seemed to have prioritized establishing a precedent regarding companies’ responsibilities when they use facial recognition technology in stores.

“I get the impression that it’s growing in practice, so the FTC wanted to get ahead of this to some extent," Brookman said.

The FTC said in May that companies that use biometric technologies such as facial recognition have to implement them fairly, and mitigate the harm that those technologies could cause. It also said companies that offer biometric technology can't make false promises about its accuracy or effectiveness.

In 2010, just two years before Rite Aid started using the facial recognition technology, it settled an FTC charge saying it failed to protect the medical and financial records of customers and employees. That resulted in a $1 million penalty, and the FTC says that in implementing the facial recognition system and failing to oversee its vendors, Rite Aid violated that settlement.

The agency says Rite Aid will be required to implement "a robust information security program, which must be overseen by the company’s top executives."