FTC bans Rite Aid from facial recognition for five years

Imagine picking up a prescription at your local pharmacy, only to be followed down the aisles by staff, publicly accused of shoplifting in front of your family, and escorted out by the police.

That nightmare actually happened to countless innocent shoppers across hundreds of Rite Aid stores over an eight-year period, all because of an AI facial recognition system that could barely tell two faces apart.

On Tuesday, the FTC stepped in and banned Rite Aid from using facial recognition surveillance technology for five years, settling charges that the retail giant deployed the system with reckless disregard for consumer harm.

Grainy phone snaps and thousands of false alarms

According to the FTC complaint, between 2012 and 2020, Rite Aid rolled out facial recognition in hundreds of locations to spot suspected shoplifters.

To build its watchlist of persons of interest, Rite Aid scooped up tens of thousands of low-quality images. The photos didn't come from mugshots; they came from grainy security cameras, employees' personal phone cameras, and random news clips.

The low-grade data led to thousands of false-positive matches. Customers were flagged as criminals based on incidents that took place thousands of miles away, and single individuals were somehow recognized in dozens of stores nationwide at the same time.

The system was also inherently biased. FTC investigators found that false matches were far more likely in plurality-Black and Asian communities than in predominantly white neighborhoods.

Compounding the disaster, Rite Aid kept the technology secret from shoppers and discouraged staff from talking about it. When the system flagged a false match, employees took it as gospel. They tailed innocent customers, searched their bags, kicked them out, and called the cops.

Rite Aid never even tested the accuracy of the software before deploying it, nor did it bother asking vendors if their tech actually worked.

Algorithmic disgorgement strikes again

Under the proposed settlement, Rite Aid is barred from using facial surveillance for five years. But the real teeth are in the operational remedies.

Rite Aid must delete all collected facial images and destroy any algorithms or products developed from those photos. The retailer is also required to provide clear notices if it ever deploys biometric tracking again, notify shoppers whenever they are flagged, and file an annual compliance certification signed by its CEO.

Rite Aid is currently navigating bankruptcy proceedings, so the order will take effect once approved by the bankruptcy court and federal district court.

Why it matters

For everyday consumers, this case exposes the dark side of invisible retail AI. You rarely know you are being tracked, but you bear the immediate emotional and legal fallout when a glitchy algorithm mistakes your face for a shoplifter's.

For the retail and tech industries, the FTC is sending an unmistakable warning shot. Slapping a poorly vetted vendor model onto an in-store camera network and letting untrained clerks act on alerts is no longer just sloppy management; it is legally hazardous.

We think the FTC’s mandate requiring Rite Aid to delete the underlying algorithms is the most consequential part of the order. Financial penalties often mean very little to companies going through bankruptcy, but forcing an organization to scrap the AI models entirely hits at the real root of biometric abuse. If businesses plan to automate surveillance, they must account for bias, human oversight, and error rates before deploying the technology.