FTC Bans Rite Aid From Using AI Facial Recognition

WASHINGTON — Rite Aid, the struggling nationwide drug store chain, got more bad news Tuesday, as federal regulators tagged it for using facial recognition at its stores that led to scores of women and people of color being wrongly identified as shoplifters.

The Federal Trade Commission said the company will be banned from using facial recognition technology for surveillance purposes for five years to settle charges it failed to implement reasonable procedures and prevent harm to consumers in hundreds of stores.

“Rite Aid’s reckless use of facial surveillance systems left its customers facing humiliation and other harms, and its order violations put consumers’ sensitive information at risk,” said Samuel Levine, director of the FTC’s Bureau of Consumer Protection, in a written statement. 

“Today’s groundbreaking order makes clear that the commission will be vigilant in protecting the public from unfair biometric surveillance and unfair data security practices,” Levine said.

The proposed order will require Rite Aid to implement a series of safeguards to prevent future harm to consumers when deploying automated systems that use biometric information to track them or flag them as security risks. 

It also will require Rite Aid to discontinue using any such technology if it cannot control potential risks to consumers. 

To settle charges it violated a 2010 commission data security order by failing to adequately oversee its service providers, Rite Aid will also be required to implement a robust information security program, which must be overseen by the company’s top executives.

In a complaint filed in federal court, the FTC says that from 2012 to 2020, Rite Aid deployed artificial intelligence-based facial recognition technology in order to identify customers who may have been engaged in shoplifting or other problematic behavior. 

The complaint, however, charges that the company failed to take reasonable measures to prevent harm to consumers, who, as a result, were erroneously accused by employees of wrongdoing because facial recognition technology falsely flagged the consumers as matching someone who had previously been identified as a shoplifter or other troublemaker.

Earlier this year, the FTC said its concerns over the growing misuse of biometric data has made ferreting it out a high priority for the agency. 

Rite Aid’s actions subjected consumers to embarrassment, harassment and other harm, according to the complaint. 

The company did not inform consumers that it was using the technology in its stores and employees were discouraged from revealing such information.

Employees, acting on false-positive alerts, followed consumers around Rite Aid stores, searched them, ordered them to leave, called the police to confront or remove consumers, and publicly accused them, sometimes in front of friends or family, of shoplifting or other wrongdoing, according to the complaint. 

In addition, the FTC said Rite Aid’s actions disproportionately impacted people of color.

According to the complaint, Rite Aid contracted with two companies to help create a database of images of individuals — considered to be “persons of interest” because Rite Aid believed they engaged in or attempted to engage in criminal activity at one of its retail locations — along with their names and other information such as any criminal background data. 

The company collected tens of thousands of images of individuals, many of which were low-quality and came from Rite Aid’s security cameras, employee phone cameras and even news stories, according to the complaint.

The system generated thousands of false-positive matches, the FTC said. For example, the technology sometimes matched customers with people who had originally been enrolled in the database based on activity thousands of miles away, or flagged the same person at dozens of different stores all across the United States, according to the complaint. 

In its complaint, the FTC also said Rite Aid violated its 2010 data security order with the commission by failing to adequately implement a comprehensive information security program. Among other things, the 2010 order required Rite Aid to ensure its third-party service providers had appropriate safeguards to protect consumers’ personal data. For example, the complaint alleges the company conducted many security assessments of service providers orally, and that it failed to obtain or possess backup documentation of such assessments, including for service providers Rite Aid deemed to be “high risk.”

In addition to the ban and required safeguards for automated biometric security or surveillance systems, Rite Aid is also being required to delete, and direct third parties to delete, any images or photos they collected because of Rite Aid’s facial recognition system as well as any algorithms or other products that were developed using those images and photos.

It must also notify consumers when their biometric information is enrolled in a database used in connection with a biometric security or surveillance system and when Rite Aid takes some kind of action against them based on an output generated by such a system.

The company has also been ordered to investigate and respond in writing to consumer complaints about actions taken against consumers related to an automated biometric security or surveillance system, and provide clear and conspicuous notice to consumers about the use of facial recognition or other biometric surveillance technology in its stores.

It must also delete any biometric information it collects within five years, and provide the commission with an annual certification from its CEO documenting Rite Aid’s adherence to the order’s provisions.

In October, Rite Aid and a number of its affiliated debtors filed for chapter 11 bankruptcy protection in an effort to settle numerous federal and state lawsuits over the company’s role in the opioid crisis.

The next day, the company was delisted from the New York Stock Exchange, and commenced trading over-the-counter.

The company subsequently released a statement in which it said it had secured $3.5 billion in financing and debt reduction agreements from lenders to keep the company afloat through its bankruptcy. 

Nevertheless, it said, about 500 of its underperforming stores across the country will be closed at least temporarily.

On the heels of that announcement, Rite Aid warned investors that it may not be able to survive its bankruptcy filing and might have to permanently shutter or sell all of its remaining stores over the next 12 months.

In a statement posted on its website on Tuesday, Rite Aid said:

“We are pleased to reach an agreement with the FTC and put this matter behind us. We respect the FTC’s inquiry and are aligned with the agency’s mission to protect consumer privacy. However, we fundamentally disagree with the facial recognition allegations in the agency’s complaint. The allegations relate to a facial recognition technology pilot program the Company deployed in a limited number of stores. Rite Aid stopped using the technology in this small group of stores more than three years ago, before the FTC’s investigation regarding the Company’s use of the technology began.

Rite Aid’s mission has always been and will continue to be to safely and conveniently serve the communities in which we operate. The safety of our associates and customers is paramount. As part of the agreement with the FTC, we will continue to enhance and formalize the practices and policies of our comprehensive information security program.

Looking ahead, we are focused on the important actions underway to strengthen our financial position as we continue providing leading healthcare products and services to the nearly one million customers that we serve daily.”

Dan can be reached at [email protected] and @DanMcCue