As part of a settlement with the Federal Trade Commission, RiteAid is prohibited from using artificial intelligence-powered facial recognition technology for the next five years. In a complaint filed Tuesday, the Federal Trade Commission accused RiteAid of "reckless" use of facial surveillance systems between 2012 and 2020.
During this period, RiteAid used facial recognition technology to "capture images of all consumers as they enter or pass through the store," the FTC said. RiteAid also allegedly created a database of customers identified as stealing or engaging in other suspicious behavior. For some customers, the database will have "incidental information," such as name, date of birth and activity the store considers suspicious, according to the complaint.
When a tagged shopper entered a RiteAid store using facial recognition technology, employees received a "match alert" on their phones, the FTC said. As a result, RiteAid employees followed customers in stores, conducted searches, publicly accused customers of shoplifting and even asked authorities to remove some shoppers, the complaint said. The FTC said RiteAid falsely identified people who had been previously flagged by the system as shoppers and that these incidents "disproportionately" affected people of color.
Additionally, the drugstore chain failed to inform customers that it used facial recognition technology, while employees were "instructed not to disclose" this information. Most RiteAid stores equipped with facial recognition technology are located in New York City, Los Angeles, Sacramento, Philadelphia, Baltimore, Detroit, Atlantic City and a few other cities.
Samuel Levine, director of the FTC's Bureau of Consumer Protection, said in a statement: "RiteAid's brazen use of facial surveillance systems exposed customers to humiliation and other harm, and its violations of orders put consumers' sensitive information at risk. Today's groundbreaking order makes clear that the Commission will remain vigilant to protect the public from unfair biometric surveillance and unfair data security practices."
In addition to banning the use of facial recognition technology for five years, the FTC's proposed order also requires RiteAid to establish "comprehensive safeguards" to protect customers. Among other provisions, the company must delete "all photos and videos" of customers collected by facial recognition systems, implement a data security plan and provide written notice to customers whose biometric data will be entered into the database in the future. Because RiteAid is currently in bankruptcy proceedings, the FTC said the order will take effect immediately once the bankruptcy court and federal district court approve the measures.
In addition to RiteAid, several retail stores already use facial recognition as a means of monitoring guests. In 2021, 35 organizations banded together to demand that retailers such as Albertsons, Macy's and Ace Hardware stop using the technology. Some states, including Maine, have enacted laws regulating the use of facial recognition, while New York City requires venues and retailers to notify customers when biometric data collection is used.