This is a research prototype. The data and analyses are preliminary and not yet validated — we'd welcome your .
The FTC reached a settlement with Rite Aid regarding the pharmacy chain's use of AI-powered facial recognition technology between 2012 and 2020. The system, which was used to identify suspected shoplifters, generated thousands of false-positive matches that disproportionately affected Black, Latino, Asian, and female customers. These errors led to customers being wrongly accused, searched, and banned from stores. As part of the settlement, Rite Aid is banned from using such technology for five years and must delete all data and models derived from the system.
Rite Aid used facial recognition technology from October 2012 to July 2020, allegedly leading to disproportionate misidentifications of women, Black, Latino, and Asian shoppers as "likely" shoplifters. The FTC settlement prohibits Rite Aid from using this technology in stores for five years.
Domain classification, causal taxonomy, severity scores, and national security assessments were LLM-classified and may contain errors.
Accuracy and effectiveness of AI decisions and actions are dependent on group membership, where decisions in AI system design and biased training data lead to unequal outcomes, reduced benefits, increased effort, and alienation of users.
Also classified as
Rite Aid collected and stored sensitive biometric data and suspected criminal histories of tens of thousands of individuals without their consent and failed to secure this non-public information.
The facial recognition system performed with unequal accuracy across demographic groups, generating significantly higher rates of false positives for Black, Asian, Latino, and female customers.
AI system
Due to a decision or action made by an AI system
Unintentional
Due to an unexpected outcome from pursuing a goal
Post-deployment
Occurring after the AI model has been trained and deployed
The direct cause of the reported harms was the generation of false-positive matches by the deployed facial recognition AI, which was an unintentional outcome of Rite Aid's security program.
Added categories peak at 2: Minor (Psychological Harm, Direct)
Rite Aid's deployment of biased facial recognition technology resulted in civil rights violations and discriminatory retail policing. While the incident highlights significant issues in biometric surveillance and algorithmic bias, its national security impact remains minor as it was resolved through domestic regulatory enforcement without systemic threats to state stability.
The facial recognition system operated independently in real-time, continuously scanning live video feeds of customers, analyzing facial geometry using learned patterns, and autonomously generating match alerts without direct human initiation for each scan.
High Risk: The report describes the deployment of real-time biometric facial recognition technology for security and surveillance purposes in retail stores, which falls under high-risk applications involving biometric identification and surveillance.
The system's primary function was to analyze facial geometry to identify individuals from a watchlist, operating as an automated biometric surveillance tool in retail stores.
The reports are highly detailed, drawing directly from the FTC's official 54-page complaint and legal settlement. The facts regarding the system's deployment, the nature of the false positives, the demographic biases, and the regulatory consequences are consistently reported across multiple reputable news outlets and official FTC statements.
None. The consensus across all reports is clear that the system was deployed recklessly, performed poorly, and caused discriminatory harm.
Technology
Biased Facial Recognition Models
AI models generated higher false-positive rates for people of color and women.
Inaccurate Vendor Software
Software from vendors was deployed despite disclaimers of accuracy.
Lack of Confidence Score Details
System alerts sent to employees did not display actual match confidence scores.
Data Inputs
Low-Quality Watchlist Images
Database relied on blurry CCTV and mobile photos, increasing false matches.
No Image Quality Controls
Rite Aid failed to enforce policies to prevent poor-quality image uploads.
Indefinite Data Retention
Watchlist images and data were stored indefinitely without deletion policies.
Human Factors
Inadequate Employee Training
Staff lacked training on evaluating matches and understanding AI bias risks.
Blind Trust in Match Alerts
Employees acted on false-positive alerts without verifying customer identity.
Pressure to Maximize Enrollments
Security staff were instructed to enroll as many individuals as possible.
Process and Methods
No Pre-Deployment Testing
Rite Aid failed to test or inquire about the accuracy of the FRT system.
Lack of Post-Deployment Monitoring
No procedures were implemented to track false positives or correct errors.
Covert System Deployment
Customers were not notified of FRT use, and staff were told to hide it.
Management
Poor Vendor Oversight
Management failed to vet vendors or include security standards in contracts.
Discriminatory Deployment Decisions
FRT was disproportionately deployed in lower-income, non-white neighborhoods.
Failure to Assess Consumer Risks
Executives did not assess risks of physical, financial, or reputational harm.
Regulatory Environment
Violation of 2010 FTC Order
Rite Aid failed to maintain mandated information security and vendor oversight.
Absence of Sweeping Privacy Laws
Lack of federal biometric laws enabled unchecked corporate surveillance.
AI system involved
Identified by automated extraction; can differ from the alleged developers above.
