Rite Aid banned from facial recognition for five years and ordered to delete the algorithms built from the data
Subject: Rite Aid Corporation (US pharmacy chain)
What happened
In a complaint filed in federal court, the FTC alleged that from 2012 to 2020 Rite Aid deployed AI-based facial recognition in hundreds of stores to identify customers who might be shoplifting or behaving problematically, without reasonable measures to prevent consumer harm. The company worked with two vendors to build a database of "persons of interest", collecting tens of thousands of images, many of them low quality and sourced from store security cameras, employee phone cameras and even news stories.
How it was handled
The FTC alleged that Rite Aid failed to: consider and mitigate the risk of misidentification, including heightened risks by race or gender — its system was more likely to generate false positives in stores in plurality-Black and Asian communities; test, assess, measure, document or even ask its two vendors about the technology’s accuracy before deployment; prevent low-quality images from being used; monitor or test accuracy after deployment, including any procedure to track false-positive rates or the actions taken on them; and adequately train the employees operating it, or flag that it could produce false positives. The system generated thousands of false positives — matching customers to people enrolled thousands of miles away, or flagging the same person at dozens of stores nationwide. Acting on false alerts, employees followed, searched and ejected customers, called the police, and publicly accused them of shoplifting, sometimes in front of friends or family. The FTC also alleged Rite Aid violated a 2010 data security order by failing to implement a comprehensive information security programme and to oversee service providers.
Outcome
On status first: what the FTC and Rite Aid agreed is a proposed stipulated order, which takes effect only once approved by the federal district court and the bankruptcy court and once the Commission modifies the 2010 order; the complaint and proposed order were filed in the Eastern District of Pennsylvania and Rite Aid was in bankruptcy proceedings at the time. The proposed order requires Rite Aid to: refrain from using facial recognition for surveillance purposes for five years; implement comprehensive safeguards when deploying automated systems that use biometric information to track consumers or flag them as security risks, and discontinue such technology if it cannot control the risks; delete, and direct third parties to delete, the images collected through the facial recognition system as well as any algorithms or other products developed using them; notify consumers when their biometric information is enrolled in such a database and when action is taken against them based on the system’s output; investigate and respond in writing to related complaints; give clear and conspicuous notice in stores about the use of facial recognition or other biometric surveillance; delete biometric information it collects within five years; and provide an annual compliance certification from its CEO. It must also implement a robust information security programme overseen by top executives.
What it means for Chinese exporters
- · Algorithmic disgorgement is the FTC’s sharpest remedy: models trained on unlawfully obtained data must themselves be deleted, so a defect in data provenance zeroes out the model asset. Companies selling vision models into the US must be able to trace training-set composition batch by batch to its sources — otherwise, once one source is found unlawful, they cannot show which models were unaffected.
- · Pre-deployment accuracy testing is a hard requirement and cannot rest on a vendor’s verbal assurance. The FTC expressly counted "never asking the vendors about accuracy testing" as a failure. On both sides of a procurement, keep the test protocol, subgroup accuracy reports and acceptance records.
- · Subgroup error by race and gender was a central allegation. Chinese companies building face, behaviour or risk-scoring models should complete subgroup performance evaluation before shipping and deliver it with the product: in the US it is mitigating evidence, and under the EU AI Act high-risk route it is a mandatory data-governance and accuracy duty.
- · Launch is not the end: continuous false-positive tracking, a staff mechanism for reporting bad matches, and whether it is actually enforced are all examined. Build these as in-product operational metrics and logs, not as a process you leave to the customer.
- · Old orders compound. Rite Aid was treated more severely for breaching its 2010 data security order. A company that has settled with a US regulator should run every later product line against the scope of that original order.
Related regulations
Sources (1)
- FTC press release — Rite Aid banned from using AI facial recognition after FTC chargesU.S. Federal Trade Commission · published 2023-12-19 · retrieved 2026-09-12
Content as of 2026-09-12 · corpus 2026.09|Compiled from public official sources with links and review dates for compliance decision support. Rules change; have licensed professionals review before external disclosure, regulatory filing or contractual commitments.