Facts
According to the complaint of the U.S. Federal Trade Commission, from 2012 to 2020 the pharmacy chain Rite Aid used AI-based facial recognition technology in hundreds of stores to identify customers it considered likely to engage in shoplifting. The system produced false matches, some of them with people enrolled in the database because of incidents thousands of miles away. Acting on these alerts, employees followed customers around stores, searched them, ordered them to leave, called the police and accused them publicly, sometimes in front of friends or family. Rite Aid did not tell customers it used the technology. The FTC also alleged violations of a 2010 FTC data security order.
Question
The FTC’s complaint alleged that Rite Aid’s use of facial recognition without reasonable measures to prevent harm to consumers was an unfair practice under the FTC Act. It rested on the company’s alleged failure to implement reasonable procedures to prevent foreseeable harm and to inform customers. It also alleged that false positives were more likely in stores located in plurality-Black and Asian communities than in plurality-White communities, which brought a discrimination dimension into the case. Because the case was resolved by a stipulated order, these allegations were never adjudicated; Rite Aid neither admitted nor denied them.
Decision
The FTC filed its complaint together with a proposed stipulated order in the U.S. District Court for the Eastern District of Pennsylvania; the Commission voted 3-0 to authorize the filing. The order, agreed by the parties rather than handed down after a trial, was entered by the court in February 2024. It bans Rite Aid from using facial recognition for surveillance purposes for five years. Rite Aid must delete the images it collected and any algorithms developed from them, notify consumers when their biometric information is enrolled in a database or used against them, respond in writing to complaints and post clear notices about facial surveillance in its stores. It may keep biometric information for no more than five years and must maintain an information security program with third-party assessments and annual CEO certification.
Why it matters
The FTC used its unfairness authority against a retailer’s facial recognition program and treated discriminatory error rates as part of the consumer harm. The remedies are structural: a temporary ban on the technology, deletion of models derived from the collected images, and conditions for any future use of automated biometric systems. Those conditions indicate the level of testing and monitoring the FTC expects from businesses that use biometric surveillance.
Related stages
Because Rite Aid was in Chapter 11 proceedings, the bankruptcy court for the District of New Jersey first approved the stipulated order on January 23, 2024. Judge Kelley B. Hodge of the Eastern District of Pennsylvania signed it on February 23, 2024, and it was entered on the docket on February 26, 2024 (Dkt. 19). On March 5, 2024 the FTC renewed its 2010 data security order. On May 5, 2025 Rite Aid filed for Chapter 11 bankruptcy for the second time; it has since closed all its stores.