Associated Incidents
The Federal Trade Commission (FTC) on Tuesday banned Rite Aid from using facial recognition powered by artificial intelligence (AI) for surveillance purposes for five years following charges the retailer’s use of AI lacked appropriate safeguards and falsely tagged customers as shoplifters.
In a complaint filed in federal court, the FTC argued that Rite Aid used AI-based facial recognition tools to identify customers who may have engaged in shoplifting or other problematic behavior. The agency said that Rite Aid failed to put in place safeguards to protect employees who were falsely accused of wrongdoing because the facial recognition technology mistakenly flagged them as matching someone previously identified as a shoplifter or other troublemaker.
The FTC said the facial recognition system "generated thousands of false-positive matches" and that it "sometimes matched customers with people who had originally been enrolled in the database based on activity thousands of miles away, or flagged the same person at dozens of different stores" all across the country.
It added that Rite Aid’s technology was also more likely to generate false positives at stores located in plurality-Black and Asian communities, used low-quality images that made false positives more likely and failed to both adequately train employees on the technology and regularly monitor its accuracy.
"Rite Aid’s reckless use of facial surveillance systems left its customers facing humiliation and other harms, and its order violations put consumers’ sensitive information at risk," said Samuel Levine, director of the FTC’s Bureau of Consumer Protection. "Today’s groundbreaking order makes clear that the Commission will be vigilant in protecting the public from unfair biometric surveillance and unfair data security practices."
The FTC will require Rite Aid to implement consumer safeguards when deploying automated systems using biometric information to track them or flag them as security risks. It will also require the company to discontinue the use of technology if can’t control potential risks to consumers, and Rite Aid executives will have to implement a "robust information security program" that has to be "overseen by the company’s top executives."
Rite Aid released a statement saying that it’s "pleased to reach an agreement with the FTC and put this matter behind us," though it noted that while it shares the goal of protecting consumers’ privacy, it took issue with some of the agency’s allegations.
"We respect the FTC’s inquiry and are aligned with the agency’s mission to protect consumer privacy," the company wrote. "However, we fundamentally disagree with the facial recognition allegations in the agency’s complaint. The allegations relate to a facial recognition pilot program the Company deployed in a limited number of stores. Rite Aid stopped using the technology in this small group of stores more than three years ago, before the FTC’s investigation regarding the Company’s use of the technology began."
"Looking ahead, we are focused on the important actions underway to strengthen our financial position as we continue providing leading healthcare products and services to the nearly one million customers that we serve daily," it added.
Rite Aid – the third-largest pharmacy chain in the U.S. – filed for Chapter 11 bankruptcy in October and announced that it would close more than 154 stores in 15 states as it looks to restructure its business. The company closed approximately 210 stores in the fiscal year ending Sept. 30, which left it with a total of 2,100 operating stores.