The Enterprise AI Failure Casebook

The FTC alleged Rite Aid's facial recognition led staff to confront shoppers it had misidentified

The FTC alleged that Rite Aid ran facial recognition in hundreds of stores without testing its accuracy, and that staff acting on false matches confronted, searched and removed customers.

Rite Aid · December 19, 2023 · Updated October 31, 2026

According to the Federal Trade Commission's complaint, Rite Aid's facial recognition technology generated an alert indicating that a consumer, "specifically a Black woman," was a match for an enrollment image that Rite Aid employees described as depicting "a white lady with blonde hair." The complaint says employees called the police and asked the woman to leave the store before realizing the alert was a false positive. It says Rite Aid conducted an internal investigation into the incident, and alleges that Rite Aid did not modify its policies to address increased risks to consumers based on race and gender.

The complaint alleges that from about October 2012 until July 2020, Rite Aid used facial recognition in hundreds of its pharmacy stores. It says two third-party vendors operated the technology on Rite Aid's behalf, and that most of the stores were in and around New York City, Los Angeles, San Francisco, Philadelphia, Baltimore, Detroit, Atlantic City, Seattle, Portland in Oregon, Wilmington in Delaware, and Sacramento. According to the complaint, cameras captured images of shoppers as they entered or moved through the stores, and the system compared them with a database of people Rite Aid considered "persons of interest." The complaint says Rite Aid trained security staff to "push for as many enrollments as possible" and enrolled at least tens of thousands of people. It says match alerts went to employees' phones, generally without the system's confidence score, and that a majority of enrollments carried the instruction "Approach and Identify": approach the person, ask them to leave, and call the police if they refused.

The FTC alleges the system generated thousands of false-positive matches. According to the complaint, between December 2019 and July 2020 it produced over 5,000 alerts in stores more than 100 miles from the store that created the enrollment. In one five-day period, a single enrollment produced over 900 alerts in over 130 stores. One image uploaded in the Bronx on May 16, 2020 produced over 1,000 alerts by July 2020, over 99 percent of them in or near Los Angeles. The complaint says employees followed shoppers, told them to leave, searched them, publicly accused them of shoplifting and called the police. It says employees stopped and searched an 11-year-old girl on the basis of a false match.

The complaint alleges that an internal presentation arguing for expansion after a pilot named only one risk: "[m]edia attention and customer acceptance." It says Rite Aid did not assess the rate of false-positive alerts during the pilot and did not ask its first vendor whether the technology had been tested for accuracy, and that the vendor's contract with Rite Aid disclaimed the technology's accuracy. When Rite Aid switched vendors, the complaint says, it again sought no test results. According to the complaint, about 60 percent of the stores using the system were in plurality non-White areas, while about 80 percent of all Rite Aid stores were in plurality-White areas. The complaint says Rite Aid made no effort to check whether accuracy varied by race or gender. It says Rite Aid's policy required employees to record the outcome of every alert, and that between December 2019 and July 2020 they did not record about two thirds of them.

The FTC filed its complaint in the U.S. District Court for the Eastern District of Pennsylvania on December 19, 2023. Rite Aid had filed for Chapter 11 bankruptcy on October 15, 2023. The bankruptcy court approved the settlement on January 23, 2024, and Judge Kelley B. Hodge signed the stipulated order on February 23, 2024. Rite Aid neither admitted nor denied the allegations. The order bars Rite Aid for five years from using any facial recognition system in its stores or online. It requires deletion of the photos and videos collected through the system and of any data, models or algorithms derived from them. Before Rite Aid uses any automated biometric surveillance system in its stores or online, it must assess the risks to consumers in writing, designate an employee responsible for a monitoring program, give its board the assessment at least every 12 months, and hold competent and reliable scientific evidence that the system's outputs are likely to be accurate. The Commission order attached to the stipulated order runs for 20 years from its issuance, or longer if the government files a complaint alleging a violation.

What failed

By the FTC's account, Rite Aid put a system into hundreds of stores that told employees to confront, remove or report customers, without first testing whether its matches were accurate. The complaint says the internal case for expansion named one risk, media attention and customer acceptance. It says no one measured false positives in the pilot, asked either vendor for test results, or checked whether errors fell harder on some customers than others, and that once the system was live Rite Aid had no way to track false positives. A use that can lead staff to call the police on a customer belongs in the highest risk tier, where go-live should wait for accuracy testing, a written risk assessment and a named person's sign-off. The settlement order requires Rite Aid to have a written risk assessment, a responsible employee and evidence of accuracy before it uses any automated biometric surveillance system.

Sources

1. FTC, Complaint for Permanent Injunction and Other Relief, FTC v. Rite Aid Corp., No. 2:23-cv-5023 (E.D. Pa., Dec. 19, 2023), Paragraphs 3, 10, 18, 19, 21, 23, 25 to 27, 30, 31(a) to (b), 36, 41, 43, 48, 50, 51, 53, 55, 82, 83, 84(a), 88, 90 and 91
2. U.S. District Court, E.D. Pa., Stipulated Order for Permanent Injunction and Other Relief, FTC v. Rite Aid Corp., No. 2:23-cv-5023, ECF No. 19 (filed Feb. 26, 2024), Findings 5, p. 2; signature, p. 4; Attachment A, Provisions I and II.A, p. 13; Provision III and III.B and C, p. 14; Provision III.F and G.1, p. 20; Provision XVIII, p. 35; Bankruptcy Court order of Jan. 23, 2024, p. 37 (ECF pagination, of 138)