U.S. Federal Trade Commission (FTC) — Rite Aid Corporation
FTC banned Rite Aid from using facial-recognition AI in any form for 5 years after finding the company deployed the technology in hundreds of stores without reasonable safeguards. The system disproportionately misidentified women and people of colour as shoplifters, leading to wrongful detentions and humiliating searches. Cited FTC Act §5 (unfair and deceptive practices). The same biometric-identification deployment in a US jurisdiction with an AI law (e.g. Colorado AI Act once 'consequential decisions' kicks in, or any future federal AI law) would face direct duties on bias testing, deployer impact assessments and consumer notice.
Key takeaway — how to prevent this
Biometric data (faces, iris, fingerprints) needs an explicit lawful basis or consent. Scraping or capturing it without one is unlawful across the EU/UK and many US states (e.g. Illinois BIPA) — and draws the largest fines.
Case brief
Read from the authority's press release on 2026-09-19. Every holding carries a short verbatim quote from that text.
- Decided by
- Federal Trade Commission
- Parties
- Federal Trade Commission v. Rite Aid Corporation
- Decision date
- December 19, 2023
- Remedy
- Rite Aid is banned from using facial recognition technology for surveillance for five years, must delete collected images and derived algorithms, and must implement comprehensive biometric safeguards and an information security program.
- Appeal
- Appeal status not stated
Key holdings
Rite Aid deployed AI-based facial recognition systems without reasonable safeguards to identify potential shoplifters.
“Rite Aid deployed artificial intelligence-based facial recognition technology in order to identify customers who may have been engaged in shoplifting or other problematic behavior.”
Rite Aid failed to test or assess the accuracy of its technology, resulting in false positives that disproportionately impacted Black and Asian communities.
“Rite Aid’s facial recognition technology was more likely to generate false positives in stores located in plurality-Black and Asian communities than in plurality-White communities”
Rite Aid agreed to a five-year ban on using facial recognition technology for surveillance purposes to settle FTC charges.
“Rite Aid will be prohibited from using facial recognition technology for surveillance purposes for five years to settle Federal Trade Commission charges”
Rite Aid violated a prior 2010 FTC data security order by failing to adequately oversee third-party vendors and maintain a comprehensive security program.
“In its complaint, the FTC also says Rite Aid violated its 2010 data security order with the Commission by failing to adequately implement a comprehensive information security program.”
In plain English
Between 2012 and 2020, Rite Aid Corporation deployed artificial intelligence-based facial recognition technology in hundreds of stores to identify customers suspected of shoplifting or other problematic behavior. According to a Federal Trade Commission complaint filed in federal court, Rite Aid failed to take reasonable measures to ensure the accuracy of the technology or prevent harm to consumers. As a result, the system generated thousands of false positive matches. Employees acting on these false alerts followed customers around stores, searched them, ordered them to leave, publicly accused them of wrongdoing, and summoned police officers. The Federal Trade Commission found that these false matches disproportionately impacted women and people of color, particularly in plurality-Black and Asian communities. Additionally, the FTC alleged that Rite Aid violated a 2010 data security order by failing to adequately oversee third-party service providers handling sensitive consumer data. To settle the FTC charges, Rite Aid agreed to a proposed order filed in the Eastern District of Pennsylvania. Under the order, Rite Aid is banned from using facial recognition technology for surveillance purposes for five years. The company must also delete all collected consumer photos, images, and algorithms created from them, implement comprehensive biometric safeguards, establish a robust information security program overseen by top executives, and provide annual compliance certifications from its Chief Executive Officer.
Inclusion does not imply wrongdoing or liability. Status reflects the latest information we have — always check the official source for current status.