FTC v Rite Aid (facial recognition surveillance order)

5 years

Ban on facial recognition for surveillance

FTC stipulated order

2012 to 2020

Period of deployment alleged

FTC complaint

Thousands

False-positive matches alleged, often of people of colour and women

FTC complaint

What happened?

The FTC's complaint alleged that Rite Aid ran facial recognition in roughly 200 stores, mostly in lower-income and non-white neighbourhoods, to flag people previously logged as shoplifters. Enrolment images were often low quality, taken from CCTV or phone cameras, and the system generated thousands of false matches. Staff acting on alerts followed, searched and ejected customers, and in some cases called the police, on the strength of a false positive. The complaint said Rite Aid did not test the system's accuracy, did not train staff, did not tell customers, and did not monitor its vendors.

1. 2012

   Deployment begins

   Facial recognition installed in a first set of stores.

2. 2020-07

   Reuters investigation

   Reporting documents the programme; Rite Aid says it has ended it.

3. 2023-10

   Chapter 11 filing

   Rite Aid enters bankruptcy, which affects how the order is approved.

4. 2023-12-19

   FTC complaint and proposed order

   Five-year ban and safeguards announced.

5. 2024

   Approvals

   The order required bankruptcy and district court approval before taking effect.

What did the order require?

• No facial recognition or analysis for security or surveillance, in stores or online, for five years.
• Deletion of the images and face data collected, and instructions to vendors to delete what they held.
• Before any future biometric system: a written monitoring programme, accuracy testing, notice to consumers, a way to complain, and a halt if the system causes more harm than benefit.
• Modification of a 2010 FTC order, which the Commission said Rite Aid had violated by failing to oversee its service providers' data security.

Why does it matter for face search?

The FTC used Section 5 of the FTC Act, its general unfairness power, rather than a biometric statute. That reasoning reaches any company whose face-matching system causes harm through inaccuracy, lack of testing or lack of notice, whether a retailer, a vendor or a search engine. The order's conditions (accuracy testing, bias assessment, notice, redress) read as a baseline that an enforcement action against a face search engine would borrow. Face search engines typically avoid the retail scenario by not claiming identification, but a result used to accuse someone is the same harm the FTC described (see accuracy, bias and testing).

What happened next?

Rite Aid disputed the allegations and described the programme as a pilot in a limited number of stores. Because the company was in bankruptcy, the order took effect only after approval by the bankruptcy court and the district court, which followed in 2024. The FTC cited the case in its 2024 policy statement on biometric information and in later actions involving automated decision systems. Rite Aid's broader restructuring continued through 2024 and 2025.