Background of the FTC’s Legal Action Against Rite Aid
The Federal Trade Commission (FTC) filed a lawsuit against Rite Aid Corporation in 2023, alleging violations of a 2010 data security order. The case centered on Rite Aid’s deployment of facial recognition technology across hundreds of its stores without implementing adequate safeguards to prevent harm to consumers. The FTC’s investigation revealed that the system disproportionately produced false accusations, particularly affecting Black, Latino, and Asian customers.
The lawsuit followed a broader trend of regulatory scrutiny over biometric surveillance systems, which have increasingly been adopted by retailers for security and loss prevention. However, the lack of standardized testing, transparency, or accountability in these systems has raised concerns about their reliability and ethical implications. The FTC’s action against Rite Aid marked a significant step in holding corporations accountable for deploying automated systems that process biometric data without ensuring fairness, accuracy, or consumer protection.
This oversight contributed to the system’s operational flaws, which the FTC argued violated its 2010 order requiring Rite Aid to maintain reasonable data security practices. The proposed settlement reflected the FTC’s determination to enforce stricter controls over biometric surveillance technologies in retail environments.
Key Provisions of the FTC’s Five-Year Ban on Facial Recognition
The FTC’s final order, issued in February 2024, permanently prohibits Rite Aid from using facial recognition technology for security or surveillance purposes for a period of five years. This ban applies to all Rite Aid-owned stores and locations where the retailer operates. The restriction underscores the FTC’s stance that unchecked biometric surveillance poses unacceptable risks to consumers, particularly in contexts where false identifications can lead to harassment, wrongful accusations, or other forms of discrimination.
Beyond the outright ban, the order mandates that Rite Aid implement comprehensive safeguards before deploying any automated systems that rely on biometric information for tracking or flagging individuals as security risks. These safeguards include rigorous testing protocols to assess the accuracy and fairness of the technology, particularly in diverse populations. The FTC’s expectations align with growing calls for bias audits and impact assessments in AI-driven systems, though the order does not prescribe specific methodologies. Instead, it requires Rite Aid to demonstrate that any future biometric systems can be controlled to mitigate risks to consumers.
A critical component of the order is the requirement for Rite Aid to discontinue the use of any biometric surveillance technology if it cannot effectively manage the associated risks.
Mandates for Information Security and Executive Oversight
To address the broader failures in data security that contributed to the facial recognition debacle, the FTC’s order requires Rite Aid to establish a robust information security program. This program must be overseen by the company’s top executives, ensuring that security measures are integrated into corporate governance rather than treated as an afterthought. The program’s scope includes regular audits, employee training, and incident response protocols to prevent future breaches or misuse of consumer data.
This requirement also serves as a precedent for other retailers and organizations that rely on third-party vendors for sensitive technologies, reinforcing the need for comprehensive vendor management practices.
This transparency requirement ensures that the retailer cannot revert to past practices of neglecting oversight or downplaying risks.
Broader Implications for Biometric Surveillance and AI Regulation
The FTC’s action against Rite Aid carries significant implications for the retail industry and the broader adoption of biometric surveillance technologies. While facial recognition systems are often marketed as tools for enhancing security, their deployment without proper safeguards can exacerbate existing biases in AI algorithms.
The order sets a precedent for how regulatory agencies may approach the governance of AI-driven systems that process biometric data. Unlike traditional data privacy laws, which often focus on consent and transparency, the FTC’s approach emphasizes the operational risks posed by untested or poorly managed technologies. This shift reflects a growing recognition that biometric surveillance requires not only legal compliance but also technical and ethical vetting to prevent harm.
For other retailers and businesses considering the use of facial recognition or similar technologies, the Rite Aid case serves as a cautionary example. The FTC’s order makes clear that the absence of reasonable safeguards can result in legal consequences, reputational damage, and financial penalties. Companies must now weigh the potential benefits of biometric surveillance against the regulatory and ethical risks, particularly in an environment where public trust in AI systems remains fragile.
As biometric technologies become more pervasive, stakeholders must work together to establish frameworks that balance innovation with protection against discrimination and misuse.
Required actions
- Rite Aid may not use facial recognition surveillance for five years and must delete the images and models involved - Any future biometric surveillance requires a comprehensive monitoring programme with bias testing, consumer notice and complaint handling