At a glance
- Company
- Rite AidPharmacy and retail chain
- Size
- Enterprise (1,000+ employees) The regulator says the system ran in hundreds of stores.
- Industry
- E-commerce and retail
- Where and when
- United States. 2012–2020, order announced December 2023.
- Who produced the figures
- Official recordEverything on this page comes from the US Federal Trade Commission’s announcement of its complaint and the order Rite Aid agreed to. These are the regulator’s allegations, settled by agreement.
What happened
From 2012 to 2020 Rite Aid used facial recognition in hundreds of its stores. The system compared shoppers’ faces with a database of people the chain suspected of shoplifting or other trouble. When it found a match, it alerted staff.
The system produced many false matches. Staff acted on them. According to the regulator, employees followed shoppers around the store, searched them, called the police and accused them in front of others. Customers were not told the technology was in use.
What the regulator said was missing
- Questions to the vendor. Rite Aid worked with two technology companies. It did not ask either how far the system had been tested for accuracy.
- Its own test. It did not test or measure accuracy before putting the system in stores.
- Checks afterwards. It did not monitor accuracy once the system was running, and did not keep track of false matches or what staff did about them.
- Good inputs. It allowed low-quality images into the database, which made false matches more likely.
- A look at who would be hurt. It did not weigh the risk of misidentifying people, which the regulator said was higher for people of some races and genders.
- Staff training. It did not train staff properly or warn them that alerts could be wrong. It later gave staff a way to report bad matches and did not make sure they used it.
The outcome
- A five-year ban on using facial recognition for surveillance.
- Deletion of the images it had collected and of anything built from them.
- A programme of safeguards for any similar system in future, with outside assessments and a yearly sign-off by the chief executive.
What the case shows
- Buying a system does not move the responsibility to the seller. The regulator held the buyer to account for questions it never asked.
- Test before, and keep testing. Nobody at the chain knew how often the system was wrong, before or after it went live.
- An alert is not a decision. Staff treated a match as proof. Nobody had told them how often it was wrong.
What this says about the practices
Practices that were missing
- Ask AI vendors for proof before you buy, and test on your own material The regulator said Rite Aid did not ask either of its two vendors how far the system had been tested for accuracy. Do first · Effort: medium (weeks, a few people)
- Train staff on the tools you actually chose Staff acted on the system’s alerts without adequate training and without being warned that it produced false matches. Do first · Effort: medium (weeks, a few people)
- Keep a person checking anything that goes to a customer or carries legal weight Employees followed, searched and accused shoppers on the strength of an alert. The chain did not track false matches or what staff did about them. Do first · Effort: medium (weeks, a few people)
- Know the rules that already apply to your AI use The regulator acted under consumer-protection law. It also said Rite Aid had not kept to an earlier order on overseeing its suppliers’ data security. Do first · Effort: low (days, one person)
- Put your own records in order before you ask AI to predict from them The regulator said Rite Aid did not prevent the use of low-quality images in its facial recognition database, which made false matches more likely. Do next · Effort: medium (weeks, a few people)
Sources
- US Federal Trade Commission (19 December 2023). Rite Aid banned from using AI facial recognition after FTC says retailer deployed technology without reasonable safeguards. Press release. ftc.gov