Rite Aid Facial Recognition Case: False Matches and Consumer Harm

The FTC alleged that weak safeguards led to false accusations, searches, and police encounters.

What happened—and what the record establishes

The FTC alleged that Rite Aid used AI-based facial recognition in hundreds of stores without reasonable safeguards, producing false-positive matches that led employees to follow, search, remove, or accuse consumers and sometimes call police. The agency alleged disproportionate effects in some communities of color.

The resulting orders prohibited Rite Aid from using facial recognition for surveillance for five years and required deletion, notice, complaint handling, testing, monitoring, training, and information-security measures. The matter illustrates how the FTC can treat inadequate deployment practices as unfair or deceptive even without a comprehensive federal AI statute.

An FTC order protects public interests but does not automatically compensate every individual or decide state tort claims. A person harmed by a false match may need to evaluate defamation, discrimination, privacy, false imprisonment, or other state-law theories.

Questions the law must answer

• Was the match independently verified before action?
• What data was enrolled and retained?
• Did race, gender, image quality, or store practices affect error rates?

Practical takeaways

• Human review is not meaningful if staff simply trust the alert.
• Biometric notices and retention rules may also apply under state law.
• Obtain incident reports and preserve witness information.