Store staff act on facial recognition alerts that the FTC alleges were often false

The FTC alleged that Rite Aid’s employees acted on facial recognition alerts they had little means to judge, while thousands of false positives went unaddressed. Rite Aid disputed the allegations.

Date: 2012–2020
Kind of system: Predictive or matching model
Outcome: Harm

Gaps found

G1G2G3G4G5G6G7G8G9G10G11G12G13

G5 Blind to the total G7 Review in name only G9 Warning with no authority

What happened

According to the FTC’s complaint, Rite Aid used facial recognition in stores from 2012 to 2020, enrolling at least tens of thousands of people in a watchlist, often from low-quality images. When the system matched a shopper, employees received an alert with both images and an instruction to carry out if they believed the match was accurate, such as to approach the person or call 911. The alerts generally did not include the system’s confidence score.

The FTC alleged that employees recorded thousands of false-positive alerts between December 2019 and July 2020, and that one enrollment produced more than 1,000 alerts in about two months. It also alleged that Rite Aid did not test the system’s accuracy before deploying it or regularly monitor it afterward, and had no way to track false positives. In the December 2023 settlement, Rite Aid neither admitted nor denied the allegations, and it said publicly that it disagreed with them. The order bars it from using facial recognition in its stores and online retail platforms for five years.

What allowed the action to take effect

G5 Blind to the total
Each action was allowed one at a time. Nothing tracked what the actions added up to in volume, rate, exposure, or repetition until the total did the harm.
From May to July 2020, one enrollment “generated over 1,000 match alerts,” nearly 5% of all alerts in that period, and Rite Aid had “no way to track false positives.”
Kind of evidence: allegation. Source: Federal Trade Commission, 19 December 2023, “FTC v. Rite Aid Corporation, Complaint for Permanent Injunction and Other Relief”, ¶¶ 83, 84(a).
Related guidance: P8 Sequence awareness. Contract clause C-8.
G7 Review in name only
A person was supposed to catch the error but lacked the information, time, training, or practical means to do it, so the review did not work as a check.
Alerts “generally did not include confidence scores,” and employees were told to take the stated action “if the employees believed the match to be accurate.” In nearly all cases Rite Aid did not verify that employees had received the one to two hours of training its policy called for.
Kind of evidence: allegation. Source: Federal Trade Commission, 19 December 2023, “FTC v. Rite Aid Corporation, Complaint for Permanent Injunction and Other Relief”, ¶¶ 27–28, 67.
Related guidance: P5 Human authority. Contract clause C-5.
G9 Warning with no authority
Signs that the action was wrong existed before or during the harm, but none of them could stop or hold the action, and nothing required anyone to act on them.
Employees “recorded thousands of false positive match alerts” and complained about them, and Rite Aid “failed to modify its policies to address increased risks to consumers based on race and gender even after its facial recognition technology generated egregious results.”
Kind of evidence: allegation. Source: Federal Trade Commission, 19 December 2023, “FTC v. Rite Aid Corporation, Complaint for Permanent Injunction and Other Relief”, ¶¶ 31, 48.
Related guidance: P3 Fail-closed and P8 Sequence awareness. Contract clauses C-3 and C-8.

Considered and left out

G6 No independent evidence: Employees could compare the live image with the enrollment image before acting, so the decision was not based on the system’s output alone. The weakness of that comparison falls under G7.

Entries with gaps in common

Sources

Legal filingFTC v. Rite Aid Corporation, Complaint for Permanent Injunction and Other ReliefFederal Trade Commission, 19 December 2023
Court recordStipulated Order for Permanent Injunction and Other Relief, FTC v. Rite Aid Corporation, No. 2:23-cv-5023U.S. District Court, Eastern District of Pennsylvania, 19 December 2023
Official recordRite Aid Banned from Using AI Facial Recognition After FTC Says Retailer Deployed Technology without Reasonable SafeguardsFederal Trade Commission, 19 December 2023
Company statementRite Aid Reaches Settlement with FTCRite Aid, via Business Wire, December 2023

Cite this entry

External Control Layer. (2026). Entry 7: Store staff act on facial recognition alerts that the FTC alleges were often false. In Control Gap Record (Version 0.3). G-14, Inc. https://externalcontrollayer.ai/record-7

@misc{ecl_cgr_7,
  author = {{External Control Layer}},
  title = {Entry 7: Store staff act on facial recognition alerts that the FTC alleges were often false},
  howpublished = {Control Gap Record, version 0.3},
  publisher = {G-14, Inc.},
  year = {2026},
  url = {https://externalcontrollayer.ai/record-7},
  note = {Released 2 November 2026}
}

Uses Control Gap Classification 0.2.

Correct this entry

Email ecl@g14.ai with “ECL record 7” in the subject line.

Write the email

Facts about this incident

When: 2012 to 2020; the alert data in the complaint cover December 2019 to July 2020
Who: Rite Aid
System: AI facial recognition from two vendors, matching shoppers against a watchlist
Kind of system: Predictive or matching model
Sector: Consumer and retail
Action: According to the FTC’s complaint, employees followed, searched, removed, and called the police on shoppers flagged by match alerts, many of them false.
Why it acted: Model error. According to the FTC, the system produced false-positive matches, made more likely by low-quality enrollment images.
Outcome: Harm. The FTC alleged that people were publicly accused, searched, and removed from stores on false matches, including an 11-year-old girl who was stopped and searched. The settlement order bars Rite Aid from using facial recognition in its stores and online retail platforms for five years.
Confidence: Medium. Detailed FTC allegations drawn from Rite Aid’s own records. The company neither admitted nor denied them in the settlement and disputes them publicly.